diff --git a/firewall/interception.go b/firewall/interception.go
index 4edc790c..366990ed 100644
--- a/firewall/interception.go
+++ b/firewall/interception.go
@@ -307,7 +307,7 @@ func initialHandler(conn *network.Connection, pkt packet.Packet) {
 	log.Tracer(pkt.Ctx()).Trace("filter: handing over to connection-based handler")
 
 	// Check for pre-authenticated port.
-	if localPortIsPreAuthenticated(conn.Entity.Protocol, conn.LocalPort) {
+	if !conn.Inbound && localPortIsPreAuthenticated(conn.Entity.Protocol, conn.LocalPort) {
 		// Approve connection.
 		conn.Accept("connection by Portmaster", noReasonOptionKey)
 		conn.Internal = true