firewall: implement support for abritary netmasks