diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index c28afe2e8..ac8a564b2 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -876,6 +876,7 @@ func (c *Conn) runDerpReader(ctx context.Context, derpFakeAddr *net.UDPAddr, dc
 				return
 			default:
 			}
+			c.ReSTUN("derp-close")
 			c.logf("[%p] derp.Recv(derp%d): %v", dc, derpFakeAddr.Port, err)
 			time.Sleep(250 * time.Millisecond)
 			continue