diff --git a/src/etc/inc/filter.inc b/src/etc/inc/filter.inc
index 3ce090665..28f61a5ae 100644
--- a/src/etc/inc/filter.inc
+++ b/src/etc/inc/filter.inc
@@ -1150,10 +1150,12 @@ function filter_nat_rules_automatic_tonathosts(&$FilterIflist, $with_descr = fal
     }
 
     /* PPPoE subnet */
-    foreach (array($FilterIflist['pppoe']['items']) as $pppoe) {
-        if (is_private_ip($pppoe['ip'])) {
-            $tonathosts[] = "{$pppoe['sa']}/{$pppoe['sn']}";
-            $descriptions[] = gettext("PPPoE server");
+    if (isset($FilterIflist['pppoe']['items']) && is_array($FilterIflist['pppoe']['items'])) {
+        foreach ($FilterIflist['pppoe']['items'] as $pppoe) {
+            if (is_private_ip($pppoe['ip'])) {
+                $tonathosts[] = "{$pppoe['sa']}/{$pppoe['sn']}";
+                $descriptions[] = gettext("PPPoE server");
+            }
         }
     }
 
@@ -1168,17 +1170,21 @@ function filter_nat_rules_automatic_tonathosts(&$FilterIflist, $with_descr = fal
     }
 
     /* add openvpn interfaces */
-    foreach (array($config['openvpn']['openvpn-server']) as $ovpnsrv) {
-        if (!isset($ovpnsrv['disable']) && !empty($ovpnsrv['tunnel_network'])) {
-            $tonathosts[] = $ovpnsrv['tunnel_network'];
-            $descriptions[] = gettext("OpenVPN server");
+    if (isset($config['openvpn']['openvpn-server'])) {
+        foreach ($config['openvpn']['openvpn-server'] as $ovpnsrv) {
+            if (!isset($ovpnsrv['disable']) && !empty($ovpnsrv['tunnel_network'])) {
+                $tonathosts[] = $ovpnsrv['tunnel_network'];
+                $descriptions[] = gettext("OpenVPN server");
+            }
         }
     }
 
-    foreach (array($config['openvpn']['openvpn-client']) as $ovpncli) {
-        if (!isset($ovpncli['disable']) && !empty($ovpncli['tunnel_network'])) {
-            $tonathosts[] = $ovpncli['tunnel_network'];
-            $descriptions[] = gettext("OpenVPN client");
+    if (isset($config['openvpn']['openvpn-client'])) {
+        foreach ($config['openvpn']['openvpn-client'] as $ovpncli) {
+            if (!isset($ovpncli['disable']) && !empty($ovpncli['tunnel_network'])) {
+                $tonathosts[] = $ovpncli['tunnel_network'];
+                $descriptions[] = gettext("OpenVPN client");
+            }
         }
     }