diff --git a/conf/cf-lex.l b/conf/cf-lex.l
index 61ea4527..d2aa6402 100644
--- a/conf/cf-lex.l
+++ b/conf/cf-lex.l
@@ -246,6 +246,7 @@ else: {
 <CCOMM>.
 
 \!\= return NEQ;
+\!\~ return NMA;
 \<\= return LEQ;
 \>\= return GEQ;
 \&\& return AND;
diff --git a/conf/confbase.Y b/conf/confbase.Y
index 5f487c1d..c14c23c7 100644
--- a/conf/confbase.Y
+++ b/conf/confbase.Y
@@ -82,7 +82,7 @@ CF_DECLS
 
 %nonassoc PREFIX_DUMMY
 %left AND OR
-%nonassoc '=' '<' '>' '~' GEQ LEQ NEQ PO PC
+%nonassoc '=' '<' '>' '~' GEQ LEQ NEQ NMA PO PC
 %left '+' '-'
 %left '*' '/' '%'
 %left '!'
diff --git a/doc/bird.sgml b/doc/bird.sgml
index af5b7980..07a2d470 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -1016,9 +1016,9 @@ foot).
 	of type <cf/string/, print such variables, use standard string
 	comparison operations (e.g. <cf/=, !=, &lt;, &gt;, &lt;=, &gt;=/), but
 	you can't concatenate two strings. String literals are written as
-	<cf/"This is a string constant"/. Additionally matching <cf/&tilde;/
-	operator could be used to match a string value against a shell pattern
-	(represented also as a string).
+	<cf/"This is a string constant"/. Additionally matching (<cf/&tilde;,
+	!&tilde;/) operators could be used to match a string value against
+	a shell pattern (represented also as a string).
 
 	<tag/ip/
 	This type can hold a single IP address. Depending on the compile-time
@@ -1202,9 +1202,9 @@ foot).
 	<tag/eclist/
 	Eclist is a data type used for BGP extended community lists. Eclists
 	are very similar to clists, but they are sets of ECs instead of pairs.
-	The same operations (like <cf/add/, <cf/delete/, or <cf/&tilde;/
-	membership operator) can be used to modify or test eclists, with ECs
-	instead of pairs as arguments.
+	The same operations (like <cf/add/, <cf/delete/ or <cf/&tilde;/ and
+	<cf/!&tilde;/ membership operators) can be used to modify or test
+	eclists, with ECs instead of pairs as arguments.
 </descrip>
 
 
@@ -1213,19 +1213,19 @@ foot).
 <p>The filter language supports common integer operators <cf>(+,-,*,/)</cf>,
 parentheses <cf/(a*(b+c))/, comparison <cf/(a=b, a!=b, a&lt;b, a&gt;=b)/.
 Logical operations include unary not (<cf/!/), and (<cf/&amp;&amp;/) and or
-(<cf/&verbar;&verbar;/). Special operators include <cf/&tilde;/ for "is element
-of a set" operation - it can be used on element and set of elements of the same
-type (returning true if element is contained in the given set), or on two
-strings (returning true if first string matches a shell-like pattern stored in
-second string) or on IP and prefix (returning true if IP is within the range
-defined by that prefix), or on prefix and prefix (returning true if first prefix
-is more specific than second one) or on bgppath and bgpmask (returning true if
-the path matches the mask) or on number and bgppath (returning true if the
-number is in the path) or on bgppath and int (number) set (returning true if any
-ASN from the path is in the set) or on pair/quad and clist (returning true if
-the pair/quad is element of the clist) or on clist and pair/quad set (returning
-true if there is an element of the clist that is also a member of the pair/quad
-set).
+(<cf/&verbar;&verbar;/). Special operators include (<cf/&tilde;/,
+<cf/!&tilde;/) for "is (not) element of a set" operation - it can be used on
+element and set of elements of the same type (returning true if element is
+contained in the given set), or on two strings (returning true if first string
+matches a shell-like pattern stored in second string) or on IP and prefix
+(returning true if IP is within the range defined by that prefix), or on prefix
+and prefix (returning true if first prefix is more specific than second one) or
+on bgppath and bgpmask (returning true if the path matches the mask) or on
+number and bgppath (returning true if the number is in the path) or on bgppath
+and int (number) set (returning true if any ASN from the path is in the set) or
+on pair/quad and clist (returning true if the pair/quad is element of the
+clist) or on clist and pair/quad set (returning true if there is an element of
+the clist that is also a member of the pair/quad set).
 
 <p>There is one operator related to ROA infrastructure - <cf/roa_check()/. It
 examines a ROA table and does RFC 6483 route origin validation for a given
diff --git a/filter/config.Y b/filter/config.Y
index da605710..9fffd651 100644
--- a/filter/config.Y
+++ b/filter/config.Y
@@ -735,6 +735,7 @@ term:
  | term '>' term     { $$ = f_new_inst(); $$->code = '<';        $$->a1.p = $3; $$->a2.p = $1; }
  | term GEQ term { $$ = f_new_inst(); $$->code = P('<','=');     $$->a1.p = $3; $$->a2.p = $1; }
  | term '~' term     { $$ = f_new_inst(); $$->code = '~';        $$->a1.p = $1; $$->a2.p = $3; }
+ | term NMA term { $$ = f_new_inst(); $$->code = P('!','~');     $$->a1.p = $1; $$->a2.p = $3; }
  | '!' term { $$ = f_new_inst(); $$->code = '!'; $$->a1.p = $2; }
  | DEFINED '(' term ')' { $$ = f_new_inst(); $$->code = P('d','e');  $$->a1.p = $3; }
 
diff --git a/filter/filter.c b/filter/filter.c
index ccdfed36..2f5f00d8 100644
--- a/filter/filter.c
+++ b/filter/filter.c
@@ -716,6 +716,16 @@ interpret(struct f_inst *what)
       runtime( "~ applied on unknown type pair" );
     res.val.i = !!res.val.i;
     break;
+
+  case P('!','~'):
+    TWOARGS;
+    res.type = T_BOOL;
+    res.val.i = val_in_range(v1, v2);
+    if (res.val.i == CMP_ERROR)
+      runtime( "!~ applied on unknown type pair" );
+    res.val.i = !res.val.i;
+    break;
+
   case P('d','e'):
     ONEARG;
     res.type = T_BOOL;