Wild cards = *, ? instead of part of the IP or /IP to invert the logic (=except)
for instance I must write 192.168.*.* or *192.168.1.1-192.168.255.255?
to allow only 192.168.x.x
No , I think you must write: \192.168.*.* (meaning - ban ALL except...)
By the way, if you are behind a router, you are protected by it's NAT anyway, and if you WANT ot allow connection from the outside you MUST forward the port HFS is using INSIDE the router to your HFS-PC.