diff --git a/npc/ipblock.go b/npc/ipblock.go
index c40e46e2..0c5284ae 100644
--- a/npc/ipblock.go
+++ b/npc/ipblock.go
@@ -48,6 +48,10 @@ func (spec *ipBlockSpec) getRuleSpec(src bool) ([]string, string) {
 	return rule, comment
 }
 
+func (spec *ipBlockSpec) isNil() bool {
+	return spec == nil
+}
+
 type ipBlockSet struct {
 	ips   ipset.Interface
 	users map[string]map[types.UID]struct{}
diff --git a/npc/rule.go b/npc/rule.go
index 24ac5b13..03de4170 100644
--- a/npc/rule.go
+++ b/npc/rule.go
@@ -16,6 +16,8 @@ type ruleHost interface {
 	//
 	// If src=true then the rulespec is for source, otherwise - for destination.
 	getRuleSpec(src bool) ([]string, string)
+	// TODO(brb) Get rid
+	isNil() bool
 }
 
 type ruleSpec struct {
@@ -30,13 +32,13 @@ func newRuleSpec(policyType policyType, proto *string, srcHost, dstHost ruleHost
 		args = append(args, "-p", *proto)
 	}
 	srcComment := "anywhere"
-	if srcHost != nil {
+	if srcHost != nil && !srcHost.isNil() {
 		rule, comment := srcHost.getRuleSpec(true)
 		args = append(args, rule...)
 		srcComment = comment
 	}
 	dstComment := "anywhere"
-	if dstHost != nil {
+	if dstHost != nil && !dstHost.isNil() {
 		rule, comment := dstHost.getRuleSpec(false)
 		args = append(args, rule...)
 		dstComment = comment
diff --git a/npc/selector.go b/npc/selector.go
index 33f839a0..51eed64f 100644
--- a/npc/selector.go
+++ b/npc/selector.go
@@ -56,6 +56,10 @@ func (spec *selectorSpec) getRuleSpec(src bool) ([]string, string) {
 	return rule, comment
 }
 
+func (spec *selectorSpec) isNil() bool {
+	return spec == nil
+}
+
 type selector struct {
 	ips  ipset.Interface
 	spec *selectorSpec