diff --git a/libi2pd/NTCP2.cpp b/libi2pd/NTCP2.cpp
index 25dc353c..1138db3e 100644
--- a/libi2pd/NTCP2.cpp
+++ b/libi2pd/NTCP2.cpp
@@ -1077,6 +1077,12 @@ namespace transport
 			Terminate ();
 			return;
 		}
+		if (ri1->GetVersion () < i2p::data::NETDB_MIN_ALLOWED_VERSION && !ri1->IsHighBandwidth ())
+		{
+			LogPrint (eLogInfo, "NTCP2: Router version ", ri1->GetVersion (), " is too old in SessionConfirmed");
+			SendTerminationAndTerminate (eNTCP2Banned);
+			return;
+		}
 		// TODO: process options block
 
 		// ready to communicate
diff --git a/libi2pd/NetDb.hpp b/libi2pd/NetDb.hpp
index a669a07c..3eabf395 100644
--- a/libi2pd/NetDb.hpp
+++ b/libi2pd/NetDb.hpp
@@ -54,6 +54,7 @@ namespace data
 	const int NETDB_MIN_FLOODFILL_VERSION = MAKE_VERSION_NUMBER(0, 9, 62); // 0.9.62
 	const int NETDB_MIN_SHORT_TUNNEL_BUILD_VERSION = MAKE_VERSION_NUMBER(0, 9, 51); // 0.9.51
 	const int NETDB_MIN_PEER_TEST_VERSION = MAKE_VERSION_NUMBER(0, 9, 62); // 0.9.62
+	const int NETDB_MIN_ALLOWED_VERSION = MAKE_VERSION_NUMBER(0, 9, 58); // 0.9.58
 	const size_t NETDB_MAX_NUM_SEARCH_REPLY_PEER_HASHES = 16;
 	const size_t NETDB_MAX_EXPLORATORY_SELECTION_SIZE = 500;
 	const int NETDB_EXPLORATORY_SELECTION_UPDATE_INTERVAL = 82; // in seconds. for floodfill
diff --git a/libi2pd/SSU2Session.cpp b/libi2pd/SSU2Session.cpp
index 19d05dce..a71315bc 100644
--- a/libi2pd/SSU2Session.cpp
+++ b/libi2pd/SSU2Session.cpp
@@ -1227,6 +1227,11 @@ namespace transport
 				i2p::transport::transports.AddBan (m_RemoteEndpoint.address ());
 			return false;
 		}
+		if (ri->GetVersion () < i2p::data::NETDB_MIN_ALLOWED_VERSION && !ri->IsHighBandwidth ())
+		{
+			LogPrint (eLogInfo, "SSU2: Router version ", ri->GetVersion (), " is too old in SessionConfirmed");
+			return false;
+		}
 		if (!m_Address->published)
 		{
 			if (ri->HasProfile ())
diff --git a/libi2pd/Transports.cpp b/libi2pd/Transports.cpp
index f22db285..59d0064f 100644
--- a/libi2pd/Transports.cpp
+++ b/libi2pd/Transports.cpp
@@ -506,7 +506,9 @@ namespace transport
 			try
 			{
 				auto r = netdb.FindRouter (ident);
-				if (r && (r->IsUnreachable () || !r->IsReachableFrom (i2p::context.GetRouterInfo ()))) return nullptr; // router found but non-reachable
+				if (r && (r->IsUnreachable () || !r->IsReachableFrom (i2p::context.GetRouterInfo ()) ||
+					(r->GetVersion () < i2p::data::NETDB_MIN_ALLOWED_VERSION && !r->IsHighBandwidth ())))
+					return nullptr; // router found but non-reachable or too old
 
 				peer = std::make_shared<Peer>(r, i2p::util::GetSecondsSinceEpoch ());
 				{