--- orig/etc/ferm/rules.ferm
+++ mod/etc/ferm/rules.ferm
@@ -1,5 +1,37 @@
 # -*- shell-script -*-
 
+def &gen_net_tcp_udp_rules($name, $net_if, $net_ip, $tcp_services, $udp_services) = {
+    def &_gen_net_tcp_udp_rules() = {
+	@if $net_if {
+    	    @if $net_ip {
+		interface $net_if saddr $net_ip subchain "$name" {
+		    proto tcp mod multiport destination-ports $tcp_services ACCEPT;
+		    proto udp mod multiport destination-ports $udp_services ACCEPT;
+		}
+    	    } @else {
+		interface $net_if subchain "$name" {
+		    proto tcp mod multiport destination-ports $tcp_services ACCEPT;
+		    proto udp mod multiport destination-ports $udp_services ACCEPT;
+		}
+    	    }
+	} @else {
+    	    @if $net_ip {
+		saddr $net_ip subchain "$name" {
+		    proto tcp mod multiport destination-ports $tcp_services ACCEPT;
+		    proto udp mod multiport destination-ports $udp_services ACCEPT;
+		}
+    	    }
+	}
+    }
+
+    @if $tcp_services {
+	&_gen_net_tcp_udp_rules();
+    }
+    @else @if $udp_services {
+	&_gen_net_tcp_udp_rules();
+    }
+}
+
 def &input() = {
     chain "log_in_reserved" {
 	LOG log-prefix 'INPUT-RESERVED: ';
@@ -86,10 +118,7 @@
 
     def &input_local_rules($name, $tcp_services, $udp_services) = {
 	# allow locally reachable services
-	saddr $local_net_ip subchain "$name" {
-	    proto tcp mod multiport destination-ports $tcp_services ACCEPT;
-	    proto udp mod multiport destination-ports $udp_services ACCEPT;
-	}
+	&gen_net_tcp_udp_rules($name, $local_net_if, $local_net_ip, $tcp_services, $udp_services);
     }
 
     def &input_xcast_rules() = {
@@ -139,10 +168,7 @@
 
     def &input_local_rules($name, $tcp_services, $udp_services) = {
 	# allow locally reachable services
-	saddr $local_net_ip6 subchain "$name" {
-	    proto tcp mod multiport destination-ports $tcp_services ACCEPT;
-	    proto udp mod multiport destination-ports $udp_services ACCEPT;
-	}
+	&gen_net_tcp_udp_rules($name, $local_net_if, $local_net_ip6, $tcp_services, $udp_services);
     }
 
     def &input_xcast_rules() = {
