Defining group access for all IPs

In the current implementation it doesn't seem possible to do something like:
- One group has access to everything excluding address 1.2.3.4
- The other group doesn't have access to anything but address 3.4.5.6

without using a second gateway (with a different default policy) or defining every destination address by hand.

This has been reported via support.