diff --git a/llarp/exit/endpoint.cpp b/llarp/exit/endpoint.cpp
index a99eabeea..737c10949 100644
--- a/llarp/exit/endpoint.cpp
+++ b/llarp/exit/endpoint.cpp
@@ -119,6 +119,8 @@ namespace llarp
         if (not quic)
           return false;
         quic->receive_packet(tag, buf.underlying);
+        m_LastActive = m_Parent->Now();
+        m_TxRate += buf.underlying.sz;
         return true;
       }
       // queue overflow
diff --git a/llarp/handlers/exit.cpp b/llarp/handlers/exit.cpp
index 48a643e53..3741f2246 100644
--- a/llarp/handlers/exit.cpp
+++ b/llarp/handlers/exit.cpp
@@ -115,10 +115,10 @@ namespace llarp
             }
           }
 
-          std::vector<byte_t> data{};
-          data.resize(payload.sz);
-          std::copy_n(payload.base, data.size(), data.data());
-          ObtainSNodeSession(*rid, [data, type](auto session) {
+          if (not m_Router->ConnectionToRouterAllowed(*rid))
+            return false;
+
+          ObtainSNodeSession(*rid, [data = payload.copy(), type](auto session) {
             if (session and session->IsReady())
             {
               session->SendPacketToRemote(data, type);
@@ -141,20 +141,28 @@ namespace llarp
         return false;
       if (auto* rid = std::get_if<RouterID>(&addr))
       {
-        ObtainSNodeSession(
-            *rid, [hook, routerID = *rid](std::shared_ptr<exit::BaseSession> session) {
-              if (session and session->IsReady())
-              {
-                if (auto path = session->GetPathByRouter(routerID))
+        if (m_SNodeKeys.count(PubKey{*rid}) or m_Router->ConnectionToRouterAllowed(*rid))
+        {
+          ObtainSNodeSession(
+              *rid, [hook, routerID = *rid](std::shared_ptr<exit::BaseSession> session) {
+                if (session and session->IsReady())
                 {
-                  hook(service::ConvoTag{path->RXID().as_array()});
+                  if (auto path = session->GetPathByRouter(routerID))
+                  {
+                    hook(service::ConvoTag{path->RXID().as_array()});
+                  }
+                  else
+                    hook(std::nullopt);
                 }
                 else
                   hook(std::nullopt);
-              }
-              else
-                hook(std::nullopt);
-            });
+              });
+        }
+        else
+        {
+          // probably a client
+          hook(GetBestConvoTagFor(addr));
+        }
       }
       return true;
     }
diff --git a/llarp/util/buffer.cpp b/llarp/util/buffer.cpp
index 62c516646..2967024eb 100644
--- a/llarp/util/buffer.cpp
+++ b/llarp/util/buffer.cpp
@@ -115,6 +115,15 @@ llarp_buffer_t::read_until(char c_delim, byte_t* result, size_t resultsize)
   return 0;
 }
 
+std::vector<byte_t>
+llarp_buffer_t::copy() const
+{
+  std::vector<byte_t> copy;
+  copy.resize(sz);
+  std::copy_n(base, sz, copy.data());
+  return copy;
+}
+
 bool
 operator==(const llarp_buffer_t& buff, const char* c_str)
 {
diff --git a/llarp/util/buffer.hpp b/llarp/util/buffer.hpp
index a94616ff6..2f2ff10a6 100644
--- a/llarp/util/buffer.hpp
+++ b/llarp/util/buffer.hpp
@@ -171,6 +171,10 @@ struct llarp_buffer_t
   size_t
   read_until(char delim, byte_t* result, size_t resultlen);
 
+  /// make a copy of this buffer
+  std::vector<byte_t>
+  copy() const;
+
  private:
   friend struct ManagedBuffer;
   llarp_buffer_t(const llarp_buffer_t&) = default;