So...
[network]
# block one host incoming/outgoing from/to all ports.
blacklist = 209.222.252.42
# block one host incoming/outgoing from/to port 8333.
blacklist = 209.222.252.42:8333
# block class C subnet incoming/outgoing from/to all ports.
blacklist = 209.222.252.0/24
# block class C subnet incoming/outgoing from/to port 8333.
blacklist = 209.222.252.0:8333/24
# allow one host incoming from all ports.
whitelist = 209.222.252.42
# allow one host incoming from port 4242.
whitelist = 209.222.252.42:4242
# allow class C subnet incoming from all ports.
whitelist = 209.222.252.0/24
# allow class C subnet incoming from port 4242.
whitelist = 209.222.252.0:4242/24