example needs to match cidr