diff --git a/openbsc/include/openbsc/bsc_nat_sccp.h b/openbsc/include/openbsc/bsc_nat_sccp.h
index 4f1afcb2b..c4f756e3d 100644
--- a/openbsc/include/openbsc/bsc_nat_sccp.h
+++ b/openbsc/include/openbsc/bsc_nat_sccp.h
@@ -78,6 +78,7 @@ struct sccp_connections {
 	/* status */
 	int con_type;
 	int con_local;
+	int imsi_checked;
 
 	/*
 	 * audio handling. Remember if we have ever send a CRCX,
diff --git a/openbsc/src/nat/bsc_nat.c b/openbsc/src/nat/bsc_nat.c
index 1f45e4587..31009bb30 100644
--- a/openbsc/src/nat/bsc_nat.c
+++ b/openbsc/src/nat/bsc_nat.c
@@ -713,7 +713,7 @@ static int forward_sccp_to_msc(struct bsc_connection *bsc, struct msgb *msg)
 		switch (parsed->sccp_type) {
 		case SCCP_MSG_TYPE_CR:
 			filter = bsc_nat_filter_sccp_cr(bsc, msg, parsed, &con_type);
-			if (filter != 0)
+			if (filter < 0)
 				goto exit3;
 			if (!create_sccp_src_ref(bsc, parsed))
 				goto exit2;
@@ -721,6 +721,7 @@ static int forward_sccp_to_msc(struct bsc_connection *bsc, struct msgb *msg)
 			con->msc_con = bsc->nat->msc_con;
 			con_msc = con->msc_con;
 			con->con_type = con_type;
+			con->imsi_checked = filter;
 			con_bsc = con->bsc;
 			break;
 		case SCCP_MSG_TYPE_RLSD:
diff --git a/openbsc/src/nat/bsc_nat_utils.c b/openbsc/src/nat/bsc_nat_utils.c
index 058251368..e81a1e85b 100644
--- a/openbsc/src/nat/bsc_nat_utils.c
+++ b/openbsc/src/nat/bsc_nat_utils.c
@@ -271,7 +271,7 @@ static int auth_imsi(struct bsc_connection *bsc, const char *mi_string)
 
 		/* 2. BSC allow */
 		if (lst_check_allow(bsc_lst, mi_string) == 0)
-			return 0;
+			return 1;
 	}
 
 	/* 3. NAT deny */
@@ -283,7 +283,7 @@ static int auth_imsi(struct bsc_connection *bsc, const char *mi_string)
 		}
 	}
 
-	return 0;
+	return 1;
 }
 
 static int _cr_check_loc_upd(struct bsc_connection *bsc, uint8_t *data, unsigned int length)