diff --git a/include/proto/stream_interface.h b/include/proto/stream_interface.h
index 5800c1e..3cccc8f 100644
--- a/include/proto/stream_interface.h
+++ b/include/proto/stream_interface.h
@@ -420,6 +420,12 @@
 	si->ops->shutw(si);
 }
 
+/* Marks on the stream-interface that next shutw must kill the whole connection */
+static inline void si_must_kill_conn(struct stream_interface *si)
+{
+	si->flags |= SI_FL_KILL_CONN;
+}
+
 /* This is to be used after making some room available in a channel. It will
  * return without doing anything if the stream interface's RX path is blocked.
  * It will automatically mark the stream interface as busy processing the end
diff --git a/include/types/stream_interface.h b/include/types/stream_interface.h
index eab1fba..8be3ee9 100644
--- a/include/types/stream_interface.h
+++ b/include/types/stream_interface.h
@@ -64,7 +64,7 @@
 	SI_FL_NONE       = 0x00000000,  /* nothing */
 	SI_FL_EXP        = 0x00000001,  /* timeout has expired */
 	SI_FL_ERR        = 0x00000002,  /* a non-recoverable error has occurred */
-	/* unused:         0x00000004 */
+	SI_FL_KILL_CONN  = 0x00000004,  /* next shutw must kill the whole conn, not just the stream */
 	SI_FL_WAIT_DATA  = 0x00000008,  /* stream-int waits for more outgoing data to send */
 	SI_FL_ISBACK     = 0x00000010,  /* 0 for front-side SI, 1 for back-side */
 	SI_FL_DONT_WAKE  = 0x00000020,  /* resync in progress, don't wake up */
diff --git a/src/http_act.c b/src/http_act.c
index 37cf435..4f51d4a 100644
--- a/src/http_act.c
+++ b/src/http_act.c
@@ -34,6 +34,7 @@
 #include <proto/http_rules.h>
 #include <proto/log.h>
 #include <proto/proto_http.h>
+#include <proto/stream_interface.h>
 
 
 /* This function executes one of the set-{method,path,query,uri} actions. It
@@ -185,6 +186,7 @@
 static enum act_return http_action_reject(struct act_rule *rule, struct proxy *px,
                                           struct session *sess, struct stream *s, int flags)
 {
+	si_must_kill_conn(chn_prod(&s->req));
 	channel_abort(&s->req);
 	channel_abort(&s->res);
 	s->req.analysers = 0;
diff --git a/src/tcp_rules.c b/src/tcp_rules.c
index 602749c..91f98b0 100644
--- a/src/tcp_rules.c
+++ b/src/tcp_rules.c
@@ -163,6 +163,7 @@
 				break;
 			}
 			else if (rule->action == ACT_ACTION_DENY) {
+				si_must_kill_conn(chn_prod(req));
 				channel_abort(req);
 				channel_abort(&s->res);
 				req->analysers = 0;
@@ -342,6 +343,7 @@
 				break;
 			}
 			else if (rule->action == ACT_ACTION_DENY) {
+				si_must_kill_conn(chn_prod(rep));
 				channel_abort(rep);
 				channel_abort(&s->req);
 				rep->analysers = 0;
@@ -359,6 +361,7 @@
 			}
 			else if (rule->action == ACT_TCP_CLOSE) {
 				chn_prod(rep)->flags |= SI_FL_NOLINGER | SI_FL_NOHALF;
+				si_must_kill_conn(chn_prod(rep));
 				si_shutr(chn_prod(rep));
 				si_shutw(chn_prod(rep));
 				break;