diff --git a/src/etc/inc/plugins.inc.d/captiveportal.inc b/src/etc/inc/plugins.inc.d/captiveportal.inc
index 6976d6782..2445ab0ec 100644
--- a/src/etc/inc/plugins.inc.d/captiveportal.inc
+++ b/src/etc/inc/plugins.inc.d/captiveportal.inc
@@ -120,7 +120,8 @@ function captiveportal_firewall($fw)
                             'protocol' => 'tcp',
                             'from' => "<__captiveportal_zone_{$zoneid}>",
                             'from_not' => true,
-                            'to' => 'any',
+                            'to' => "<__captiveportal_zone_{$zoneid}>",
+                            'to_not' => true,
                             'to_port' => $to_port,
                             'target' => '127.0.0.1',
                             'localport' => $rdr_port,
@@ -158,7 +159,8 @@ function captiveportal_firewall($fw)
                         'direction' => 'in',
                         'from' => "<__captiveportal_zone_{$zoneid}>",
                         'from_not' => true,
-                        'to' => 'any',
+                        'to' => "<__captiveportal_zone_{$zoneid}>",
+                        'to_not' => true,
                         'descr' => "Default Captive Portal block rule (zone {$zoneid})",
                         'log' => !isset($config['syslog']['nologdefaultblock']),
                         '#ref' => "ui/captiveportal#edit={$uuid}",