diff --git a/p2p/netutil/addrutil.go b/p2p/netutil/addrutil.go
index fb6d8d2731..88aaec076b 100644
--- a/p2p/netutil/addrutil.go
+++ b/p2p/netutil/addrutil.go
@@ -16,18 +16,52 @@
 
 package netutil
 
-import "net"
+import (
+	"fmt"
+	"math/rand"
+	"net"
+	"net/netip"
+)
 
-// AddrIP gets the IP address contained in addr. It returns nil if no address is present.
-func AddrIP(addr net.Addr) net.IP {
+// AddrAddr gets the IP address contained in addr. It returns nil if no address is present.
+func AddrAddr(addr net.Addr) netip.Addr {
 	switch a := addr.(type) {
 	case *net.IPAddr:
-		return a.IP
+		return IPToAddr(a.IP)
 	case *net.TCPAddr:
-		return a.IP
+		return IPToAddr(a.IP)
 	case *net.UDPAddr:
-		return a.IP
+		return IPToAddr(a.IP)
 	default:
-		return nil
+		return netip.Addr{}
 	}
 }
+
+// IPToAddr converts net.IP to netip.Addr. Note that unlike netip.AddrFromSlice, this
+// function will always ensure that the resulting Addr is IPv4 when the input is.
+func IPToAddr(ip net.IP) netip.Addr {
+	if ip4 := ip.To4(); ip4 != nil {
+		addr, _ := netip.AddrFromSlice(ip4)
+		return addr
+	} else if ip6 := ip.To16(); ip6 != nil {
+		addr, _ := netip.AddrFromSlice(ip6)
+		return addr
+	}
+	return netip.Addr{}
+}
+
+// RandomAddr creates a random IP address.
+func RandomAddr(rng *rand.Rand, ipv4 bool) netip.Addr {
+	var bytes []byte
+	if ipv4 || rng.Intn(2) == 0 {
+		bytes = make([]byte, 4)
+	} else {
+		bytes = make([]byte, 16)
+	}
+	rng.Read(bytes)
+	addr, ok := netip.AddrFromSlice(bytes)
+	if !ok {
+		panic(fmt.Errorf("BUG! invalid IP %v", bytes))
+	}
+	return addr
+}
diff --git a/p2p/netutil/net.go b/p2p/netutil/net.go
index 01fda7dc7d..9495a2af80 100644
--- a/p2p/netutil/net.go
+++ b/p2p/netutil/net.go
@@ -21,7 +21,6 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
-	"math/rand"
 	"net"
 	"net/netip"
 	"slices"
@@ -339,32 +338,3 @@ func (s DistinctNetSet) String() string {
 	buf.WriteString("}")
 	return buf.String()
 }
-
-// IPToAddr converts net.IP to netip.Addr. Note that unlike netip.AddrFromSlice, this
-// function will always ensure that the resulting Addr is IPv4 when the input is.
-func IPToAddr(ip net.IP) netip.Addr {
-	if ip4 := ip.To4(); ip4 != nil {
-		addr, _ := netip.AddrFromSlice(ip4)
-		return addr
-	} else if ip6 := ip.To16(); ip6 != nil {
-		addr, _ := netip.AddrFromSlice(ip6)
-		return addr
-	}
-	return netip.Addr{}
-}
-
-// RandomAddr creates a random IP address.
-func RandomAddr(rng *rand.Rand, ipv4 bool) netip.Addr {
-	var bytes []byte
-	if ipv4 || rng.Intn(2) == 0 {
-		bytes = make([]byte, 4)
-	} else {
-		bytes = make([]byte, 16)
-	}
-	rng.Read(bytes)
-	addr, ok := netip.AddrFromSlice(bytes)
-	if !ok {
-		panic(fmt.Errorf("BUG! invalid IP %v", bytes))
-	}
-	return addr
-}
diff --git a/p2p/server.go b/p2p/server.go
index 9fec2d1e36..740e370ec2 100644
--- a/p2p/server.go
+++ b/p2p/server.go
@@ -905,7 +905,7 @@ func (srv *Server) listenLoop() {
 			break
 		}
 
-		remoteIP := netutil.AddrIP(fd.RemoteAddr())
+		remoteIP := netutil.AddrAddr(fd.RemoteAddr())
 		if err := srv.checkInboundConn(remoteIP); err != nil {
 			srv.log.Debug("Rejected inbound connection", "addr", fd.RemoteAddr(), "err", err)
 			fd.Close()
@@ -924,18 +924,19 @@ func (srv *Server) listenLoop() {
 	}
 }
 
-func (srv *Server) checkInboundConn(remoteIP net.IP) error {
-	if remoteIP == nil {
+func (srv *Server) checkInboundConn(remoteIP netip.Addr) error {
+	if !remoteIP.IsValid() {
+		// This case happens for internal test connections without remote address.
 		return nil
 	}
 	// Reject connections that do not match NetRestrict.
-	if srv.NetRestrict != nil && !srv.NetRestrict.Contains(remoteIP) {
+	if srv.NetRestrict != nil && !srv.NetRestrict.ContainsAddr(remoteIP) {
 		return errors.New("not in netrestrict list")
 	}
 	// Reject Internet peers that try too often.
 	now := srv.clock.Now()
 	srv.inboundHistory.expire(now, nil)
-	if !netutil.IsLAN(remoteIP) && srv.inboundHistory.contains(remoteIP.String()) {
+	if !netutil.AddrIsLAN(remoteIP) && srv.inboundHistory.contains(remoteIP.String()) {
 		return errors.New("too many attempts")
 	}
 	srv.inboundHistory.add(remoteIP.String(), now.Add(inboundThrottleTime))