diff --git a/sys/netinet/ip_fw2.c b/sys/netinet/ip_fw2.c
index 9a46ce752659..a33b361649bb 100644
--- a/sys/netinet/ip_fw2.c
+++ b/sys/netinet/ip_fw2.c
@@ -2955,9 +2955,13 @@ check_ipfw_struct(struct ip_fw *rule, int size)
 			goto check_action;
 
 		case O_FORWARD_IP:
+#ifdef	IPFIREWALL_FORWARD
 			if (cmdlen != F_INSN_SIZE(ipfw_insn_sa))
 				goto bad_size;
 			goto check_action;
+#else
+			return EINVAL;
+#endif
 
 		case O_DIVERT:
 		case O_TEE: