diff --git a/configure.ac b/configure.ac
index 53bacac4..79d352a8 100644
--- a/configure.ac
+++ b/configure.ac
@@ -431,7 +431,7 @@ dnl
       AS_IF([ test "x$withval" = xno ], [],
         AS_IF([ test "x$withval" = x -o "x$withval" = xyes ],
           [AC_MSG_ERROR([--with-iptables requires an argument specifying a path to iptables])],
-          [ IPTABLES_EXE=$withval ]
+          [ FORCE_IPTABLES_EXE=$withval ]
         )
       )
     ],
@@ -449,7 +449,7 @@ dnl
       AS_IF([ test "x$withval" = xno ], [],
         AS_IF([ test "x$withval" = x -o "x$withval" = xyes ],
           [AC_MSG_ERROR([--with-ipfw requires an argument specifying a path to ipfw])],
-          [ IPFW_EXE=$withval ]
+          [ FORCE_IPFW_EXE=$withval ]
         )
       )
     ],
@@ -467,7 +467,7 @@ dnl
       AS_IF([ test "x$withval" = xno ], [],
         AS_IF([ test "x$withval" = x -o "x$withval" = xyes ],
           [AC_MSG_ERROR([--with-pf requires an argument specifying a path to pf])],
-          [ PF_EXE=$withval ]
+          [ FORCE_PF_EXE=$withval ]
         )
       )
     ],
@@ -485,7 +485,7 @@ dnl
       AS_IF([ test "x$withval" = xno ], [],
         AS_IF([ test "x$withval" = x -o "x$withval" = xyes ],
           [AC_MSG_ERROR([--with-ipf requires an argument specifying a path to ipf])],
-          [ IPF_EXE=$withval ]
+          [ FORCE_IPF_EXE=$withval ]
         )
       )
     ],
@@ -494,6 +494,31 @@ dnl
     ]
   )
 
+dnl If a firewall was forced. set the appropriate _EXE var and clear the others.
+dnl
+  AS_IF([test "x$FORCE_IPTABLES_EXE" != x], [
+    IPTABLES_EXE="$FORCE_IPTABLES_EXE"    
+  ],[
+    AS_IF([test "x$FORCE_IPFW_EXE" != x], [
+      IPFW_EXE="$FORCE_IPFW_EXE"    
+      IPTABLES_EXE=""    
+    ],[
+      AS_IF([test "x$FORCE_PF_EXE" != x], [
+        PF_EXE="$FORCE_PF_EXE"    
+        IPFW_EXE=""    
+        IPTABLES_EXE=""    
+      ],[
+        AS_IF([test "x$FORCE_IPF_EXE" != x], [
+          IPF_EXE="$FORCE_IPF_EXE"    
+          PF_EXE=""    
+          IPFW_EXE=""    
+          IPTABLES_EXE=""    
+        ]
+      ]
+    ]
+  ]
+  ))))
+
 dnl Determine which firewall exe we use (if we have one).
 dnl If iptables was found or specified, it wins, then we fallback to ipfw,
 dnl then pf, and otherwise we try ipf.
diff --git a/server/fw_util_ipf.c b/server/fw_util_ipf.c
index 37937aad..307d30ca 100644
--- a/server/fw_util_ipf.c
+++ b/server/fw_util_ipf.c
@@ -121,9 +121,6 @@ process_spa_request(const fko_srv_options_t *opts, const acc_stanza_t *acc, spa_
     acc_port_list_t *port_list = NULL;
     acc_port_list_t *ple;
 
-    unsigned int    fst_proto;
-    unsigned int    fst_port;
-
     int             res = 0;
     time_t          now;
     unsigned int    exp_ts;
@@ -136,12 +133,6 @@ process_spa_request(const fko_srv_options_t *opts, const acc_stanza_t *acc, spa_
     */
     ple = port_list;
 
-    /* Remember the first proto/port combo in case we need them
-     * for NAT access requests.
-    */
-    fst_proto = ple->proto;
-    fst_port  = ple->port;
-
     /* Set our expire time value.
     */
     time(&now);
diff --git a/server/fw_util_ipfw.c b/server/fw_util_ipfw.c
index a9c84c11..12fd0781 100644
--- a/server/fw_util_ipfw.c
+++ b/server/fw_util_ipfw.c
@@ -478,9 +478,6 @@ process_spa_request(const fko_srv_options_t * const opts,
     acc_port_list_t *port_list = NULL;
     acc_port_list_t *ple;
 
-    unsigned int    fst_proto;
-    unsigned int    fst_port;
-
     int             res = 0;
     time_t          now;
     unsigned int    exp_ts;
@@ -493,12 +490,6 @@ process_spa_request(const fko_srv_options_t * const opts,
     */
     ple = port_list;
 
-    /* Remember the first proto/port combo in case we need them
-     * for NAT access requests.
-    */
-    fst_proto = ple->proto;
-    fst_port  = ple->port;
-
     /* Set our expire time value.
     */
     time(&now);
diff --git a/server/fw_util_pf.c b/server/fw_util_pf.c
index 864375ac..a010e0c0 100644
--- a/server/fw_util_pf.c
+++ b/server/fw_util_pf.c
@@ -202,9 +202,6 @@ process_spa_request(const fko_srv_options_t * const opts,
     acc_port_list_t *port_list = NULL;
     acc_port_list_t *ple;
 
-    unsigned int    fst_proto;
-    unsigned int    fst_port;
-
     int             res = 0;
     time_t          now;
     unsigned int    exp_ts;
@@ -217,12 +214,6 @@ process_spa_request(const fko_srv_options_t * const opts,
     */
     ple = port_list;
 
-    /* Remember the first proto/port combo in case we need them
-     * for NAT access requests.
-    */
-    fst_proto = ple->proto;
-    fst_port  = ple->port;
-
     /* Set our expire time value.
     */
     time(&now);