diff --git a/Shorewall2/firewall b/Shorewall2/firewall
index 4bb5f76d7..db30801cc 100755
--- a/Shorewall2/firewall
+++ b/Shorewall2/firewall
@@ -1751,7 +1751,7 @@ setup_ipsec() {
 	eval local policy=\$${1}_policy
 	if [ "$policy" != NONE ]; then
 	    ensurechain $1
-	    run_iptables -A $1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss $mss
+	    run_iptables -I $1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss $mss
 	fi
     }