diff --git a/group_vars/all b/group_vars/all
index 88065f1..640ba6d 100644
--- a/group_vars/all
+++ b/group_vars/all
@@ -17,17 +17,13 @@ vdr:
   uid: 666
   gid: 666
   home: /var/lib/vdr
+  etc_confdir: /etc/vdr
   confdir: /var/lib/vdr
   recdir: /srv/vdr/video
   hide_first_recording_level: false
   safe_dirnames: true  # escape characters (useful for windows clients and FAT/NTFS file systems)
   override_vdr_charset: false
 
-# optional additional hosts and subnets for svdrphosts.conf
-#
-# vdr_svdrphosts:
-#   - 192.168.0.0/24
-
 # copy channels.conf from a local file
 # vdr_channels_conf: /path/to/channels.conf
 
@@ -39,6 +35,26 @@ vdr_plugins:
   - vdr-plugin-devstatus
   - vdr-plugin-markad
   - vdr-plugin-softhddevice-vpp
+
+# IP (range) filter for vdr and plugins (this must be an array):
+# vdr_allowed_hosts:
+#   - 192.168.0.0/24
+#
+# hosts and subnets for svdrphosts.conf (overrides vdr_allowed_hosts):
+# vdr_svdrphosts:
+#   - 192.168.0.0/24
+#
+# hosts and subnets for allowed_hosts.conf of xineliboutput (overrides vdr_allowed_hosts):
+# xineliboutput_allowed_hosts:
+#   - 192.168.0.0/24
+#
+# hosts and subnets for allowed_hosts.conf of vnsiserver (overrides vdr_allowed_hosts):
+# vnsiserver_allowed_hosts:
+#   - 192.168.0.0/24
+#
+# hosts and subnets for streamdevhosts.conf (overrides vdr_allowed_hosts):
+# streamdev_server_allowed_hosts:
+#   - 192.168.0.0/24
 # dictionary of directories for (shared) files. Automatically exported via NFS and Samba if those roles are enabled
 media_dirs:
   audio: /srv/audio