Instead of ip/netmask. This should be functionally equivalent (for now), and makes it easier to identify the rule as belonging to weave. Unfortunatley we must still match the source with ip/netmask, since we are in the POSTROUTING chain and source interface matches aren't valid there. See also issue #20.