Add range rules

[tansly]

For more practical configuration, and for a default deny policy to be even marginally practical (#10), there needs to be a way to match a range of ports, IP addresses etc.