diff --git a/pkg/acl/ip.go b/pkg/acl/ip.go
new file mode 100644
index 0000000..fe31923
--- /dev/null
+++ b/pkg/acl/ip.go
@@ -0,0 +1,27 @@
+package acl
+
+import "net"
+
+func parseIPZone(s string) (net.IP, string) {
+	s, zone := splitHostZone(s)
+	return net.ParseIP(s), zone
+}
+
+func splitHostZone(s string) (host, zone string) {
+	if i := last(s, '%'); i > 0 {
+		host, zone = s[:i], s[i+1:]
+	} else {
+		host = s
+	}
+	return
+}
+
+func last(s string, b byte) int {
+	i := len(s)
+	for i--; i >= 0; i-- {
+		if s[i] == b {
+			break
+		}
+	}
+	return i
+}