check sourceip= vs the subnet=...

here's a table

- subnet=host when not specified
- sourceip must fall within at least one subnet= entry
  which means matches host
- sourceip conflicts with interface-ip

see also, github #897 #1691 #1693 #1699

