--- a/mod_firewall/README.md	Wed Mar 25 18:52:10 2026 +0000
+++ b/mod_firewall/README.md	Thu Mar 26 13:33:44 2026 +0000
@@ -302,6 +302,29 @@
 stanza. It is not advisable to perform access control or similar rules
 on JIDs in these chains (see the [chain documentation](#chains) for more info).
 
+#### IP matching
+
+  Condition        Matches
+  ---------------- -------------------------------------------------------------
+  `FROM IP`        The origin/session's IP address matches the provided IP address
+  `FROM SUBNET`    The origin/session's IP is within the given (CIDR) subnet range
+
+
+For example:
+
+```
+# Only allow stanzas to user@example.com from clients connected to 127.0.0.1
+NOT FROM IP: 127.0.0.1
+TO: user@example.com
+BOUNCE=policy-violation
+
+FROM SUBNET: 10.0.0.0/8
+PASS.
+
+FROM SUBNET: 2001:db8::/32
+PASS.
+```
+
 #### GeoIP matching
 
   Condition        Matches