diff --git a/sys/netpfil/ipfw/nat64/nat64stl.h b/sys/netpfil/ipfw/nat64/nat64stl.h
index 42ec20ea274..ec182740a2d 100644
--- a/sys/netpfil/ipfw/nat64/nat64stl.h
+++ b/sys/netpfil/ipfw/nat64/nat64stl.h
@@ -38,7 +38,7 @@ struct nat64stl_cfg {
 
 	struct in6_addr		prefix6;/* IPv6 prefix */
 	uint8_t			plen6;	/* prefix length */
-	uint8_t			flags;	/* flags for internal use */
+	uint32_t		flags;	/* flags for internal use */
 #define	NAT64STL_KIDX		0x0100
 #define	NAT64STL_46T		0x0200
 #define	NAT64STL_64T		0x0400
diff --git a/sys/netpfil/ipfw/nat64/nat64stl_control.c b/sys/netpfil/ipfw/nat64/nat64stl_control.c
index dd52e2c4c2d..aa21e08596a 100644
--- a/sys/netpfil/ipfw/nat64/nat64stl_control.c
+++ b/sys/netpfil/ipfw/nat64/nat64stl_control.c
@@ -289,8 +289,8 @@ nat64stl_config(struct ip_fw_chain *ch, ip_fw3_opheader *op,
 	 * For now allow to change only following values:
 	 *  flags.
 	 */
-
-	cfg->flags = uc->flags & NAT64STL_FLAGSMASK;
+	cfg->flags &= ~NAT64STL_FLAGSMASK;
+	cfg->flags |= uc->flags & NAT64STL_FLAGSMASK;
 	IPFW_UH_WUNLOCK(ch);
 	return (0);
 }