Methods are provided for processing a packet received by a mesh-enabled access point (MAP). When a first MAP receives a packet it can determine whether the packet is destined for a mesh portal based on the destination address. If so, the first MAP can retrieve an encryption key corresponding to the mesh portal, use the encryption key to encrypt the packet and set a mesh forwarding flag in the packet to indicate that the packet is destined for a mesh portal, and is encrypted with an encryption key corresponding to the mesh portal, and then forward the packet to the next hop MAP towards the a mesh portal. The mesh forwarding flag indicates that the packet is destined for a mesh portal, is encrypted with an encryption key corresponding to the mesh portal, and is to be forwarded to the next hop MAP without performing decryption/re-encryption processing on the packet. When a MAP receives a packet, the first MAP it determines whether a mesh forwarding flag is set in the packet. When the mesh forwarding flag is set in the packet, the first MAP skips decryption/re-encryption processing of the packet, and forwards the packet to the next hop MAP towards the mesh portal. When the mesh forwarding flag is not set in the packet, the first MAP retrieves an encryption key corresponding to the mesh portal, encrypts the packet using the encryption key, sets a mesh forwarding flag in the packet and forwards the packet to the next hop MAP.