diff --git a/libi2pd/Config.cpp b/libi2pd/Config.cpp
index 939cd9ff..3d88ff21 100644
--- a/libi2pd/Config.cpp
+++ b/libi2pd/Config.cpp
@@ -305,6 +305,8 @@ namespace config {
 			("ssu2.mtu4", value<uint16_t>()->default_value(0),            "MTU for ipv4 address (default: detect)")
 			("ssu2.mtu6", value<uint16_t>()->default_value(0),            "MTU for ipv6 address (default: detect)")
 			("ssu2.proxy", value<std::string>()->default_value(""),       "Socks5 proxy URL for SSU2 transport")
+			("ssu2.firewalled4", value<bool>()->default_value(false),     "Set ipv4 network status to Firewalled even if OK (default: disabled)")
+			("ssu2.firewalled6", value<bool>()->default_value(false),     "Set ipv6 network status to Firewalled even if OK (default: disabled)")
 		;
 
 		options_description nettime("Time sync options");
diff --git a/libi2pd/SSU2.cpp b/libi2pd/SSU2.cpp
index fc2355a5..4540b4d2 100644
--- a/libi2pd/SSU2.cpp
+++ b/libi2pd/SSU2.cpp
@@ -25,7 +25,8 @@ namespace transport
 		m_TerminationTimer (GetService ()), m_CleanupTimer (GetService ()), m_ResendTimer (GetService ()),
 		m_IntroducersUpdateTimer (GetService ()), m_IntroducersUpdateTimerV6 (GetService ()),
 		m_IsPublished (true), m_IsSyncClockFromPeers (true), m_PendingTimeOffset (0),
-		m_Rng(i2p::util::GetMonotonicMicroseconds ()%1000000LL), m_IsThroughProxy (false)
+		m_Rng(i2p::util::GetMonotonicMicroseconds ()%1000000LL), m_IsForcedFirewalled4 (false),
+		m_IsForcedFirewalled6 (false), m_IsThroughProxy (false)
 	{
 	}
 
@@ -79,6 +80,7 @@ namespace transport
 						if (address->IsV4 ())
 						{
 							found = true;
+							i2p::config::GetOption ("ssu2.firewalled4",  m_IsForcedFirewalled4);
 							LogPrint (eLogDebug, "SSU2: Opening IPv4 socket at Start");
 							OpenSocket (boost::asio::ip::udp::endpoint (m_AddressV4, port));
 							boost::asio::post (m_ReceiveService.GetService (),
@@ -91,6 +93,7 @@ namespace transport
 						if (address->IsV6 ())
 						{
 							found = true;
+							i2p::config::GetOption ("ssu2.firewalled6",  m_IsForcedFirewalled6);
 							LogPrint (eLogDebug, "SSU2: Opening IPv6 socket at Start");
 							OpenSocket (boost::asio::ip::udp::endpoint (m_AddressV6, port));
 							boost::asio::post (m_ReceiveService.GetService (),
diff --git a/libi2pd/SSU2.h b/libi2pd/SSU2.h
index a8598ce3..b7214480 100644
--- a/libi2pd/SSU2.h
+++ b/libi2pd/SSU2.h
@@ -79,6 +79,7 @@ namespace transport
 			bool UsesProxy () const { return m_IsThroughProxy; };
 			bool IsSupported (const boost::asio::ip::address& addr) const;
 			uint16_t GetPort (bool v4) const;
+			bool IsForcedFirewalled (bool v4) const { return v4 ? m_IsForcedFirewalled4 : m_IsForcedFirewalled6; }
 			bool IsConnectedRecently (const boost::asio::ip::udp::endpoint& ep, bool max = true);
 			void AddConnectedRecently (const boost::asio::ip::udp::endpoint& ep, uint64_t ts);
 			std::mt19937& GetRng () { return m_Rng; }
@@ -208,6 +209,7 @@ namespace transport
 			i2p::crypto::AEADChaCha20Poly1305Encryptor m_Encryptor;
 			i2p::crypto::AEADChaCha20Poly1305Decryptor m_Decryptor;
 			i2p::crypto::ChaCha20Context m_ChaCha20;
+			bool m_IsForcedFirewalled4, m_IsForcedFirewalled6;
 		
 			// proxy
 			bool m_IsThroughProxy;
diff --git a/libi2pd/SSU2OutOfSession.cpp b/libi2pd/SSU2OutOfSession.cpp
index 3760e329..dc626b16 100644
--- a/libi2pd/SSU2OutOfSession.cpp
+++ b/libi2pd/SSU2OutOfSession.cpp
@@ -90,6 +90,9 @@ namespace transport
 				if (htobe64 (((uint64_t)nonce << 32) | nonce) == GetSourceConnID ())
 				{
 					m_PeerTestResendTimer.cancel (); // cancel delayed msg 6 if any
+					if (GetServer ().IsForcedFirewalled (GetRemoteEndpoint ().address().is_v4())) 
+						// we assume that msg 5 was not received if forced firewalled
+						return; 
 					m_IsConnectedRecently = GetServer ().IsConnectedRecently (GetRemoteEndpoint ());
 					if (GetAddress ())
 					{