diff --git a/doc/ChangeLog b/doc/ChangeLog
index dd9bd8673..ff04c9a9b 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,3 +1,9 @@
+2008-06-30  Vadim Kurland  <vadim@vk.crocodile.org>
+
+	* PolicyCompiler_PrintRule.cpp (PrintRule::_printProtocol): do not
+	generate "-m icmp6 --icmp6-type any" for ipv6 for object "any
+	icmp".
+
 2008-06-28  Vadim Kurland  <vadim@vk.crocodile.org>
 
 	* DiscoveryDruid.cpp (DiscoveryDruid::loadDataFromDNS): object
diff --git a/src/ipt/PolicyCompiler_PrintRule.cpp b/src/ipt/PolicyCompiler_PrintRule.cpp
index 795f550ea..4d5634391 100644
--- a/src/ipt/PolicyCompiler_PrintRule.cpp
+++ b/src/ipt/PolicyCompiler_PrintRule.cpp
@@ -604,7 +604,8 @@ string PolicyCompiler_ipt::PrintRule::_printProtocol(libfwbuilder::Service *srv)
             if (pn == "icmp")
             {
                 s = "-p ipv6-icmp ";
-                if (ipt_comp->newIptables(version)) s += " -m icmp6";
+                if (srv->getInt("type")!=-1 &&
+                    ipt_comp->newIptables(version)) s += " -m icmp6";
             } else
             {
                 // ip6tables issues warning for commands using "-p all"
@@ -857,7 +858,8 @@ string PolicyCompiler_ipt::PrintRule::_printDstService(RuleElementSrv  *rel)
 	    string str = _printICMP( ICMPService::cast(srv) );
 	    if (str.empty() ) 
             {
-                if (ipt_comp->newIptables(version))
+                // module icmp6 does not like "--icmp6-type any"
+                if (ipt_comp->newIptables(version) && !ipt_comp->ipv6)
                     ostr << icmp_type_str << " any ";
             } else
             {