shorewall: more defensive regexp