diff --git a/changes/10777_netunreach b/changes/10777_netunreach
new file mode 100644
index 0000000000..899181423f
--- /dev/null
+++ b/changes/10777_netunreach
@@ -0,0 +1,7 @@
+  - Minor bugfixes:
+
+    - Treat ENETUNREACH, EACCES, and EPERM at an exit node as a
+      NOROUTE error, not an INTERNAL error, since they can apparently
+      happen when trying to connect to the wrong sort of
+      netblocks. Fixes a part of bug 10777; bugfix on 0.1.0.1-rc.
+
diff --git a/changes/bug10777_internal_024 b/changes/bug10777_internal_024
new file mode 100644
index 0000000000..4544147f6e
--- /dev/null
+++ b/changes/bug10777_internal_024
@@ -0,0 +1,4 @@
+  o Major bugfixes:
+    - Do not treat END_STREAM_REASON_INTERNAL as indicating a definite
+      circuit failure, since it could also indicate an ENETUNREACH
+      error. Fixes part of bug 10777; bugfix on 0.2.4.8-alpha.
diff --git a/src/or/reasons.c b/src/or/reasons.c
index 637f8cdc7d..6eb2643a8a 100644
--- a/src/or/reasons.c
+++ b/src/or/reasons.c
@@ -174,11 +174,12 @@ errno_to_stream_end_reason(int e)
     S_CASE(ENOTSOCK):
     S_CASE(EPROTONOSUPPORT):
     S_CASE(EAFNOSUPPORT):
-    E_CASE(EACCES):
     S_CASE(ENOTCONN):
-    S_CASE(ENETUNREACH):
       return END_STREAM_REASON_INTERNAL;
+    S_CASE(ENETUNREACH):
     S_CASE(EHOSTUNREACH):
+    E_CASE(EACCES):
+    E_CASE(EPERM):
       return END_STREAM_REASON_NOROUTE;
     S_CASE(ECONNREFUSED):
       return END_STREAM_REASON_CONNECTREFUSED;
diff --git a/src/or/relay.c b/src/or/relay.c
index 94016b49f9..dc234c1f2a 100644
--- a/src/or/relay.c
+++ b/src/or/relay.c
@@ -735,13 +735,15 @@ connection_ap_process_end_not_open(
 
   if (rh->length > 0) {
     if (reason == END_STREAM_REASON_TORPROTOCOL ||
-        reason == END_STREAM_REASON_INTERNAL ||
         reason == END_STREAM_REASON_DESTROY) {
-      /* All three of these reasons could mean a failed tag
+      /* Both of these reasons could mean a failed tag
        * hit the exit and it complained. Do not probe.
        * Fail the circuit. */
       circ->path_state = PATH_STATE_USE_FAILED;
       return -END_CIRC_REASON_TORPROTOCOL;
+    } else if (reason == END_STREAM_REASON_INTERNAL) {
+      /* We can't infer success or failure, since older Tors report
+       * ENETUNREACH as END_STREAM_REASON_INTERNAL. */
     } else {
       /* Path bias: If we get a valid reason code from the exit,
        * it wasn't due to tagging.