every place where you can put an address mask, you can use "lan" as it would be "any LAN address", that is 127.0.0.1;192.168.*;10.*;etc
let's say you have a ban rule: \lan
since you got the initial "\", logic is inverted, and all NON-lan addresses are banned.
i thought of this feature to be used with stunnel: you put
forwarded-mask=lan
in your ini, if your stunnel is on another computer of the LAN.
SADLY, this build will not let you enter this special value, because i forgot to make the syntax check compatible with it.
you will have to wait till #255 (or workaround it, if you can't wait).