To allow SSH only from a trusted address, enforce the rule at one or more layers: OpenSSH can match a username to a source IP with AllowUsers, UFW can drop unwanted TCP/22 packets before authentication, and a VPS provider’s network firewall can block them before they reach the server. Use the narrowest rule that fits, validate it with sudo sshd -t, and keep an existing session or console open until a new allowed connection succeeds.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What an IP-restricted SSH policy actually controls
SSH access has two separate decisions. First, a network control decides whether a packet from a source address can reach the SSH port. Then sshd decides whether the connecting account and its authentication method are permitted. An IP allowlist does not replace account authorization; it only narrows where a permitted login may originate.
As an Amazon Associate I earn from qualifying purchases.
For a single administrator and a fixed public IPv4 address, the most direct OpenSSH rule is:
AllowUsers [email protected]If the trusted network is a /24 subnet, use the CIDR network instead:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
AllowUsers [email protected]/24When AllowUsers is present, only matching user-and-host combinations are allowed. OpenSSH evaluates DenyUsers before AllowUsers, so an explicit deny still wins. The host portion accepts addresses in CIDR address/mask-length form.
Choose the enforcement layer
| Layer | Best use | Scope | What happens to unwanted traffic | Typical evidence |
|---|---|---|---|---|
OpenSSH AllowUsers |
Permit a named account from one address or network | Selected usernames and source hosts | Packets reach SSH, but non-matching logins are rejected by the daemon | SSH daemon authentication logs |
OpenSSH Match Address |
Change SSH settings by source network, user, or group | Conditional policy for IPv4 or IPv6 CIDR ranges | Connection reaches SSH and receives the settings selected by the match | SSH daemon logs and effective configuration checks |
| UFW host firewall | Reject unwanted SSH packets before authentication | All traffic to the host’s SSH port from a host or subnet | Firewall blocks the packet before sshd processes it |
Host firewall status and logs |
| VPS provider firewall or security group | Stop traffic outside the virtual machine | Provider network interface, often including multiple servers | Provider network drops the packet before it reaches the VPS | Provider flow or firewall logs |
Combining layers is reasonable: a provider rule or UFW rule limits who can reach port 22, while AllowUsers limits which accounts can log in. The trade-off is operational complexity. Every layer must contain the current address, port, and address family, and each provider exposes different syntax, IPv6 behavior, logging, and pricing.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBefore changing anything
- Keep the current SSH session open. Also identify a VPS web console, serial console, bastion host, or other out-of-band recovery path.
- Record the administrator’s actual public IPv4 and IPv6 source addresses. The address shown inside a VPN or behind NAT may not be the address the VPS sees.
- Confirm the SSH listening port. The examples use TCP port 22; substitute the configured port in firewall commands.
- List every account that must retain access and decide whether the rule should cover one account, several accounts, or an account group.
- Decide whether the address is stable. A residential, mobile, or rotating VPN address can make a fixed
/32allowlist stop working without warning.
Method 1: Allow one account from one IP with AllowUsers
Edit the effective SSH server configuration
Open the server configuration as root or with sudo. Common installations use /etc/ssh/sshd_config, but distributions can also load snippets from /etc/ssh/sshd_config.d/. Inspect the effective files before editing so a later snippet does not override or invalidate the rule.
Add a host-specific rule
For account admin at public address 203.0.113.10, add:
AllowUsers [email protected]This is an account-and-source rule: the username must be admin, and the connection must originate from that address. Numeric user IDs are not accepted in place of usernames.
Allow a trusted subnet
Use the network prefix and mask length when an office or VPN exit has a controlled range:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
AllowUsers [email protected]/24A broader prefix is easier to maintain but trusts more source addresses. Use the smallest range that covers the legitimate clients.
Permit multiple accounts or sources
Place multiple entries when different combinations are required. For example, separate lines can grant two administrators access from the same office range. Keep the list explicit; adding one user does not implicitly authorize every account on the VPS.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Method 2: Use Match Address for conditional policies
Match Address is suited to policies that change according to source network and may also depend on a user or group. OpenSSH documents IPv4 and IPv6 CIDR criteria, and the mask length must be valid for the address.
Match User admin Address 203.0.113.10
PasswordAuthentication noThis example disables password authentication only when admin connects from the listed address. It is an illustration of conditional matching, not a universal hardening profile; choose authentication options that fit the server’s actual policy.
