Recognize "net-" in match_ip lists (as documented).