diff --git a/apps/routerconsole/java/src/net/i2p/router/update/ConsoleUpdateManager.java b/apps/routerconsole/java/src/net/i2p/router/update/ConsoleUpdateManager.java
index 17b33a059..f8745f065 100644
--- a/apps/routerconsole/java/src/net/i2p/router/update/ConsoleUpdateManager.java
+++ b/apps/routerconsole/java/src/net/i2p/router/update/ConsoleUpdateManager.java
@@ -1104,7 +1104,7 @@ public class ConsoleUpdateManager implements UpdateManager {
                 if (up.verifyAndMigrate(temp)) {
                     String ver = up.getVersionString();
                     int type = up.getContentType();
-                    if (ver == null || VersionComparator.comp(RouterVersion.VERSION, ver) <= 0)
+                    if (ver == null || VersionComparator.comp(RouterVersion.VERSION, ver) >= 0)
                         err = "Old version " + ver;
                     else if (type != SU3File.CONTENT_ROUTER)
                         err = "Bad su3 content type " + type;
diff --git a/apps/routerconsole/java/src/net/i2p/router/update/UpdateRunner.java b/apps/routerconsole/java/src/net/i2p/router/update/UpdateRunner.java
index 98055fa2d..8a10c5d97 100644
--- a/apps/routerconsole/java/src/net/i2p/router/update/UpdateRunner.java
+++ b/apps/routerconsole/java/src/net/i2p/router/update/UpdateRunner.java
@@ -150,8 +150,14 @@ class UpdateRunner extends I2PAppThread implements UpdateTask, EepGet.StatusList
         boolean isSSL = false;
         if (_method == HTTP) {
             shouldProxy = _context.getProperty(ConfigUpdateHandler.PROP_SHOULD_PROXY, ConfigUpdateHandler.DEFAULT_SHOULD_PROXY);
-            proxyHost = _context.getProperty(ConfigUpdateHandler.PROP_PROXY_HOST, ConfigUpdateHandler.DEFAULT_PROXY_HOST);
-            proxyPort = ConfigUpdateHandler.proxyPort(_context);
+            if (shouldProxy) {
+                proxyHost = _context.getProperty(ConfigUpdateHandler.PROP_PROXY_HOST, ConfigUpdateHandler.DEFAULT_PROXY_HOST);
+                proxyPort = ConfigUpdateHandler.proxyPort(_context);
+            } else {
+                // TODO, wrong method, fail
+                proxyHost = null;
+                proxyPort = 0;
+            }
         } else if (_method == HTTP_CLEARNET) {
             shouldProxy = false;
             proxyHost = null;
@@ -191,7 +197,8 @@ class UpdateRunner extends I2PAppThread implements UpdateTask, EepGet.StatusList
                 _log.debug("Selected update URL: " + updateURL);
 
             // Check the first 56 bytes for the version
-            // PartialEepGet works with clearnet but not with SSL
+            // FIXME PartialEepGet works with clearnet but not with SSL
+            _newVersion = null;
             if (!isSSL) {
                 _isPartial = true;
                 _baos.reset();
@@ -265,6 +272,9 @@ class UpdateRunner extends I2PAppThread implements UpdateTask, EepGet.StatusList
             return;
         }
 
