monolith/firewall: add subnet chain