filtering by subnet seems to work