diff --git a/llarp/handlers/tun.cpp b/llarp/handlers/tun.cpp
index 6feee9b1f..e2efa0f7f 100644
--- a/llarp/handlers/tun.cpp
+++ b/llarp/handlers/tun.cpp
@@ -289,6 +289,7 @@ namespace llarp
                                          service::Address addr, auto msg, bool isV6) -> bool {
         using service::Address;
         using service::OutboundContext;
+        MarkAddressOutbound(addr);
         return EnsurePathToService(
             addr,
             [this, addr, msg, reply, isV6](const Address&, OutboundContext* ctx) {
@@ -315,7 +316,7 @@ namespace llarp
                                          service::Address addr, auto msg) -> bool {
         using service::Address;
         using service::OutboundContext;
-
+        MarkAddressOutbound(addr);
         return EnsurePathToService(
             addr,
             [msg, addr, reply](const Address&, OutboundContext* ctx) {
@@ -967,35 +968,34 @@ namespace llarp
             pkt.UpdateIPv6Address({0}, {0});
         }
         // try sending it on an existing convotag
+        // this succeds for inbound convos, probably.
         if (SendToOrQueue(to, pkt.ConstBuffer(), type))
           return;
-        // make sure we are not trying to ensure a path to an inbound session
-        if (const auto* ptr = std::get_if<service::Address>(&to))
-        {
-          // it's an inbound session so let's not build back better
-          if (not WantsOutboundSession(*ptr))
-            return;
-          EnsurePathToService(
-              *ptr,
-              [pkt, type](auto addr, auto* ctx) {
-                if (ctx == nullptr)
-                {
-                  LogWarn("failed to ensure path to ", addr, " so we drop some packets");
-                  return;
-                }
-                ctx->SendPacketToRemote(pkt.ConstBuffer(), type);
-              },
-              PathAlignmentTimeout());
-          return;
-        }
-        // it's an inbound session or a snode session let's gooooo
+        // try establishing a path to this guy
+        // will fail if it's an inbound convo
         EnsurePathTo(
             to,
-            [pkt, type, dst, this](auto maybe) {
-              if (maybe and SendToOrQueue(*maybe, pkt.ConstBuffer(), type))
+            [pkt, type, dst, to, this](auto maybe) {
+              if (not maybe)
+              {
+                var::visit(
+                    [&](auto&& addr) {
+                      LogWarn(Name(), " failed to ensure path to ", addr, " no convo tag found");
+                    },
+                    to);
+              }
+              if (SendToOrQueue(*maybe, pkt.ConstBuffer(), type))
               {
                 MarkIPActive(dst);
               }
+              else
+              {
+                var::visit(
+                    [&](auto&& addr) {
+                      LogWarn(Name(), " failed to send to ", addr, ", SendToOrQueue failed");
+                    },
+                    to);
+              }
             },
             PathAlignmentTimeout());
       });
diff --git a/llarp/service/endpoint.cpp b/llarp/service/endpoint.cpp
index e0c9d9f5c..f11925d04 100644
--- a/llarp/service/endpoint.cpp
+++ b/llarp/service/endpoint.cpp
@@ -1394,12 +1394,19 @@ namespace llarp
     bool
     Endpoint::EnsurePathToService(const Address remote, PathEnsureHook hook, llarp_time_t timeout)
     {
+      if (not WantsOutboundSession(remote))
+      {
+        // we don't want to ensure paths to addresses that are inbound
+        // inform fail right away in that case
+        hook(remote, nullptr);
+        return false;
+      }
+
       /// how many routers to use for lookups
       static constexpr size_t NumParallelLookups = 2;
       /// how many requests per router
       static constexpr size_t RequestsPerLookup = 2;
 
-      MarkAddressOutbound(remote);
       // add response hook to list for address.
       m_state->m_PendingServiceLookups.emplace(remote, hook);
 
@@ -1737,6 +1744,13 @@ namespace llarp
           Loop()->call_soon([tag, hook]() { hook(tag); });
           return true;
         }
+        if (not WantsOutboundSession(*ptr))
+        {
+          // we don't want to connect back to inbound sessions
+          hook(std::nullopt);
+          return true;
+        }
+
         return EnsurePathToService(
             *ptr,
             [hook](auto, auto* ctx) {
diff --git a/llarp/service/endpoint.hpp b/llarp/service/endpoint.hpp
index b8287dab3..740feec01 100644
--- a/llarp/service/endpoint.hpp
+++ b/llarp/service/endpoint.hpp
@@ -285,6 +285,7 @@ namespace llarp
       bool
       WantsOutboundSession(const Address&) const override;
 
+      /// this MUST be called if you want to call EnsurePathTo on the given address
       void
       MarkAddressOutbound(const Address&) override;