You can restrict access to a specific subnet in several ways. I will assume your ssh server is on subnet 192.168.0.0/16 with an ip address of 192.168.0.10 , adjust accordingly ;)

Router

One line of defense is to use a router. Be sure to disable UPnP and do not allow port forwarding.

SSH configuration

You can set several options in /etc/ssh/sshd_config. One is the listen address. If You set a listen address on your subnet. A private IP address is not routable over the internet.

ListenAddress 192.168.0.10

You can also use the AllowUsers

AllowUsers [email protected]/16

Somewhat related, you can also change the port

Port 1234

See: http://manpages.ubuntu.com/manpages/precise/man5/sshd_config.5.html

TCP wrapper

As outlined on the forums post, you can use TCP Wrapper . TCP wrapper uses 2 files, /etc/hosts.allow and /etc/hosts.deny

Edit /etc/hosts.allow and add your subnet

sshd : 192.168.0.

Edit /etc/hosts.deny , and deny all

ALL : ALL

See also: http://ubuntu-tutorials.com/2007/09/02/network-security-with-tcpwrappers-hostsallow-and-hostsdeny/

Firewall

Last you can firewall your server. You can use iptables, ufw, or gufw.

`iptables`

sudo iptables -I INPUT -p tcp --dport 22 -s 192.168.0.0/16 -j ACCEPT

sudo iptables -A INPUT -p tcp --dport 22 -j REJECT

Please do not use DROP in iptables.

`ufw`

sudo ufw allow from 192.168.0.0/16 to any port 22

UFW

IptablesHowTo

ufw has a graphical interface: gufw

GUFW