diff --git a/router/crypto.go b/router/crypto.go
index 8b83f81b..803858aa 100644
--- a/router/crypto.go
+++ b/router/crypto.go
@@ -286,7 +286,7 @@ func (nd *NaClDecryptor) ReceiveNonce(msg []byte) {
 func (nd *NaClDecryptor) IterateFrames(fun FrameConsumer, packet *UDPPacket) error {
 	buf, err := nd.decrypt(packet.Packet)
 	if err != nil {
-		return PacketDecodingError{Desc: fmt.Sprint("decryption failed; ", err)}
+		return PacketDecodingError{Fatal: true, Desc: fmt.Sprint("decryption failed; ", err)}
 	}
 	packet.Packet = buf
 	return nd.NonDecryptor.IterateFrames(fun, packet)
diff --git a/router/router.go b/router/router.go
index 08825bd5..f9736641 100644
--- a/router/router.go
+++ b/router/router.go
@@ -209,7 +209,11 @@ func (router *Router) udpReader(conn *net.UDPConn, po PacketSink) {
 		}
 		err = relayConn.Decryptor.IterateFrames(handleUDPPacket, udpPacket)
 		if pde, ok := err.(PacketDecodingError); ok {
-			relayConn.log(pde.Error())
+			if pde.Fatal {
+				relayConn.CheckFatal(pde)
+			} else {
+				relayConn.log(pde.Error())
+			}
 		} else {
 			checkWarn(err)
 		}
diff --git a/router/types.go b/router/types.go
index e6acb90b..5c236c24 100644
--- a/router/types.go
+++ b/router/types.go
@@ -114,7 +114,8 @@ type NameCollisionError struct {
 }
 
 type PacketDecodingError struct {
-	Desc string
+	Fatal bool
+	Desc  string
 }
 
 type LocalAddress struct {