Use CIDR for network ranges, numerical netmask doesn't work