limiting connections to subnets