diff --git a/firewall/edit_rule.cgi b/firewall/edit_rule.cgi
index 443069f51..1d4438f39 100755
--- a/firewall/edit_rule.cgi
+++ b/firewall/edit_rule.cgi
@@ -155,7 +155,7 @@ if (($table->{'name'} eq 'nat' && $rule->{'chain'} ne 'PREROUTING' &&
     &can_jump("SNAT")) {
 	if ($rule->{'j'}->[1] eq 'SNAT') {
 		if ($rule->{'to-source'}->[1] =~
-		    /^([0-9\.]+)(\-([0-9\.]+))?(:(\d+)(\-(\d+))?)?$/) {
+		    /^([0-9\.]+)?(\-([0-9\.]+))?(:(\d+)(\-(\d+))?)?$/) {
 			$sipfrom = $1;
 			$sipto = $3;
 			$spfrom = $5;
diff --git a/firewall/save_rule.cgi b/firewall/save_rule.cgi
index e2fdd2ed1..46ab3ac14 100755
--- a/firewall/save_rule.cgi
+++ b/firewall/save_rule.cgi
@@ -116,7 +116,8 @@ else {
 	if ($table->{'name'} eq 'nat' && $rule->{'chain'} ne 'PREROUTING' &&
 	    $rule->{'chain'} ne 'OUTPUT') {
 		if ($rule->{'j'}->[1] eq 'SNAT' && !$in{'snatdef'}) {
-			&check_ipaddress($in{'sipfrom'}) ||
+			(!$in{'sipfrom'} && !$in{'sipto'}) ||
+			    &check_ipaddress($in{'sipfrom'}) ||
 				&error($text{'save_esipfrom'});
 			!$in{'sipto'} || &check_ipaddress($in{'sipto'}) ||
 				&error($text{'save_esipto'});