diff --git a/internal/nftables/match.go b/internal/nftables/match.go
index 31b4c1f..9a5edf3 100644
--- a/internal/nftables/match.go
+++ b/internal/nftables/match.go
@@ -17,14 +17,20 @@ func GenerateServiceMatcher(service object.Service) string {
 			res = "tcp sport " + service.GetSPort()
 		}
 		if service.GetDPort() != "" {
-			res = res + "tcp dport " + service.GetDPort()
+			if len(res) != 0 {
+				res += " "
+			}
+			res += "tcp dport " + service.GetDPort()
 		}
 	case object.UDP:
 		if service.GetSPort() != "" {
 			res = "udp sport " + service.GetSPort()
 		}
 		if service.GetDPort() != "" {
-			res = res + "udp dport " + service.GetDPort()
+			if len(res) != 0 {
+				res += " "
+			}
+			res += "udp dport " + service.GetDPort()
 		}
 	case object.ICMP:
 		res = "icmp codes " + fmt.Sprint(service.ICMPCode)