diff --git a/client/firewall/uspfilter/filter.go b/client/firewall/uspfilter/filter.go
index 0a528b1ed..3ae797f8c 100644
--- a/client/firewall/uspfilter/filter.go
+++ b/client/firewall/uspfilter/filter.go
@@ -1552,16 +1552,6 @@ func (m *Manager) DisableRouting() error {
 	m.routingEnabled.Store(false)
 	m.nativeRouter.Store(false)
 
-	// don't stop forwarder if in use by netstack
-	if m.netstack && m.localForwarding {
-		return nil
-	}
-
-	fwder.Stop()
-	m.forwarder.Store(nil)
-
-	log.Debug("forwarder stopped")
-
 	var merr *multierror.Error
 	for _, rule := range m.blockRules {
 		if err := m.deleteRouteRule(rule); err != nil {
@@ -1570,6 +1560,15 @@ func (m *Manager) DisableRouting() error {
 	}
 	m.blockRules = nil
 
+	if m.netstack && m.localForwarding {
+		return nberrors.FormatErrorOrNil(merr)
+	}
+
+	fwder.Stop()
+	m.forwarder.Store(nil)
+
+	log.Debug("forwarder stopped")
+
 	return nberrors.FormatErrorOrNil(merr)
 }