public void setAuthorizedIps(String authorizedIps) {
        String[] ips = StringUtils.tokenizeToStringArray(authorizedIps, ", \t");
        if (ips != null && ips.length > 0) {
            authorizedIpMatchers = new ArrayList<IpAddressMatcher>();
            for (String ip : ips) {
                authorizedIpMatchers.add(new IpAddressMatcher(ip));
            }
        }
    }
Specifies a set of (comma, tab or space-separated) strings representing
IP address representing IPv4 or IPv6 ranges / CIDRs from which access
should be allowed (if the IP is not included in either the list of
statically defined denied IPs or the dynamic list of IPs obtained from
the IP source.
web/src/main/java/org/apache/shiro/web/filter/authz/IpFilter.java