This seems to work as expected and allows CIDR, subnet, and single IP while rejecting IPs out of range.