As long as you do not specify any IP address all user can connect from any IP address, but as soon as you specify
(-)mask all user can not connect from the IP address in the refuse rules.
If you add allow access before the refuse access,all user can connect form any IP in the allow access. But if you add allow
access after the refuse access,it impacts nothing.
So the order of the rules is also very important.

For example

+192.168.0.12
-192.168.0.*
Refuse all user from 192.168.0.* to connect except 192.168.0.12 since 192.168.0.12 is in allow rules before 192.168.0.*.

-192.168.0.*
+192.168.0.12
Refuse all user from 192.168.0.* to connect, since 192.168.0.12 after 192.168.0.* impacts nothing.

Rule list

The Rule list shows the current list and order of IP rules. Rules can be added and removed from the list using the Add and Delete buttons.

Also, the order of the rules may be altered using the Up and Down buttons on the right of the rule list..

Supported wildcards

To define access rules you can use the wildcards ? and *.

Priority

This ip access list will have priority on user account ip access list.