diff --git a/lightway-core/src/connection.rs b/lightway-core/src/connection.rs
index 96845377..b1cd608f 100644
--- a/lightway-core/src/connection.rs
+++ b/lightway-core/src/connection.rs
@@ -869,8 +869,8 @@ impl<AppState: Send> Connection<AppState> {
         let msg = wire::Frame::Goodbye;
 
         // here, goodbye + shutdown are just a courtesy.
-        self.send_frame_or_drop(msg)?;
-        let _ = self.session.try_shutdown()?;
+        let _ = self.send_frame_or_drop(msg);
+        let _ = self.session.try_shutdown();
 
         self.set_state(State::Disconnected)?;
 
diff --git a/lightway-server/src/io/outside/tcp.rs b/lightway-server/src/io/outside/tcp.rs
index ff23a578..9d6fdb5f 100644
--- a/lightway-server/src/io/outside/tcp.rs
+++ b/lightway-server/src/io/outside/tcp.rs
@@ -137,7 +137,6 @@ async fn handle_connection(
         match sock.try_read_buf(&mut buf) {
             Ok(0) => {
                 // EOF
-                conn.handle_end_of_stream();
                 break anyhow!("End of stream");
             }
             Ok(_nr) => {}
@@ -157,6 +156,8 @@ async fn handle_connection(
         }
     };
 
+    conn.handle_end_of_stream();
+
     info!("Connection closed: {:?}", err);
 }
 
diff --git a/lightway-server/src/lib.rs b/lightway-server/src/lib.rs
index d3317de2..0bcd6a3e 100644
--- a/lightway-server/src/lib.rs
+++ b/lightway-server/src/lib.rs
@@ -253,9 +253,11 @@ pub async fn server<SA: for<'a> ServerAuth<AuthState<'a>> + Sync + Send + 'stati
                         metrics::tun_rejected_packet_invalid_inside_packet();
                     }
                     Err(err) => {
-                        metrics::tun_rejected_packet_invalid_other();
-                        // TODO: fatal vs non-fatal;
-                        break Err(anyhow!(err).context("Inside data handling error"));
+                        let fatal = err.is_fatal(conn.connection_type());
+                        metrics::tun_rejected_packet_invalid_other(fatal);
+                        if fatal {
+                            conn.handle_end_of_stream();
+                        }
                     }
                 }
             } else {
diff --git a/lightway-server/src/metrics.rs b/lightway-server/src/metrics.rs
index 9754b11a..01182814 100644
--- a/lightway-server/src/metrics.rs
+++ b/lightway-server/src/metrics.rs
@@ -61,8 +61,7 @@ static METRIC_TUN_REJECTED_INVALID_STATE: LazyLock<Counter> =
     LazyLock::new(|| counter!("tun_rejected_packet_invalid_state"));
 static METRIC_TUN_REJECTED_INVALID_INSIDE_PACKET: LazyLock<Counter> =
     LazyLock::new(|| counter!("tun_rejected_packet_invalid_inside_packet"));
-static METRIC_TUN_REJECTED_OTHER: LazyLock<Counter> =
-    LazyLock::new(|| counter!("tun_rejected_packet_invalid_other"));
+static METRIC_TUN_REJECTED_OTHER: &str = "tun_rejected_packet_invalid_other";
 static METRIC_TUN_REJECTED_NO_CONNECTION: LazyLock<Counter> =
     LazyLock::new(|| counter!("tun_rejected_packet_no_connection"));
 static METRIC_TUN_REJECTED_NO_CLIENT_IP: LazyLock<Counter> =
@@ -279,8 +278,8 @@ pub(crate) fn tun_rejected_packet_invalid_inside_packet() {
 }
 
 /// Tunnel rejected packet, other reasons
-pub(crate) fn tun_rejected_packet_invalid_other() {
-    METRIC_TUN_REJECTED_OTHER.increment(1);
+pub(crate) fn tun_rejected_packet_invalid_other(fatal: bool) {
+    counter!(METRIC_TUN_REJECTED_OTHER, FATAL_LABEL => fatal.to_string()).increment(1);
 }
 
 /// Tunnel rejected packet, no corresponding