Permit/Deny in sip.conf

Can anybody enlighten me on how permit/deny exactly works in sip.conf?
Let’s take the permit example:
Specifying an IP address or subnet here will do what exactly:
Allow registration attempts only from said subnet?
Prevent the device from sending and/or receiving traffic from IP addresses outside the permit range?

Thank you.

The source address for inbound INVITE, PUBLISH, OPTIONS, or REGISTER requests, but possibly not Re-INVITEs.

Is it possible to specify more IP address ranges in sip.conf under permit for an extension?
E.g. like this:

This might help you … -deny-mask