diff --git a/www/manager6/lxc/Config.js b/www/manager6/lxc/Config.js
index 23c17d2e..85d32e3c 100644
--- a/www/manager6/lxc/Config.js
+++ b/www/manager6/lxc/Config.js
@@ -304,7 +304,7 @@ Ext.define('PVE.lxc.Config', {
 	    });
 	}
 
-	if (caps.vms['VM.Console']) {
+	if (caps.vms['VM.Audit']) {
 	    me.items.push(
 		{
 		    xtype: 'pveFirewallRules',
@@ -342,6 +342,11 @@ Ext.define('PVE.lxc.Config', {
 		    list_refs_url: base_url + '/firewall/refs',
 		    itemId: 'firewall-ipset',
 		},
+	    );
+	}
+
+	if (caps.vms['VM.Console']) {
+	    me.items.push(
 		{
 		    title: gettext('Log'),
 		    groups: ['firewall'],
diff --git a/www/manager6/qemu/Config.js b/www/manager6/qemu/Config.js
index 94c540c5..6acf589c 100644
--- a/www/manager6/qemu/Config.js
+++ b/www/manager6/qemu/Config.js
@@ -339,7 +339,7 @@ Ext.define('PVE.qemu.Config', {
 	    });
 	}
 
-	if (caps.vms['VM.Console']) {
+	if (caps.vms['VM.Audit']) {
 	    me.items.push(
 		{
 		    xtype: 'pveFirewallRules',
@@ -377,7 +377,12 @@ Ext.define('PVE.qemu.Config', {
 		    list_refs_url: base_url + '/firewall/refs',
 		    itemId: 'firewall-ipset',
 		},
-		{
+	    );
+	}
+
+	if (caps.vms['VM.Console']) {
+            me.items.push(
+                {
 		    title: gettext('Log'),
 		    groups: ['firewall'],
 		    iconCls: 'fa fa-list',