diff --git a/net/lux_router.go b/net/lux_router.go
index 5203557..5ca1254 100644
--- a/net/lux_router.go
+++ b/net/lux_router.go
@@ -30,14 +30,14 @@ func (route *LuxRoute) String() string {
 	var dir string
 	switch route.Type {
 	case LuxRouteFromSource:
-		dir = "->"
+		dir = "  <-> *"
 	case LuxRouteToTarget:
-		dir = "<-"
+		dir = "* <->  "
 	default:
-		dir = "?"
+		dir = "  <?>  "
 	}
 
-	return fmt.Sprintf("%s %s %s %s %s",
+	return fmt.Sprintf("%s%s%s %s %s",
 		route.Target.String(), dir, route.Source.String(),
 		route.Associated.Type.String(), route.Destination.IP.String())
 }
@@ -143,8 +143,20 @@ func (r *LuxRouter) CreateOutboundRoute(id proto.LuxID, chType LuxChannelType, u
 		return err
 	}
 
+	var routeType LuxRouteType
+	switch r.GetRouterType() {
+	case proto.LuxTypeHost:
+		if key.Type == proto.LuxTypeNode {
+			routeType = LuxRouteFromSource
+		} else {
+			routeType = LuxRouteToTarget
+		}
+	case proto.LuxTypeNode:
+		routeType = LuxRouteToTarget
+	}
+
 	r.routes[key.Id] = &LuxRoute{
-		Type:        LuxRouteToTarget,
+		Type:        routeType,
 		Target:      id,
 		Source:      r.thisKey.Id,
 		Destination: channel.Address,
@@ -380,10 +392,15 @@ func (r *LuxRouter) Send(packet LuxPacket) error {
 	return route.Associated.Send(dgram)
 }
 
+// In multicast we send packet to all routes by group. Group is lux peer type
+// which is always determined by target ID-key, even in LuxRouteFromSource,
+// since target is node, but we encrypt with source ID-key.
 func (r *LuxRouter) Multicast(packet LuxPacket, group proto.LuxType) error {
 	for _, route := range r.routes {
 		key, _ := r.GetRouteKey(route)
-		if key.Type == group {
+		targetKey, _ := r.keyStore.Get(route.Target)
+
+		if targetKey.Type == group {
 			packet.Nonce = GenerateLuxNonce()
 			dgram, err := EncryptLuxPacket(packet, key, route.Destination)
 			if err != nil {