diff --git a/Shorewall-perl/Shorewall/Nat.pm b/Shorewall-perl/Shorewall/Nat.pm
index 744c9cf1f..7bdd9c179 100644
--- a/Shorewall-perl/Shorewall/Nat.pm
+++ b/Shorewall-perl/Shorewall/Nat.pm
@@ -56,7 +56,7 @@ sub do_ipsec_options($)
 			 "tunnel-dst" => NETWORK,
 		       );
     my $list=$_[0];
-    my $options = '-m policy';
+    my $options = '-m policy ';
     my $fmt;
 
     for my $e ( split ',' , $list ) {