diff --git a/src/shared/firewall-util.c b/src/shared/firewall-util.c
index eac86b24ed..eb9fc8b961 100644
--- a/src/shared/firewall-util.c
+++ b/src/shared/firewall-util.c
@@ -874,12 +874,7 @@ int nft_set_element_modify_iprange(
         assert(nfproto_is_valid(nfproto));
         assert(table);
         assert(set);
-
-        if (!source || source_prefixlen == 0)
-                return -EINVAL;
-
-        if (af == AF_INET6 && source_prefixlen < 8)
-                return -EINVAL;
+        assert(source);
 
         r = sd_nfnl_nft_message_new_setelems(nfnl, &m, add, nfproto, table, set);
         if (r < 0)
@@ -909,9 +904,7 @@ int nft_set_element_modify_ip(
         assert(nfproto_is_valid(nfproto));
         assert(table);
         assert(set);
-
-        if (!source)
-                return -EINVAL;
+        assert(source);
 
         r = sd_nfnl_nft_message_new_setelems(nfnl, &m, add, nfproto, table, set);
         if (r < 0)
@@ -984,6 +977,7 @@ int fw_nftables_add_masquerade(
 
         assert(nfnl);
         assert(IN_SET(af, AF_INET, AF_INET6));
+        assert(source);
 
         if (!socket_ipv6_is_supported() && af == AF_INET6)
                 return -EOPNOTSUPP;
diff --git a/src/test/test-firewall-util.c b/src/test/test-firewall-util.c
index cdf1864b21..70735654ed 100644
--- a/src/test/test-firewall-util.c
+++ b/src/test/test-firewall-util.c
@@ -56,14 +56,14 @@ TEST(v4) {
 
         ASSERT_NOT_NULL(nfnl);
 
-        ASSERT_ERROR(fw_nftables_add_masquerade(nfnl, true, AF_INET, NULL, 0), EINVAL);
-        ASSERT_ERROR(fw_nftables_add_masquerade(nfnl, true, AF_INET, parse_addr("10.1.2.0", &u), 0), EINVAL);
-
         ASSERT_OK_OR(r = fw_nftables_add_masquerade(nfnl, true, AF_INET, parse_addr("10.1.2.3", &u), 32),
                      -EPERM, -EOPNOTSUPP, -ENOPROTOOPT);
         if (r < 0)
                 return (void) log_tests_skipped_errno(r, "Failed to add IPv4 masquerade");
 
+        ASSERT_OK(fw_nftables_add_masquerade(nfnl, true, AF_INET, parse_addr("10.1.2.0", &u), 0));
+        ASSERT_ERROR(fw_nftables_add_masquerade(nfnl, true, AF_INET, parse_addr("10.0.2.0", &u), 28), EEXIST);
+        ASSERT_OK(fw_nftables_add_masquerade(nfnl, false, AF_INET, parse_addr("10.1.2.0", &u), 0));
         ASSERT_OK(fw_nftables_add_masquerade(nfnl, true, AF_INET, parse_addr("10.0.2.0", &u), 28));
         ASSERT_OK(fw_nftables_add_masquerade(nfnl, false, AF_INET, parse_addr("10.0.2.0", &u), 28));
         ASSERT_OK(fw_nftables_add_masquerade(nfnl, false, AF_INET, parse_addr("10.1.2.3", &u), 32));