diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index b8d0fdc706..986d9fb240 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -1571,11 +1571,13 @@ EOD;
 			$ipfrules .= $line;
 		}
 
-		$ipfrules .= "block in log quick proto tcp from <sshlockout> to any port 22 label \"sshlockout\"\n\n";
 
 		$i++;
 	}
 
+	$ipfrules .= "\n# SSH lockout\n"
+	$ipfrules .= "block in log quick proto tcp from <sshlockout> to any port 22 label \"sshlockout\"\n\n";
+
 	$ipfrules .= "\n# VPN Rules\n";
 	$lan_ip = $config['interfaces']['lan']['ipaddr'];
 	$lan_subnet = $config['interfaces']['lan']['subnet'];