netfilter: adding host IP filtering

For now, allowing three schema
single IP adress (like 127.0.0.1)
netmask (like 192.168.2.0/24 or 192.168.2.0/255.255.255.0)

single IP adress and netmask can be combined and must be comma separated like:
127.0.0.1,192.168.2.0/24,10.12.16.0/255.255.255.0