Can someone please tell me how to restrict SSH access only to certain IP ranges (e.g. local network) and not the whole Internet? I guess this has to be done via firewall.

3 Answers 3


From man sshd:

Access controls that should be enforced by tcp-wrappers are defined here.  
Further details are described in hosts_access(5).

https://debian-administration.org/article/87/Keeping_SSH_access_secure offers these examples:

# /etc/hosts.allow

# /etc/hosts.deny
sshd: ALL

The TCP wrapper program in Mac OS X is: tcpd

  • Does this work on MacOS? My man sshd says nothing about /etc/hosts.allow. Feb 24, 2020 at 20:34
  • 1
    This answer is 8 years old. It worked at the time. I don't know what the current solution is, unfortunately.
    – TJ Luoma
    Feb 24, 2020 at 20:59
  • Yeah, sorry. I eventually realized that between OpenBSD 5.5 (man.openbsd.org) and 5.6 it must have been removed. Feb 24, 2020 at 22:10

I did not test this, but I'd try this in terminal:

sudo ipfw add allow src-ip,, dst-ip me dst-port 22
sudo ipfw add reject src-ip any dst-ip me dst-port 22

If you are behind a router and didn't map the port to your computer, that effectively disables SSH access from the internet.

  • Yes, I am aware of that. Unfortunately this isn't really a solution for me as this is for my MacBook Pro which occasionally is connected to networks with external IP and no router in-between.
    – Michal M
    Dec 18, 2011 at 23:20
  • 1
    That seems very unlikely, and assuming you only have one network adapter, that would imply there is no 'local' network if a public IP address is bound to it.
    – Gerry
    Dec 18, 2011 at 23:25
  • Unlikely or not, doesn't really matter, does it? Apart from external IP situation, consider Public WiFi networks. I know which networks are safe for me and I'd like to restrict access to only these networks. My question is a little more generic though which was my intention.
    – Michal M
    Dec 18, 2011 at 23:30
  • I'd suggest rephrasing the question then. Sounds like you are looking to whitelist (some) IP ranges for some services in the firewall.
    – Gerry
    Dec 19, 2011 at 9:07
  • Done as suggested. Cheers.
    – Michal M
    Dec 19, 2011 at 9:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .