ip cidr ipfilter security

Thats not clear enough: The setting in GUI for an IP will enter in CIDR format. The container get the IP of the CIDR ok. Protect the ipfilter then the IP or the CIDR? So, can the container-admin change the IP (spoofing) into an other IP into same CIDR? When we have IP-blocks, we give one IP to...