An IPv6 criterion uses an IPv6 prefix, for example 2001:db8::/32. Apply the same care as with IPv4: verify the prefix, the mask length, and the address that the VPS receives. A rule covering IPv4 does not express an IPv6 policy.
Method 3: Allow SSH through UFW only from trusted sources
UFW is Ubuntu’s user-friendly frontend for the host firewall. A source-specific rule for one IPv4 address is:
sudo ufw allow proto tcp from 192.168.0.2 to any port 22To allow the entire subnet, replace the host with its CIDR network:
sudo ufw allow proto tcp from 192.168.0.0/24 to any port 22Adapt the destination port if SSH listens somewhere other than 22. If the VPS accepts SSH over IPv6, add and audit an equivalent IPv6 rule; an IPv4 rule does not protect the IPv6 listener.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhen replacing a broad “allow SSH from anywhere” rule, add the source-specific rule first. Removing the broad rule before the narrow rule exists can terminate your only path back into the server.
Method 4: Add a provider network firewall
A VPS provider’s firewall or security group can enforce the source restriction outside the guest operating system. This is useful when you operate several servers, want a central policy, or need protection even while the VPS firewall is misconfigured. Provider syntax, whether IPv6 is enabled by default, rule ordering, logging, and charges differ, so verify those details in the provider’s current control panel and documentation.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Keep a guest-level control when practical. A provider rule limits reachability, while OpenSSH still limits accounts; relying on only one layer leaves a larger blast radius if that layer is changed or disabled.
Restrict which accounts may use SSH
Source filtering and account filtering solve different problems. Ubuntu documents an account-group approach:
AllowGroups sshloginCreate or use the sshlogin group, add each permitted account, and restart the SSH service after validating the configuration. A user who is outside the allowed group cannot use SSH even if connecting from a trusted address. Combine this with an address rule when both the account and source network must be approved.
Remember that adding AllowGroups changes the account policy for every SSH login. Check service accounts, automation users, and emergency administrators before applying it.
A practical choice for common environments
For one administrator with a stable public address, AllowUsers admin@address is the smallest policy and is easy to review in the SSH configuration. If several accounts should be reachable only from an office or VPN, pair an explicit account policy with a CIDR source range. If every service on the VPS should be unreachable from untrusted networks, add UFW or a provider firewall so packets are discarded before authentication.
A provider firewall is especially useful when several VPS instances share the same source allowlist. It can provide one change point and network-level logs, but the provider may charge for the feature or expose different behavior for IPv4 and IPv6. There is no universal price or rule syntax: check the selected provider’s current plan, regions, limits, and logging options. A host firewall is usually more portable between Linux distributions, while OpenSSH rules travel with the daemon configuration.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Use observability appropriate to the layer. An OpenSSH rejection can appear in SSH authentication logs; a UFW decision is visible in host firewall status or logs; a provider drop may be visible only in the provider’s flow or firewall logs. If a test fails, knowing which layer saw the connection prevents guessing.
Multiple users, networks, and ports
Write every required account-and-source combination deliberately. A rule for admin does not authorize deploy, and a trusted office range does not make every local account eligible unless the account controls allow it. Review automation users and emergency administrators before enabling AllowGroups or an allowlist.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Keep the SSH port consistent across layers. If the daemon listens on a nonstandard port, change the UFW destination and provider firewall destination to that port; a rule for TCP/22 will not permit the alternate listener. Conversely, changing the daemon port without changing a provider rule can leave the server unreachable even though the source address is correct.
Free tools Windows power users keep installed
One-click scans. No signup required.
Safe rollout procedure
- Preserve recovery access. Leave the current SSH connection open and confirm that a VPS console, bastion, or other out-of-band route is available.
- Measure the real source. Record the public IPv4 and IPv6 addresses presented to the VPS. Do not substitute a private workstation address or an address visible only inside a VPN.
- Write the narrowest rule. Add the exact
AllowUsers,Match Address, UFW, or provider rule. Use a single host when feasible; use a subnet only when several controlled addresses need access. - Stage firewall changes safely. If UFW or a provider firewall currently allows SSH broadly, insert the trusted-source allow rule before removing the broad rule.
