TYPO3 Core

PHP versions tested: 5.1.x, 5.2.8

This is the documented behaviour of that setting:

[BE][IPmaskList] = String. Lets you define a list of IP-numbers (with *-wildcards) that are the ONLY ones allowed access to ANY backend activity. On error an error header is sent and the script exits. Works like IP masking for users configurable through TSconfig.

You are probably mixing it up with [SYS][devIPmask], which is described as:

Defines a list of IP addresses which will allow development-output to display. The debug() function will use this as a filter.