diff --git a/conf/cf-lex.l b/conf/cf-lex.l
index 6399fa66..179b66a4 100644
--- a/conf/cf-lex.l
+++ b/conf/cf-lex.l
@@ -570,6 +570,9 @@ static inline void cf_swap_soft_scope(struct config *conf);
 static struct symbol *
 cf_new_symbol(struct sym_scope *scope, pool *p, struct linpool *lp, const byte *c)
 {
+  if (scope->readonly)
+    cf_error("Unknown symbol %s", c);
+
   struct symbol *s;
 
   uint l = strlen(c);
@@ -771,6 +774,9 @@ cf_lex_init(int is_cli, struct config *c)
       s->class = SYM_KEYWORD;
       s->keyword = k;
     }
+
+    global_root_scope.readonly = 1;
+    global_filter_scope.readonly = 1;
   }
 
   ifs_head = ifs = push_ifs(NULL);
diff --git a/conf/conf.h b/conf/conf.h
index 767544b8..f7833d9e 100644
--- a/conf/conf.h
+++ b/conf/conf.h
@@ -141,9 +141,10 @@ struct sym_scope {
   HASH(struct symbol) hash;		/* Local symbol hash */
 
   uint slots;				/* Variable slots */
-  byte active;				/* Currently entered */
-  byte block;				/* No independent stack frame */
   byte soft_scopes;			/* Number of soft scopes above */
+  byte active:1;			/* Currently entered */
+  byte block:1;				/* No independent stack frame */
+  byte readonly:1;			/* Do not add new symbols */
 };
 
 void cf_enter_filters(void);