Index: postlfs/security/iptables.xml
===================================================================
--- postlfs/security/iptables.xml	(revision b4b71892e5e87c02670c525accc4bb71f512a88e)
+++ postlfs/security/iptables.xml	(revision 21975894ce05679fcc020ba9c4c2b807658c6a1b)
@@ -7,6 +7,6 @@
   <!ENTITY iptables-download-http "http://www.iptables.org/files/iptables-&iptables-version;.tar.bz2">
   <!ENTITY iptables-download-ftp  "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
-  <!ENTITY iptables-size          "183 KB">
-  <!ENTITY iptables-buildsize     "3.4 MB">
+  <!ENTITY iptables-size          "157 KB">
+  <!ENTITY iptables-buildsize     "4.4 MB">
   <!ENTITY iptables-time          "0.13 SBU">
 ]>
@@ -30,9 +30,10 @@
 <application>iptables</application>, you will need
 to configure the relevant options into your kernel.  This is discussed
-in the next part of this chapter - <xref linkend="postlfs-security-fw-kernel"/>.</para>
+in the next part of this chapter &ndash; 
+<xref linkend="postlfs-security-fw-kernel"/>.</para>
 
 <para>If you intend to use <acronym>IP</acronym>v6 you might consider extending
 the kernel by running <command>make patch-o-matic</command> in the top-level
-directory of the sources of <application>iptables</application>.  If you are 
+source tree directory of <application>iptables</application>.  If you are 
 going to do this, on a freshly untarred kernel, you need to run 
 <command>yes "" | make config &amp;&amp; make dep</command> first because 
@@ -47,6 +48,6 @@
 into <application>iptables</application> for the features recognized at 
 compile-time.  Applying a kernel patch may result in errors, often because the 
-hooks for the patches have changed or because the runme script doesn't 
-recognize that a patch has already been incorporated.</para>
+hooks for the patches have changed or because the <command>runme</command> 
+script doesn't recognize that a patch has already been incorporated.</para>
 
 <para>Note that for most people, patching the kernel is unnecessary.
@@ -71,9 +72,9 @@
 </sect2>
 
-
 <sect2>
 <title>Installation of <application>iptables</application></title>
 
-<para>Install <application>iptables</application> by running the following commands:</para>
+<para>Install <application>iptables</application> by running the following 
+commands:</para>
 
 <screen><userinput><command>make PREFIX=/usr LIBDIR=/lib BINDIR=/sbin &amp;&amp;
@@ -82,16 +83,16 @@
 </sect2>
 
-
 <sect2>
 <title>Command explanations</title>
 
-<para><parameter>PREFIX=/usr LIBDIR=/lib BINDIR=/sbin</parameter>: Compiles and installs 
-<application>iptables</application> libraries into <filename
-class="directory">/lib</filename>, binaries into <filename
-class="directory">/sbin</filename> and the remainder into the 
+<para><parameter>PREFIX=/usr LIBDIR=/lib BINDIR=/sbin</parameter>: Compiles 
+and installs <application>iptables</application> libraries into 
+<filename class="directory">/lib</filename>, binaries into 
+<filename class="directory">/sbin</filename> and the remainder into the 
 <filename class="directory">/usr</filename> hierarchy instead of 
 <filename class="directory">/usr/local</filename>. Firewalls are
-generally set during the boot process and <filename
-class="directory">/usr</filename> may not be mounted at that time.</para>
+generally activated during the boot process and 
+<filename class="directory">/usr</filename> may not be mounted at that 
+time.</para>
 
 </sect2>
@@ -100,7 +101,9 @@
 <title>Contents</title>
 
-<para>The <application>iptables</application> package contains <command>iptables</command>,
-<command>iptables-restore</command>, <command>iptables-save</command>,
-<command>ip6tables</command> and some libraries.</para>
+<para>The <application>iptables</application> package contains 
+<command>iptables</command>, <command>iptables-restore</command>, 
+<command>iptables-save</command>, <command>ip6tables</command> 
+and the <filename class='libraryfile'>libip*.so</filename> library
+modules.</para>
 
 </sect2>
@@ -122,8 +125,9 @@
 <para>This is the same as <command>iptables</command> but for use with
 <acronym>IP</acronym>v6.  As of v1.2.5, it is not as complete as the standard 
-<acronym>IP</acronym>v4 version, especially with regard to some of the modules.</para>
+<acronym>IP</acronym>v4 version, especially with regard to some of the 
+modules.</para>
 </sect3>
 
-<sect3><title>libip*.so</title>
+<sect3><title>libip*.so library modules</title>
 <para>These are various modules (implemented as dynamic libraries) which
 extend the core functionality of <command>iptables</command>.</para>
