diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c
index 445132a659..fd48f3b07c 100644
--- a/src/core/dbus-cgroup.c
+++ b/src/core/dbus-cgroup.c
@@ -1978,11 +1978,12 @@ int bus_cgroup_set_property(
                         prefixes = streq(name, "IPAddressAllow") ? &c->ip_address_allow : &c->ip_address_deny;
                         reduced = streq(name, "IPAddressAllow") ? &c->ip_address_allow_reduced : &c->ip_address_deny_reduced;
 
+                        fputs(name, f);
+                        fputs("=\n", f);
+
                         if (n == 0) {
                                 *reduced = true;
                                 *prefixes = set_free(*prefixes);
-                                fputs(name, f);
-                                fputs("=\n", f);
                         } else {
                                 *reduced = false;
 
@@ -1991,7 +1992,7 @@ int bus_cgroup_set_property(
                                         return r;
 
                                 const struct in_addr_prefix *p;
-                                SET_FOREACH(p, new_prefixes)
+                                SET_FOREACH(p, *prefixes)
                                         fprintf(f, "%s=%s\n", name,
                                                 IN_ADDR_PREFIX_TO_STRING(p->family, &p->address, p->prefixlen));
                         }
diff --git a/test/units/TEST-19-CGROUP.IPAddressAllow-Deny.sh b/test/units/TEST-19-CGROUP.IPAddressAllow-Deny.sh
new file mode 100755
index 0000000000..a5c47b7086
--- /dev/null
+++ b/test/units/TEST-19-CGROUP.IPAddressAllow-Deny.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -ex
+set -o pipefail
+
+# shellcheck source=test/units/util.sh
+. "$(dirname "$0")"/util.sh
+
+if [[ "$(get_cgroup_hierarchy)" != unified ]]; then
+    echo "Skipping $0 as we're not running with the unified cgroup hierarchy."
+    exit 0
+fi
+
+if systemd-detect-virt --container --quiet; then
+    echo "Skipping $0 as we're running on container."
+    exit 0
+fi
+
+ip netns add test-ns
+ip link add test-veth-1 type veth peer test-veth-2
+ip link set test-veth-2 netns test-ns
+ip link set test-veth-1 up
+ip address add 192.0.2.1/24 dev test-veth-1
+ip address add 2001:db8::1/64 dev test-veth-1 nodad
+ip netns exec test-ns ip link set test-veth-2 up
+ip netns exec test-ns ip address add 192.0.2.2/24 dev test-veth-2
+ip netns exec test-ns ip address add 2001:db8::2/64 dev test-veth-2 nodad
+
+ping_ok_one() {
+    local interface="${1?}"
+    local target="${2?}"
+    shift 2
+
+    assert_ok systemd-run --wait --pipe "$@" ping -c 1 -W 1 -I "$interface" "$target"
+}
+
+ping_fail_one() {
+    local interface="${1?}"
+    local target="${2?}"
+    shift 2
+
+    assert_fail systemd-run --wait --pipe "$@" ping -c 1 -W 1 -I "$interface" "$target"
+}
+
+ping_ok() {
+    ping_ok_one lo 127.0.0.1 "$@"
+    ping_ok_one lo ::1 "$@"
+    ping_ok_one test-veth-1 192.0.2.2 "$@"
+    ping_ok_one test-veth-1 2001:db8::2 "$@"
+}
+
+ping_fail() {
+    ping_fail_one lo 127.0.0.1 "$@"
+    ping_fail_one lo ::1 "$@"
+    ping_fail_one test-veth-1 192.0.2.2 "$@"
+    ping_fail_one test-veth-1 2001:db8::2 "$@"
+}
+
+ping_ok
+ping_ok -p IPAddressDeny=any -p IPAddressDeny=
+ping_ok -p IPAddressDeny=any -p IPAddressDeny= -p IPAddressDeny=link-local
+ping_ok -p IPAddressDeny=any -p IPAddressAllow=localhost -p IPAddressAllow=192.0.2.0/24 -p IPAddressAllow=2001:db8::/64
+ping_ok -p IPAddressDeny=any -p IPAddressAllow=localhost -p IPAddressAllow=192.0.2.0/24 -p IPAddressAllow=2001:db8::/64 \
+        -p IPAddressAllow= -p IPAddressAllow=localhost -p IPAddressAllow=192.0.2.0/24 -p IPAddressAllow=2001:db8::/64
+
+ping_fail -p IPAddressDeny=any
+ping_fail -p IPAddressDeny=any -p IPAddressDeny= -p IPAddressDeny=localhost -p IPAddressDeny=192.0.2.0/24 -p IPAddressDeny=2001:db8::/64
+ping_fail -p IPAddressDeny=any -p IPAddressAllow=localhost -p IPAddressAllow=192.0.2.0/24 -p IPAddressAllow=2001:db8::/64 -p IPAddressAllow=
+ping_fail -p IPAddressDeny=any -p IPAddressAllow=localhost -p IPAddressAllow=192.0.2.0/24 -p IPAddressAllow=2001:db8::/64 -p IPAddressAllow= -p IPAddressAllow=link-local
+
+ip link del test-veth-1
+ip netns exec test-ns ip link del test-veth-2 || :
+ip netns del test-ns
diff --git a/test/units/util.sh b/test/units/util.sh
index f5f6786d0f..80ae8ffc5b 100755
--- a/test/units/util.sh
+++ b/test/units/util.sh
@@ -6,19 +6,30 @@
 # shellcheck disable=SC2034
 [[ -e /var/tmp/.systemd_reboot_count ]] && REBOOT_COUNT="$(</var/tmp/.systemd_reboot_count)" || REBOOT_COUNT=0
 
-assert_true() {(
+assert_ok() {(
     set +ex
 
     local rc
 
     "$@"
     rc=$?
-    if [[ $rc -ne 0 ]]; then
+    if [[ "$rc" -ne 0 ]]; then
         echo "FAIL: command '$*' failed with exit code $rc" >&2
         exit 1
     fi
 )}
 
+assert_fail() {(
+    set +ex
+
+    local rc
+
+    if "$@"; then
+        echo "FAIL: command '$*' unexpectedly succeeded" >&2
+        exit 1
+    fi
+)}
+
 assert_eq() {(
     set +ex