diff --git a/changes/bug18208 b/changes/bug18208
new file mode 100644
index 0000000000000000000000000000000000000000..d6d194bb4dc35d4b27d16bc01a8bb4c0ab8f6ff8
--- /dev/null
+++ b/changes/bug18208
@@ -0,0 +1,5 @@
+  o Minor bug fixes (exit policies, security):
+    - Refresh an exit relay's exit policy when interface addresses change.
+      Previously, tor only refreshed the exit policy when the configured
+      external address changed.
+      Closes ticket 18208 on tor 0.2.7.3. Patch by "teor".
diff --git a/src/or/main.c b/src/or/main.c
index 591d4b2366ef5fd4da7a5594dec544c8489b1863..408f2447c1087fef49b8e3dca9cb5f06055367f8 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -2169,7 +2169,10 @@ got_libevent_error(void)
 void
 ip_address_changed(int at_interface)
 {
-  int server = server_mode(get_options());
+  const or_options_t *options = get_options();
+  int server = server_mode(options);
+  int exit_reject_private = (server && options->ExitRelay
+                             && options->ExitPolicyRejectPrivate);
 
   if (at_interface) {
     if (! server) {
@@ -2183,10 +2186,15 @@ ip_address_changed(int at_interface)
         reset_bandwidth_test();
       stats_n_seconds_working = 0;
       router_reset_reachability();
-      mark_my_descriptor_dirty("IP address changed");
     }
   }
 
+  /* Exit relays incorporate interface addresses in their exit policies when
+   * ExitPolicyRejectPrivate is set */
+  if (exit_reject_private || (server && !at_interface)) {
+    mark_my_descriptor_dirty("IP address changed");
+  }
+
   dns_servers_relaunch_checks();
 }