I suggest you to take a look at the answer to the following question, maybe it can help you:
"I doubt you can do that at the web.config level unless the "IP and Domain Restrictions" role is installed on the server itself."
Web.config 500 block ipaddress - Internal server error
Even if you're not getting the 500 error, maybe you just have to add the:
<clear/>
to remove all upstream restrictions? Let me know.
EDIT: added instructions to configure Restriction access to websites using IP address in IIS 7.
Here's a good link, explaining how to install "IP and Domains restrictions" in IIS 7, as this feature is not installed by default. If you don't install this feature, restrictions won't work!
http://linuxwebservertips.in/restrict-access-to-website-using-ip-address-in-iis-7/
Follow this guide and everything will work fine, As you can see, you can add multiple range restrictions too.