New IP rule entry does not allow CIDR range, only detected IP from escalation resolution page. In screenshot below, I tried to add the CIDR but it defaulted to the detected IP. You must navigate to unwanted access page, click on manage country/vpn rules to bring up IP Rules.