diff --git a/bin/lua/wipf/util/ip.lua b/bin/lua/wipf/util/ip.lua
index 2d26bc0a..db212f4c 100644
--- a/bin/lua/wipf/util/ip.lua
+++ b/bin/lua/wipf/util/ip.lua
@@ -28,7 +28,7 @@ do
       end
     elseif sep == '/' then  -- e.g. "127.0.0.0/24"
       local nbits = tonumber(mask)
-      if nbits > 32 then
+      if nbits > 32 or nbits < 0 then
         return
       elseif nbits == 32 then
         to_ip = 0xFFFFFFFF
@@ -42,14 +42,18 @@ do
 
   ip4range_to_numbers = function (text)
     local iprange_from, iprange_to = {}, {}
-    local index = 0
+    local line_no, index = 0, 0
 
     for line in string.gmatch(text, "%s*([^\n]+)") do
       local from, to = parse_address_mask(line)
 
+      line_no = line_no + 1
+
       if from then
         index = index + 1
         iprange_from[index], iprange_to[index] = from, to
+      elseif string.find(line, "%S") then
+        return nil, line_no
       end
     end
 
diff --git a/test/wipf_test.lua b/test/wipf_test.lua
index a841abbd..ec4c9d9e 100644
--- a/test/wipf_test.lua
+++ b/test/wipf_test.lua
@@ -43,25 +43,35 @@ end
 
 print"-- IPv4 Conversions"
 do
-  local ip_range = [[
+  local from, to = wipf_ip.ip4range_to_numbers[[
     172.16.0.0/20
     192.168.0.0 - 192.168.255.255
   ]]
-
-  local from, to = wipf_ip.ip4range_to_numbers(ip_range)
   assert(from.n == 2 and to.n == 2)
   assert(from[1] == sock.inet_pton("172.16.0.0", true))
   assert(to[1] == sock.inet_pton("172.31.255.255", true))
   assert(from[2] == sock.inet_pton("192.168.0.0", true))
   assert(to[2] == sock.inet_pton("192.168.255.255", true))
+
+  local _, err_line
+  _, err_line = wipf_ip.ip4range_to_numbers[[172.16.0.0/33]]
+  assert(err_line == 1)
+  _, err_line = wipf_ip.ip4range_to_numbers[[172.16.0.255/-16]]
+  assert(err_line == 1)
   print("OK")
 end
 
 
 print"-- Conf Read/Write"
 do
-  local log_blocked = true
-  local ip_include = "*"
+  local ip_include_all = true
+  local ip_exclude_all = false
+
+  local app_log_blocked = true
+  local app_block_all = true
+  local app_allow_all = false
+
+  local ip_include = ""
   local ip_exclude = [[
     10.0.0.0/24
     127.0.0.0/24
@@ -69,15 +79,27 @@ do
     172.16.0.0/20
     192.168.0.0/16
   ]]
-  local app_block = [[
-    *
-    System
-  ]]
-  local app_permit = [[
-    D:\Programs\Skype\Phone\Skype.exe
-    D:\Utils\Firefox\Bin\firefox.exe
-    D:\Utils\Dev\Git\*
-  ]]
+
+  local app_groups = {
+    {
+      name = "Base",
+      enabled = true,
+      block = [[
+        System
+      ]],
+      allow = [[
+        D:\Programs\Skype\Phone\Skype.exe
+        D:\Utils\Dev\Git\*
+      ]]
+    },
+    {
+      name = "Browser",
+      enabled = false,
+      allow = [[
+        D:\Utils\Firefox\Bin\firefox.exe
+      ]]
+    }
+  }
 
   local iprange_from_inc, iprange_to_inc =
       wipf_ip.ip4range_to_numbers(ip_include)