Network/netmask to match (requires inverse-mask be defined) ipv4net Inverse-mask to match