I believe that in the example above, it should show +* to end the IP blocks.
#So IP block start
+1.2.3.4 #whatever the actual IP address is
#and end
+*
#Program block start
!ipfw #or whatever actual program name is
#Program block end
!*
At least this seems to be the behaviour in Tiger.