diff --git a/BUGS b/BUGS
index 70aeb9f..24e6639 100644
--- a/BUGS
+++ b/BUGS
@@ -1,5 +1,5 @@
 known problems/assumptions:
- - does not handle protocols other than ICMP, UDP, TCP and GRE
+ - does not handle protocols other than ICMP, UDP, TCP and GRE/ESP
  - assumes the handset has its own (routed) /64 ipv6 subnet
  - assumes the /128 ipv6 subnet it generates can use the nat64 gateway
  - assumes the nat64 gateway has the ipv4 address in the last 32 bits of the ipv6 address (that it uses a /96 plat subnet)
diff --git a/ipv4.c b/ipv4.c
index 56d83ac..c052d03 100644
--- a/ipv4.c
+++ b/ipv4.c
@@ -131,7 +131,7 @@
   } else if (nxthdr == IPPROTO_UDP) {
     iov_len =
       udp_packet(out, pos + 2, (const struct udphdr *)next_header, old_sum, new_sum, len_left);
-  } else if (nxthdr == IPPROTO_GRE) {
+  } else if (nxthdr == IPPROTO_GRE || nxthdr == IPPROTO_ESP) {
     iov_len = generic_packet(out, pos + 2, next_header, len_left);
   } else {
 #if CLAT_DEBUG
diff --git a/ipv6.c b/ipv6.c
index c9b547e..ca3e4c6 100644
--- a/ipv6.c
+++ b/ipv6.c
@@ -163,7 +163,7 @@
   } else if (protocol == IPPROTO_UDP) {
     iov_len =
       udp_packet(out, pos + 2, (const struct udphdr *)next_header, old_sum, new_sum, len_left);
-  } else if (protocol == IPPROTO_GRE) {
+  } else if (protocol == IPPROTO_GRE || protocol == IPPROTO_ESP) {
     iov_len = generic_packet(out, pos + 2, next_header, len_left);
   } else {
 #if CLAT_DEBUG