diff --git a/Shorewall-perl/Shorewall/Nat.pm b/Shorewall-perl/Shorewall/Nat.pm
index b889d2265..5beee95d1 100644
--- a/Shorewall-perl/Shorewall/Nat.pm
+++ b/Shorewall-perl/Shorewall/Nat.pm
@@ -56,7 +56,7 @@ sub do_ipsec_options($)
 			 "tunnel-dst" => NETWORK,
 		       );
     my $list=$_[0];
-    my $options = '-m policy --pol ipsec --dir out';
+    my $options = '-m policy --pol ipsec --dir out ';
     my $fmt;
 
     for my $e ( split ',' , $list ) {
@@ -84,11 +84,11 @@ sub do_ipsec_options($)
 	}
 
 	$options .= $invert;
-	$options .= " --$e";
-	$options .= " $val" if defined $val;
+	$options .= "--$e ";
+	$options .= "$val " if defined $val;
     }
 
-    $options . ' ';
+    $options;
 }
 
 #