bugfix: allow subnets of green/blue/orange/red as network group