/carpeta ip/mask (ro,root_squad) @ trusted (rw,no_root_squad)