The way we do subnet bans, that is, the ones that work with immunity, is as follows.
We create a ban block in admin dat, but dont finish the string under ip, and leave guid blank.
So for example, to ban 10.30.*.*, we just do 10.30.
We typically give it a name of SUBNET BAN, and a reason of BANNED SUBNET, TO REQUEST IMMUNITY VISIT FORUMS.
Thats how the immunity works.
We might code up a !subnet feature later, though.