I want to be able to log in to a (publicly-accessible) SSH server from the local network (192.168.1.*) using some SSH key, but I don't want that key to be usable from outside the local network.
I want some other key to be used for external access instead (same user in both cases).

Is such a thing possible to achieve in SSH?


2 Answers 2



In the file ~/.ssh/authorized_keys on the server, each entry now probably looks like


(or similar)

There is an optional first column that may contain options. These are described in the sshd manual.

One of the options is


Specifies that in addition to public key authentication, either the canonical name of the remote host or its IP address must be present in the comma-separated list of patterns. See PATTERNS in ssh_config(5) for more information on patterns.

In addition to the wildcard matching that may be applied to hostnames or addresses, a from stanza may match IP addresses using CIDR address/masklen notation.

The purpose of this option is to optionally increase security: public key authentication by itself does not trust the network or name servers or anything (but the key); however, if somebody somehow steals the key, the key permits an intruder to log in from anywhere in the world. This additional option makes using a stolen key more difficult (name servers and/or routers would have to be compromised in addition to just the key).

This means that you should be able to modify ~/.ssh/authorized_keys from



from="pattern" ssh-ed25519 AAAAC3NzaC1lZSOMEKEYFINGERPRINT comment

Where pattern is a pattern matching the client host that you're connecting from, for example by its public DNS name, IP address, or some network block:

from="" ssh-ed25519 AAAAC3NzaC1lZSOMEKEYFINGERPRINT comment

(this would only allow the use of this key from a host in the 192.168.1.* network)

  • 2
    @Mehrdad Notice that pattern needs to match the client from the server's perspective. A local IP address pattern like 192.168.1.* may not work (unless the server is on the same network).
    – Kusalananda
    Mar 22, 2017 at 11:11
  • Interesting, why would it not work given they are both on the same network? There's by definition no NAT involved if they're on the same network, right? (Edit: Just saw your edit. Yeah, this was specifically for the local network so it should work.)
    – user541686
    Mar 22, 2017 at 11:14
  • @Mehrdad Just added that because you said the server was "publically available", so I thought it was "remote".
    – Kusalananda
    Mar 22, 2017 at 11:14
  • Ah. Nah, I mentioned that so people wouldn't start arguing with me about why disabling remote logins isn't a solution if I'm only using the server locally or something. You have to ask questions very defensively on SE in my experience... some people really go out of their way to give non-solutions. :(
    – user541686
    Mar 22, 2017 at 11:15

You can achieve this by adding from="" in front of the public key in the .authorized_keys file. The entire row should look like this:

from="" ssh-rsa AAAA....

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .