Bleah, iptables is rather hostile. Sure, you have a webserver, add a rule to allow TCP over 80. Later you revisit, decide you need to add 443. So you do the

Bleah, iptables is rather hostile. Sure, you have a webserver, add a rule to allow TCP over 80. Later you revisit, decide you need to add 443. So you do the obvious and change "80" to "80,443". Which fails. Turns out there's a completely different way to match multiple ports. Or you could write a rule per port... making mistakes much more likely and much harder to spot.