public void setDeniedIps(String deniedIps) {
        String[] ips = StringUtils.tokenizeToStringArray(deniedIps, ", \t");
        if (ips != null && ips.length > 0) {
            deniedIpMatchers = new ArrayList<IpAddressMatcher>();
            for (String ip : ips) {
                deniedIpMatchers.add(new IpAddressMatcher(ip));
            }
        }
    }
Specified a set of (comma, tab or space-separated) strings representing
IP address representing IPv4 or IPv6 ranges / CIDRs from which access
should be blocked.
web/src/main/java/org/apache/shiro/web/filter/authz/IpFilter.java