diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index d9c9b5cc0..a131c54a8 100755
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -337,6 +337,11 @@ sub buildrules {
 
 							# Use iptables DNAT
 							} else {
+								if ($destination_is_firewall && !$destination) {
+									$destination = &fwlib::get_external_address();
+								}
+								next unless ($destination);
+
 								my ($dnat_address, $dnat_mask) = split("/", $destination);
 								@destination_options = ("-d", $dnat_address);