So, if iptables doesn't support comments then the module just adds rules to the end and hopes for the best? Does this account for updating existing rules? How are existing rules recognized if not by their title? Is there any other arbitrary string element we could use to tag rules, such as hash-comments in the dump file? (I doubt hash-comments are supported or preserved though...)