diff --git a/src/netif/ppp/pppol2tp.c b/src/netif/ppp/pppol2tp.c
index 56838696..2a9a9b18 100644
--- a/src/netif/ppp/pppol2tp.c
+++ b/src/netif/ppp/pppol2tp.c
@@ -172,6 +172,9 @@ static err_t pppol2tp_write(ppp_pcb *ppp, void *ctx, struct pbuf *p) {
   LWIP_UNUSED_ARG(ppp);
 #endif /* MIB2_STATS */
 
+  /* skip address & flags */
+  pbuf_remove_header(p, 2);
+
   ph = pbuf_alloc(PBUF_TRANSPORT, (u16_t)(PPPOL2TP_OUTPUT_DATA_HEADER_LEN), PBUF_RAM);
   if(!ph) {
     LINK_STATS_INC(link.memerr);
@@ -463,8 +466,16 @@ static void pppol2tp_input(void *arg, struct udp_pcb *pcb, struct pbuf *p, const
   /*
    * skip address & flags if necessary
    *
-   * RFC 2661 does not specify whether the PPP frame in the L2TP payload should
-   * have a HDLC header or not. We handle both cases for compatibility.
+   * RFC 2661 (L2TPv2) does not specify whether the PPP frame in the L2TP payload
+   * should have a HDLC header or not, both behaviors are seen in the wild.
+   *
+   * On the other hand, L2TPv3 draft-ietf-l2tpext-l2tp-ppp versions 00 and 01 say
+   * it must be included, versions 02 to 05 say it must be omitted, and versions
+   * 06 and onwards say it should be omitted so it changed along the path when
+   * L2TPv3 was designed.  Latest versions state that receivers must handle both
+   * cases.
+   *
+   * We handle both cases for compatibility.
    */
   if (p->len >= 2) {
     GETSHORT(hflags, inp);