The Network Firewall tab on an application controls API requests authenticated with that application's secret or with an integration access token for one of its integrations. It does not affect dashboard sign-in or person-token / User API traffic.
Changes take effect immediately. Add your servers' egress IPs to Known IP Addresses before you enable unknown-IP blocking.
For the controls, CIDR format, and recommended settings, see Network Firewall. For additional context and what is still on the request-hardening roadmap, see API Request Security.