+        // FIXME if we didn't do a partial, we don't know
+        if (_newVersion == null)
+            _newVersion = "unknown";
         File tmp = new File(_updateFile);
         if (_mgr.notifyComplete(this, _newVersion, tmp))
             this.done = true;
diff --git a/core/java/src/net/i2p/util/EepGet.java b/core/java/src/net/i2p/util/EepGet.java
index fa456fee7..3dbc280c8 100644
--- a/core/java/src/net/i2p/util/EepGet.java
+++ b/core/java/src/net/i2p/util/EepGet.java
@@ -1055,12 +1055,14 @@ public class EepGet {
                 URL url = new URL(_actualURL);
                 if ("http".equals(url.getProtocol())) {
                     String host = url.getHost();
+                    if (host.toLowerCase(Locale.US).endsWith(".i2p"))
+                        throw new MalformedURLException("I2P addresses must be proxied");
                     int port = url.getPort();
                     if (port == -1)
                         port = 80;
                     _proxy = new Socket(host, port);
                 } else {
-                    throw new IOException("URL is not supported:" + _actualURL);
+                    throw new MalformedURLException("URL is not supported:" + _actualURL);
                 }
             // an MUE is an IOE
             //} catch (MalformedURLException mue) {
@@ -1089,6 +1091,8 @@ public class EepGet {
             post = true;
         URL url = new URL(_actualURL);
         String host = url.getHost();
+        if (host == null || host.length() <= 0)
+            throw new MalformedURLException("Bad URL, no host");
         int port = url.getPort();
         String path = url.getPath();
         String query = url.getQuery();
diff --git a/core/java/src/net/i2p/util/PartialEepGet.java b/core/java/src/net/i2p/util/PartialEepGet.java
index 7fe625b66..cc93fbb48 100644
--- a/core/java/src/net/i2p/util/PartialEepGet.java
+++ b/core/java/src/net/i2p/util/PartialEepGet.java
@@ -3,6 +3,7 @@ package net.i2p.util;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.net.MalformedURLException;
 import java.net.URL;
 
 import net.i2p.I2PAppContext;
@@ -32,8 +33,10 @@ public class PartialEepGet extends EepGet {
     public PartialEepGet(I2PAppContext ctx, String proxyHost, int proxyPort,
                          OutputStream outputStream,  String url, long size) {
         // we're using this constructor:
-        // public EepGet(I2PAppContext ctx, boolean shouldProxy, String proxyHost, int proxyPort, int numRetries, long minSize, long maxSize, String outputFile, OutputStream outputStream, String url, boolean allowCaching, String etag, String postData) {
-        super(ctx, true, proxyHost, proxyPort, 0, size, size, null, outputStream, url, true, null, null);
+        // public EepGet(I2PAppContext ctx, boolean shouldProxy, String proxyHost, int proxyPort, int numRetries,
+        //               long minSize, long maxSize, String outputFile, OutputStream outputStream, String url, boolean allowCaching, String etag, String postData) {
+        super(ctx, proxyHost != null && proxyPort > 0, proxyHost, proxyPort, 0,
+              size, size, null, outputStream, url, true, null, null);
         _fetchSize = size;
     }
    
@@ -106,6 +109,8 @@ public class PartialEepGet extends EepGet {
         StringBuilder buf = new StringBuilder(2048);
         URL url = new URL(_actualURL);
         String host = url.getHost();
+        if (host == null || host.length() <= 0)
+            throw new MalformedURLException("Bad URL, no host");
         int port = url.getPort();
         String path = url.getPath();
         String query = url.getQuery();
diff --git a/core/java/src/net/i2p/util/SSLEepGet.java b/core/java/src/net/i2p/util/SSLEepGet.java
index 3866f3d1a..311219fe6 100644
--- a/core/java/src/net/i2p/util/SSLEepGet.java
+++ b/core/java/src/net/i2p/util/SSLEepGet.java
@@ -46,6 +46,7 @@ import java.io.InputStream;
 import java.io.OutputStream;
 import java.io.PipedInputStream;
 import java.io.PipedOutputStream;
+import java.net.MalformedURLException;
 import java.net.URL;
 import java.security.KeyStore;
 import java.security.GeneralSecurityException;
@@ -492,6 +493,8 @@ public class SSLEepGet extends EepGet {
             int port = 0;
             if ("https".equals(url.getProtocol())) {
                 host = url.getHost();
+                if (host.toLowerCase(Locale.US).endsWith(".i2p"))
+                    throw new MalformedURLException("I2P addresses unsupported");
                 port = url.getPort();
                 if (port == -1)
                     port = 443;
@@ -500,7 +503,7 @@ public class SSLEepGet extends EepGet {
                 else
                     _proxy = SSLSocketFactory.getDefault().createSocket(host, port);
             } else {
-                throw new IOException("Only https supported: " + _actualURL);
+                throw new MalformedURLException("Only https supported: " + _actualURL);
             }
         // an MUE is an IOE
         //} catch (MalformedURLException mue) {