I just read the checkin for and that seems rather lax to me. A /16 network is pretty big. A /24 would be more reasonable (much more standard for poorly configured firewalls to change IP addresses based on a /24), however most firewalls use a hash of internal_src_ip so the external_src_ip is always consistent. In either case, changing ipPrefix() to use a tunable for the mask would be the ideal.