How do we allow certain set of Private IPs to enter through SSH login(RSA key pair) into Linux Server?

  • 3
    Firewall rules are a normal course of action to take Nov 22 '17 at 10:16
  • 2
    firewall or /etc/hosts.allow if ssh compile w/ TCP wrappers or /etc/ssh/sshd_config file rules. Nov 22 '17 at 10:41
  • more than one way to do, refer to linux.die.net/man/5/sshd_config which explains everything in /etc/ssh/sshd_config
    – ron
    Dec 20 '18 at 21:54

You can limit which hosts can connect by configuring TCP wrappers or filtering network traffic (firewalling) using iptables. If you want to use different authentication methods depending on the client IP address, configure SSH daemon instead (option 3).

Option 1: Filtering with IPTABLES

Iptables rules are evaluated in order, until first match.

For example, to allow traffic from network and otherwise drop the traffic (to port 22). The DROP rule is not required if your iptables default policy is configured to DROP.

iptables -A INPUT -p tcp --dport 22 --source -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

You can add more rules before the drop rule to match more networks/hosts. If you have a lot of networks or host addresses, you should use ipset module. There is also iprange module which allows using any arbitrary range of IP addresses.

Iptables are not persistent across reboots. You need to configure some mechanism to restore iptables on boot.

iptables apply only to IPv4 traffic. Systems which have ssh listening to IPv6 address the necessary configuration can be done with ip6tables.

Option 2: Using TCP wrappers

Note: this might not be an option on modern distributions, as support for tcpwrappers was removed from OpenSSH 6.7

You can also configure which hosts can connect using TCP wrappers. With TCP wrappers, in addition to IP addresses you can also use hostnames in rules.

By default, deny all hosts.


sshd : ALL

Then list allowed hosts in hosts.allow. For example to allow network and localhost.


sshd :
sshd :
sshd : [::1]

Option 3: SSH daemon configuration

You can configure ssh daemon in sshd_config to use different authentication method depending on the client address/hostname. If you only want to block other hosts from connecting, you should use iptables or TCP wrappers instead.

First remove default authentication methods:

PasswordAuthentication no
PubkeyAuthentication no

Then add desired authentication methods after a Match Address in the end of the file. Placing Match in the end of the file is important, since all the configuration lines after it are placed inside the conditional block until the next Match line. For example:

Match Address 127.0.0.*
    PubkeyAuthentication yes

Other clients are still able to connect, but logins will fail because there is no available authentication methods.

Match arguments and allowed conditional configuration options are documented in sshd_config man page. Match patterns are documented in ssh_config man page.

  • What about adding a ListenAddress directive in /etc/ssh/sshd_config ?
    – jerome
    Nov 27 '17 at 18:54
  • It is possible in specific situations (for example listening to private network address), depending on your network configuration and which hosts you want to allow.
    – sebasth
    Nov 27 '17 at 19:17
  • 3
    Additionally, ,sshd_config can set filterings with AlowUsers directive, and also, the authorized_keys can be set with 'from IP or subnet" to filter also.
    – tonioc
    Jun 11 '18 at 17:38
  • 2
    Note that sshd must be linked against libwrap for TCP wrappers to work (see e.g. here) and that support for tcpwrappers/libwrap was dropped from OpenSSH in v.6.7. On many modern systems Option 2 may no longer work.
    – AstroFloyd
    Sep 19 '20 at 8:10
  • 1
    @AstroFloyd thank you, I've added a note to the answer.
    – sebasth
    Oct 27 '20 at 20:39

Here some additional configuration for SSH daemon to extend previous answer:

  • Add user filtering with AllowUsers option in sshd_config file:

    AllowUsers johndoe@192.168.1.* admin2@192.168.1.* otherid1 otherid2

    This allows johndoe and admin2 only from 192.168.1.* addresses and otherid1, otherid2 from anywhere.

  • Restrict a ssh key or ca-based key to a set of addresses in .ssh/authorized_keys file of a given user's home directory:

    from="192.168.1.*,192.168.2.*" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABA...etc...mnMo7n1DD useralias

    In this example, the public key for useralias will be effective only from given addresses.

  • 1
    In my case, white listing in sshd was better than using iptables/ufw. The firewall was unable to keep up with traffic. We only needed to lock down ssh, so adding AllowUsers clause to /etc/ssh/sshd_config was a much lighter weight solution. Otherwise, you have to continuously tune your fire wall. You also have to stress/load test the firewall and it's hard to anticipate real network traffic patterns. May 13 '20 at 16:20

If you don't mind installing UFW:

sudo ufw allow from to any port 22


As previous mentioned it's a good practice to only authenticate using keys instead of passwords which can be done by editing /etc/ssh/sshd_config:

PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no
  • And how should the SSH login be limited to RSA key pair?
    – rickhg12hs
    Apr 30 '20 at 19:24
  • @rickhg12hs by adding your public RSA key to ~/.ssh/authorized_keys
    – Mahmoud K.
    Apr 30 '20 at 21:41
  • More is required to restrict login to only RSA key pair.
    – rickhg12hs
    May 1 '20 at 10:26
  • In /etc/ssh/sshd_config, set PasswordAuthentication, ChallengeResponseAuthentication and UsePAM to no.
    – Mahmoud K.
    May 1 '20 at 15:01
  • It's best if you update your answer so that future readers can look for a complete answer to the original question. I like to think about StackExchange sites as a searchable encyclopedia. Each question and answer should try to make the encyclopedia better and easy to get more correct information.
    – rickhg12hs
    May 1 '20 at 15:14

If you're using SSH CA for client authentication, you can specify the source-address option when signing certificates:

ssh-keygen -s ca_privkey -O source-address= id_rsa.pub

The certificate id_rsa-cert.pub can be used to log in to hosts only from addresses (not even unless you specify that as well).

man 1 ssh-keygen is a good document if you want more details.


Another way you can limit access to sshd on a GNU/Linux system at the socket level with a built-in (assuming init is systemd 235+ and kernel 4.11+) is by utilizing systemd with cgroup/eBPF access lists

Modify the base sshd systemd stanza

sudo systemctl edit sshd

Append the sshd [Service] stanza to your liking

#requires systemd 235+ and kernel 4.11+

reload for immediate effect

sudo systemctl daemon-reload

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.