diff --git a/router/java/src/net/i2p/router/transport/udp/EstablishmentManager.java b/router/java/src/net/i2p/router/transport/udp/EstablishmentManager.java
index cefb942c8f769eee61f9fdedce81d3a7b99588c5..bc6b576604ff78f14f16c45bb86c1e939ca62c08 100644
--- a/router/java/src/net/i2p/router/transport/udp/EstablishmentManager.java
+++ b/router/java/src/net/i2p/router/transport/udp/EstablishmentManager.java
@@ -1828,7 +1828,7 @@ class EstablishmentManager {
     }
 
     /**
-     *  Remove our outbound tokens for this length
+     *  Remove our tokens for this length
      *
      *  @since 0.9.54
      */
@@ -1845,10 +1845,17 @@ class EstablishmentManager {
                     iter.remove();
             }
         }
+        synchronized(_inboundTokens) {
+            for (Iterator<Map.Entry<RemoteHostId, Token>> iter = _inboundTokens.entrySet().iterator(); iter.hasNext(); ) {
+                Map.Entry<RemoteHostId, Token> e = iter.next();
+                if (e.getKey().getIP().length == len || e.getValue().expires < now)
+                    iter.remove();
+            }
+        }
     }
 
     /**
-     *  Remove all outbound tokens
+     *  Remove all tokens
      *
      *  @since 0.9.54
      */
@@ -1858,6 +1865,9 @@ class EstablishmentManager {
         synchronized(_outboundTokens) {
             _outboundTokens.clear();
         }
+        synchronized(_inboundTokens) {
+            _inboundTokens.clear();
+        }
     }
 
     /**
diff --git a/router/java/src/net/i2p/router/transport/udp/UDPTransport.java b/router/java/src/net/i2p/router/transport/udp/UDPTransport.java
index 415bacc39d598ecad8ecd8bcf41a78f243f6c523..4913eda82a112d2f05162df9c30a2023aa33f401 100644
--- a/router/java/src/net/i2p/router/transport/udp/UDPTransport.java
+++ b/router/java/src/net/i2p/router/transport/udp/UDPTransport.java
@@ -1424,6 +1424,15 @@ public class UDPTransport extends TransportImpl implements TimedWeightedPriority
                     //     (_context.clock().now() - _reachabilityStatusLastUpdated > 2*TEST_FREQUENCY) ) {
                         // they told us something different and our tests are either old or failing
                     if (rebuild) {
+                            if (_enableSSU2) {
+                                // flush SSU2 tokens
+                                if (ourPort != externalListenPort) {
+                                    _establisher.portChanged();
+                                } else if (externalListenHost != null && !Arrays.equals(ourIP, externalListenHost)) {
+                                    _establisher.ipChanged(isIPv6);
+                                }
+                            }
+
                             if (_log.shouldLog(Log.WARN))
                                 _log.warn("Trying to change our external address to " +
                                           Addresses.toString(ourIP, ourPort));