diff --git a/go.mod b/go.mod
index 1d6d2f5f4..957df3f4d 100644
--- a/go.mod
+++ b/go.mod
@@ -28,6 +28,6 @@ require (
 	golang.org/x/sys v0.0.0-20200317113312-5766fd39f98d
 	golang.org/x/time v0.0.0-20191024005414-555d28b269f0
 	gortc.io/stun v1.22.1
-	inet.af/netaddr v0.0.0-20200417204647-17eccff2620c
+	inet.af/netaddr v0.0.0-20200417213433-f9e5bcc2d6ea
 	rsc.io/goversion v1.2.0
 )
diff --git a/go.sum b/go.sum
index f35617613..8c42ab282 100644
--- a/go.sum
+++ b/go.sum
@@ -151,5 +151,9 @@ inet.af/netaddr v0.0.0-20200417144406-01f6d1b213c8 h1:flBh+hqli1lALDWbRAkX2Cs7QS
 inet.af/netaddr v0.0.0-20200417144406-01f6d1b213c8/go.mod h1:qqYzz/2whtrbWJvt+DNWQyvekNN4ePQZcg2xc2/Yjww=
 inet.af/netaddr v0.0.0-20200417204647-17eccff2620c h1:MzkYVBmOE/xWhdLv/R4ycVJ2On0j00w5gtboXBIqnE8=
 inet.af/netaddr v0.0.0-20200417204647-17eccff2620c/go.mod h1:qqYzz/2whtrbWJvt+DNWQyvekNN4ePQZcg2xc2/Yjww=
+inet.af/netaddr v0.0.0-20200417205003-27c4b435b671 h1:rZdhNZoQfq9HLsGYWHYkNNa2hnSMH2wu0VdXZDA3mXs=
+inet.af/netaddr v0.0.0-20200417205003-27c4b435b671/go.mod h1:qqYzz/2whtrbWJvt+DNWQyvekNN4ePQZcg2xc2/Yjww=
+inet.af/netaddr v0.0.0-20200417213433-f9e5bcc2d6ea h1:DpXewrGVf9+vvYQFrNGj9v34bXMuTVQv+2wuULTNV8I=
+inet.af/netaddr v0.0.0-20200417213433-f9e5bcc2d6ea/go.mod h1:qqYzz/2whtrbWJvt+DNWQyvekNN4ePQZcg2xc2/Yjww=
 rsc.io/goversion v1.2.0 h1:SPn+NLTiAG7w30IRK/DKp1BjvpWabYgxlLp/+kx5J8w=
 rsc.io/goversion v1.2.0/go.mod h1:Eih9y/uIBS3ulggl7KNJ09xGSLcuNaLgmvvqa07sgfo=
diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index e5865a524..55bff731f 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -1513,7 +1513,8 @@ type AddrSet struct {
 	//     [DERP fakeip:node, Global IP:port, LAN ip:port]
 	//
 	// But there could be multiple or none of each.
-	addrs []net.UDPAddr
+	addrs   []net.UDPAddr
+	ipPorts []netaddr.IPPort // same as addrs, in different form
 
 	// clock, if non-nil, is used in tests instead of time.Now.
 	clock func() time.Time
@@ -1748,12 +1749,17 @@ func (c *Conn) CreateEndpoint(key [32]byte, addrs string) (conn.Endpoint, error)
 
 	if addrs != "" {
 		for _, ep := range strings.Split(addrs, ",") {
-			addr, err := net.ResolveUDPAddr("udp", ep)
+			ua, err := net.ResolveUDPAddr("udp", ep)
 			if err != nil {
 				return nil, err
 			}
-			addr.IP = ip4or6(addr.IP)
-			a.addrs = append(a.addrs, *addr)
+			ipp, ok := netaddr.FromStdAddr(ua.IP, ua.Port, ua.Zone)
+			if !ok {
+				return nil, fmt.Errorf("bogus address %q", ep)
+			}
+			ua.IP = ipp.IP.IPAddr().IP // makes IPv4 addresses 4 bytes long
+			a.ipPorts = append(a.ipPorts, ipp)
+			a.addrs = append(a.addrs, *ua)
 		}
 	}
 
@@ -1903,13 +1909,6 @@ func peerShort(k key.Public) string {
 	return k2.ShortString()
 }
 
-func ip4or6(ip net.IP) net.IP {
-	if ip4 := ip.To4(); ip4 != nil {
-		return ip4
-	}
-	return ip
-}
-
 func sbPrintAddr(sb *strings.Builder, a net.UDPAddr) {
 	is6 := a.IP.To4() == nil
 	if is6 {