Hi Juergen,
my configuration is 172.20.0.0/24 and it does not work! Both the lock and the broker have 172.20.1.x IP addresses. When I try to connect it does not even try to. It just errors out. When I add a fake 192.168.x.x address it takes a while and errors out. When I take a public IP it behaves the same as when I use my local private subnet. It really looks like an issue in your setting for local IP address range.
I have now added an additional broker connected to another wifi router using 192.168.2.x and what should I say if connect right away without any issues!
Please test in your test environment the 172.20.0.0 255.255.254.0 setting and let me know if that works in your test environment, I assume you have one 
Did some additional testing on the same hardware where I was able to connect successfully.
172.17.0.0 with subnetmask 255.255.254.0 did not work!
172.17.1.0 with subnetmask 255.255.255.0 did not work!
172.16.1.0with subnetmask 255.255.255.0 WORKS!
172.16.1.0with subnetmask 255.255.254.0 WORKS!
My conclusion! Your local network identification filter has a bug!
It only accepts 172.16.x.x and that is not like RFC1918 that you mentioned earlier. Please, please, please check the code and test in 172.16+ subnets!
I reported this 21st of March and it is not fixed and has not been tested.
Thanks,
Devid