diff --git a/Shorewall/Perl/Shorewall/Chains.pm b/Shorewall/Perl/Shorewall/Chains.pm
index 870c25c..7fc6bf0 100644
--- a/Shorewall/Perl/Shorewall/Chains.pm
+++ b/Shorewall/Perl/Shorewall/Chains.pm
@@ -2225,6 +2225,8 @@ sub do_proto( $$$;$ )
 	    #
 	    # Protocol is numeric and <= 65535 or is defined in /etc/protocols or NSS equivalent
 	    #
+	    fatal_error "'!0' not allowed in the PROTO column" if $invert && ! $protonum;
+
 	    my $pname = proto_name( $proto = $protonum );
 	    #
 	    # $proto now contains the protocol number and $pname contains the canonical name of the protocol