An IP address is a 32-bit number written as four decimal octets separated by dots, such as 10.0.0.1. A CIDR block is written as base_ip/k, which represents every IP address whose first k bits match the first k bits of base_ip. A plain IP (no slash) is treated as a /32, matching exactly that address.

Design a firewall that evaluates incoming IP addresses against an ordered list of rules. Each rule is either ALLOW or DENY paired with an IP or CIDR block. The first rule whose range contains the query IP determines the outcome. If the rule is ALLOW, access is granted; if DENY, it is blocked. You are guaranteed that every query matches at least one rule. ...