diff --git a/src/server/OfflineMessageHandler.php b/src/server/OfflineMessageHandler.php
index 65a1fb0..196a376 100644
--- a/src/server/OfflineMessageHandler.php
+++ b/src/server/OfflineMessageHandler.php
@@ -26,7 +26,6 @@
 use raklib\protocol\UnconnectedPing;
 use raklib\protocol\UnconnectedPong;
 use raklib\utils\InternetAddress;
-use function abs;
 use function min;
 
 class OfflineMessageHandler{
@@ -67,7 +66,11 @@ public function handle(OfflineMessage $packet, InternetAddress $address) : bool{
 				/** @var OpenConnectionRequest2 $packet */
 
 				if($packet->serverAddress->port === $this->sessionManager->getPort() or !$this->sessionManager->portChecking){
-					$mtuSize = min(abs($packet->mtuSize), $this->sessionManager->getMaxMtuSize()); //Max size, do not allow creating large buffers to fill server memory
+					if($packet->mtuSize < Session::MIN_MTU_SIZE){
+						$this->sessionManager->getLogger()->debug("Not creating session for $address due to bad MTU size $packet->mtuSize");
+						return true;
+					}
+					$mtuSize = min($packet->mtuSize, $this->sessionManager->getMaxMtuSize()); //Max size, do not allow creating large buffers to fill server memory
 					$pk = new OpenConnectionReply2();
 					$pk->mtuSize = $mtuSize;
 					$pk->serverID = $this->sessionManager->getID();
diff --git a/src/server/Session.php b/src/server/Session.php
index 0c7faa2..d79c02d 100644
--- a/src/server/Session.php
+++ b/src/server/Session.php
@@ -47,6 +47,8 @@ class Session{
 	public const STATE_DISCONNECTING = 2;
 	public const STATE_DISCONNECTED = 3;
 
+	public const MIN_MTU_SIZE = 400;
+
 	private const MAX_SPLIT_SIZE = 128;
 	private const MAX_SPLIT_COUNT = 4;
 
@@ -136,6 +138,9 @@ class Session{
 	private $lastPingMeasure = 1;
 
 	public function __construct(SessionManager $sessionManager, InternetAddress $address, int $clientId, int $mtuSize){
+		if($mtuSize < self::MIN_MTU_SIZE){
+			throw new \InvalidArgumentException("MTU size must be at least " . self::MIN_MTU_SIZE . ", got $mtuSize");
+		}
 		$this->sessionManager = $sessionManager;
 		$this->address = $address;
 		$this->id = $clientId;