diff --git a/src/opnsense/mvc/app/controllers/OPNsense/TrafficShaper/forms/dialogRule.xml b/src/opnsense/mvc/app/controllers/OPNsense/TrafficShaper/forms/dialogRule.xml
index ee8e25617..8317c7568 100644
--- a/src/opnsense/mvc/app/controllers/OPNsense/TrafficShaper/forms/dialogRule.xml
+++ b/src/opnsense/mvc/app/controllers/OPNsense/TrafficShaper/forms/dialogRule.xml
@@ -28,6 +28,12 @@
         <type>text</type>
         <help>source ip or network, examples 10.0.0.0/24, 10.0.0.1</help>
     </field>
+    <field>
+        <id>rule.source_not</id>
+        <label>invert source</label>
+        <type>checkbox</type>
+        <help>invert source (not)</help>
+    </field>
     <field>
         <id>rule.src_port</id>
         <label>src-port</label>
@@ -40,6 +46,12 @@
         <type>text</type>
         <help>destination ip or network, examples 10.0.0.0/24, 10.0.0.1</help>
     </field>
+    <field>
+        <id>rule.destination_not</id>
+        <label>invert destination</label>
+        <type>checkbox</type>
+        <help>invert destination (not)</help>
+    </field>
     <field>
         <id>rule.dst_port</id>
         <label>dst-port</label>
diff --git a/src/opnsense/mvc/app/models/OPNsense/TrafficShaper/Migrations/M1_0_1.php b/src/opnsense/mvc/app/models/OPNsense/TrafficShaper/Migrations/M1_0_1.php
new file mode 100644
index 000000000..2fc0ff790
--- /dev/null
+++ b/src/opnsense/mvc/app/models/OPNsense/TrafficShaper/Migrations/M1_0_1.php
@@ -0,0 +1,36 @@
+<?php
+/**
+ *    Copyright (C) 2016 Deciso B.V.
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\TrafficShaper\Migrations;
+
+use OPNsense\Base\BaseModelMigration;
+
+class M1_0_1 extends BaseModelMigration
+{
+}
diff --git a/src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.xml b/src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.xml
index a7eb4a033..77ebeedcd 100644
--- a/src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.xml
+++ b/src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.xml
@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/TrafficShaper</mount>
-    <version>1.0.0</version>
+    <version>1.0.1</version>
     <description>
         OPNsense traffic shaper
     </description>
@@ -216,16 +216,26 @@
                 </proto>
                 <source type="NetworkField">
                     <Required>Y</Required>
+                    <FieldSeparator>,</FieldSeparator>
                     <default>any</default>
                 </source>
+                <source_not type="BooleanField">
+                    <default>0</default>
+                    <Required>Y</Required>
+                </source_not>
                 <src_port type="PortField">
                     <Required>Y</Required>
                     <default>any</default>
                 </src_port>
                 <destination type="NetworkField">
                     <Required>Y</Required>
+                    <FieldSeparator>,</FieldSeparator>
                     <default>any</default>
                 </destination>
+                <destination_not type="BooleanField">
+                    <default>0</default>
+                    <Required>Y</Required>
+                </destination_not>
                 <dst_port type="PortField">
                     <Required>Y</Required>
                     <default>any</default>
diff --git a/src/opnsense/service/templates/OPNsense/IPFW/ipfw.conf b/src/opnsense/service/templates/OPNsense/IPFW/ipfw.conf
index b101d6f57..eabc053e6 100644
--- a/src/opnsense/service/templates/OPNsense/IPFW/ipfw.conf
+++ b/src/opnsense/service/templates/OPNsense/IPFW/ipfw.conf
@@ -175,7 +175,9 @@ add 60000 return via any
 {#  2 interface defined, use both to match packets (2 rules)  #}
 {%                         if rule.direction == 'in' or not rule.direction %}
 add {{loop.index + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
-    helpers.getUUID(rule.target).number }} {{ rule.proto.split('_')[0] }} from {{ rule.source }} to {{rule.destination
+    helpers.getUUID(rule.target).number }} {{ rule.proto.split('_')[0] }} from {%
+    if rule.source_not|default('0') == '1' %}not {% endif %}{{ rule.source }} to {%
+    if rule.destination_not|default('0') == '1' %}not {% endif %}{{rule.destination
     }} src-port  {{ rule.src_port }} dst-port {{ rule.dst_port }} recv {{
     physical_interface(rule.interface) }} {%
     if rule.proto.split('_')[1]|default('') == 'ack' %} {{ rule.proto.split('_')[2]|default('') }} tcpflags ack {% endif
@@ -184,7 +186,9 @@ add {{loop.index + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
 {%                         endif %}
 {%                         if rule.direction == 'out' or not rule.direction %}
 add {{loop.index + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
-    helpers.getUUID(rule.target).number }} {{ rule.proto.split('_')[0] }} from {{ rule.source }} to {{rule.destination
+    helpers.getUUID(rule.target).number }} {{ rule.proto.split('_')[0] }} from {%
+    if rule.source_not|default('0') == '1' %}not {% endif %}{{ rule.source }} to {%
+    if rule.destination_not|default('0') == '1' %}not {% endif %}{{rule.destination
     }} src-port  {{ rule.src_port }} dst-port {{ rule.dst_port }} xmit {{
     physical_interface(rule.interface) }} {%
     if rule.proto.split('_')[1]|default('') == 'ack' %} {{ rule.proto.split('_')[2]|default('') }} tcpflags ack {% endif
@@ -194,7 +198,9 @@ add {{loop.index + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
 {%                       else %}
 {#  normal, single interface situation  #}
 add {{loop.index + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
-    helpers.getUUID(rule.target).number }} {{ rule.proto.split('_')[0] }} from {{ rule.source }} to {{rule.destination
+    helpers.getUUID(rule.target).number }} {{ rule.proto.split('_')[0] }} from {%
+    if rule.source_not|default('0') == '1' %}not {% endif %}{{ rule.source }} to {%
+    if rule.destination_not|default('0') == '1' %}not {% endif %}{{rule.destination
     }} src-port  {{ rule.src_port }} dst-port {{ rule.dst_port }} {{rule.direction}} {%
     if rule.proto.split('_')[1]|default('') == 'ack' %}{{ rule.proto.split('_')[2]|default('') }} tcpflags ack {% endif %} via {{
     physical_interface(rule.interface)