diff --git a/firewall/edit_rule.cgi b/firewall/edit_rule.cgi
index 1d4438f39..b178eb452 100755
--- a/firewall/edit_rule.cgi
+++ b/firewall/edit_rule.cgi
@@ -181,13 +181,19 @@ print &ui_table_start($text{'edit_header2'}, "width=100%", 2);
 
 # Packet source
 print &ui_table_row($text{'edit_source'},
-	&print_mode("source", $rule->{'s'})." ".
-	&ui_textbox("source", $rule->{'s'}->[1], 40));
+	&ui_grid_table([
+		&print_mode("source", $rule->{'s'}),
+		&ui_textarea("source", join(" ", split(/,/, $rule->{'s'}->[1])),
+			     4, 80),
+		], 2));
 
 # Packet destination
 print &ui_table_row($text{'edit_dest'},
-	&print_mode("dest", $rule->{'d'})." ".
-	&ui_textbox("dest", $rule->{'d'}->[1], 40));
+	&ui_grid_table([
+		&print_mode("dest", $rule->{'d'}),
+		&ui_textarea("dest", join(" ", split(/,/, $rule->{'d'}->[1])),
+			     4, 80),
+		], 2));
 
 # Incoming interface
 print &ui_table_row($text{'edit_in'},
diff --git a/firewall/firewall-lib.pl b/firewall/firewall-lib.pl
index ff666e44d..6897a1278 100755
--- a/firewall/firewall-lib.pl
+++ b/firewall/firewall-lib.pl
@@ -208,6 +208,8 @@ foreach $d ('p', 's', 'd', 'i', 'o', 'f', 'dport',
 	if ($_[0]->{$d}) {
 		local ($n, @v) = @{$_[0]->{$d}};
 		@v = map { uc($_) } @v if ($d eq 'p');
+		@v = map { join(", ", split(/,/, $_)) } @v
+			if ($d eq 's' || $d eq 'd');
 		local $txt = &text("desc_$d$n", map { "<b>$_</b>" } @v);
 		push(@c, $txt) if ($txt);
 		}
diff --git a/firewall/save_rule.cgi b/firewall/save_rule.cgi
index d099f837f..10cb78197 100755
--- a/firewall/save_rule.cgi
+++ b/firewall/save_rule.cgi
@@ -144,9 +144,10 @@ else {
 		}
 	if (&parse_mode("source", $rule, "s")) {
 		&check_ipmask($in{'source'}) || &error($text{'save_esource'});
-		$rule->{'s'}->[1] = $in{'source'};
+		$rule->{'s'}->[1] = join(",", split(/\s+/, $in{'source'}));
 		}
 	if (&parse_mode("dest", $rule, "d")) {
+		$in{'dest'} =~ s/\r|\n//g;
 		&check_ipmask($in{'dest'}) || &error($text{'save_edest'});
 		$rule->{'d'}->[1] = $in{'dest'};
 		}
@@ -408,7 +409,7 @@ else {
 
 sub check_ipmask
 {
-foreach my $w (split(/,/, $_[0])) {
+foreach my $w (split(/\s+/, $_[0])) {
 	my $ok = &to_ipaddress($w) ||
 		$w =~ /^([0-9\.]+)\/([0-9\.]+)$/ &&
 			&to_ipaddress("$1") &&