I just read the checkin for [84e755e2139ca9cc2396c2cfa950f2ccffae1a61] and that seems rather lax to me. A /16 network is pretty big. A /24 would be more reasonable (much more standard for poorly configured firewalls to change IP addresses based on a /24), however most firewalls use a hash of internal_src_ip so the external_src_ip is always consistent. In either case, changing ipPrefix() to use a tunable for the mask would be the ideal.