--- a/mod_firewall/mod_firewall.lua	Wed Nov 30 15:44:35 2016 +0100
+++ b/mod_firewall/mod_firewall.lua	Fri Dec 02 11:45:10 2016 +0100
@@ -305,7 +305,7 @@
 			end
 			-- Check standard modifiers for the condition (e.g. NOT)
 			local negated;
-			local condition = line:match("^[^:=%.]*");
+			local condition = line:match("^[^:=%.?]*");
 			if condition:find("%f[%w]NOT%f[^%w]") then
 				local s, e = condition:match("%f[%w]()NOT()%f[^%w]");
 				condition = (condition:sub(1,s-1)..condition:sub(e+1, -1)):match("^%s*(.-)%s*$");