- Validate syntax. Run
sudo sshd -t. Fix every reported error before reloading or restarting the service. This catches malformed directives and invalid CIDR entries without replacing the running daemon. - Apply the configuration. Reload or restart SSH using the method supported by the distribution. Ubuntu’s documented group workflow uses
sudo systemctl restart ssh.service. - Test an allowed connection. From the trusted source, open a new SSH session instead of relying on the old session. Confirm the intended account and authentication method work.
- Test a denied source. From a deliberately untrusted network, verify that the connection is blocked or rejected as expected. Keep the original session until both tests succeed.
- Record the policy. Note the allowed users, IPv4 and IPv6 ranges, SSH port, firewall layers, and the recovery method so a future address change does not cause an avoidable lockout.
How the rules interact
AllowUsers and DenyUsers
DenyUsers is evaluated before AllowUsers. If a username and source match a deny rule, adding the same combination to an allow rule will not restore access. Review both directives when an apparently valid allowlist is ignored.
AllowUsers and AllowGroups
These controls are cumulative account restrictions. A user must satisfy the configured account rules as well as the source-address rule. A trusted IP does not bypass group membership, and membership does not bypass an address restriction.
OpenSSH and a host firewall
A firewall rejection occurs before authentication, so no SSH login is attempted. An OpenSSH rejection reaches the daemon and can appear in SSH logs. Running both gives defense in depth but requires synchronized changes when an address, port, or user changes.
IPv4, IPv6, NAT, and changing addresses
IPv4 and IPv6 are separate policies
An IPv4 allowlist does not automatically constrain IPv6. If the VPS has an IPv6 address and SSH listens on it, define the IPv6 source range in OpenSSH, UFW, the provider firewall, or each applicable layer. Audit both families during testing.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →NAT and VPN exits
The server sees the public egress address of a NAT gateway or VPN exit, not necessarily the workstation’s local address. Whitelist that observed egress address only when the gateway or VPN is under your control. If the exit changes, a fixed /32 rule will no longer match.
Dynamic residential addresses
A changing ISP address makes a permanent single-IP rule fragile. A stable VPN exit, bastion, or managed provider rule can reduce maintenance. Expanding the CIDR range may restore convenience, but it also authorizes more addresses and should be treated as a deliberate security trade-off.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting unexpected access or lockout
The rule has no effect
- Check whether another file under
/etc/ssh/sshd_config.d/changes the effective configuration. - Run
sudo sshd -tand correct syntax errors before restarting. - Confirm that the connecting username exactly matches the rule.
AllowUsersuses account names, not numeric IDs. - Check whether the connection is arriving over IPv6 while only an IPv4 rule was added.
- Review
DenyUsersand anyAllowGroupsrestriction that may take precedence over the intended account policy.
The administrator is locked out
- Use the still-open SSH session, VPS console, bastion, or out-of-band recovery path; do not close the last working session.
- Compare the allowlisted address with the public address actually presented by the client. VPN and NAT paths commonly change it.
- Check for a CIDR typo. OpenSSH requires a valid mask length consistent with the address.
- Inspect UFW and provider rules for a missing source-specific exception or a port mismatch.
- Restore the last known-good rule, validate with
sudo sshd -t, and retest from a second session before tightening the policy again.
Host-name based matching behaves unexpectedly
With UseDNS no, OpenSSH uses addresses rather than host names for the from patterns in authorized_keys and for Match Host rules. Explicit IP addresses or CIDR ranges provide more predictable control for an IP allowlist.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Operational checklist
- The policy names the intended account or group.
- Every allowed IPv4 and IPv6 source is written with a correct address and mask length.
- The SSH port in each firewall rule matches the daemon’s listening port.
- OpenSSH syntax passes
sudo sshd -t. - At least one existing session and one recovery path remain available.
- A new connection from an allowed source succeeds.
- A connection from an untrusted source is blocked or rejected.
- Dynamic-address, VPN, NAT, and IPv6 assumptions are documented for the next administrator.
Frequently Asked Questions
How do I allow SSH only from my current public IP?
Add an account-and-address rule such as AllowUsers [email protected], validate it with sudo sshd -t, then test a new connection. Confirm that the address is the public address seen by the VPS, not a private NAT or VPN address.
Recommended Free Tools
How do I whitelist an entire office or VPN subnet?
Use a valid CIDR range, for example AllowUsers [email protected]/24. In UFW, use the same source range in a rule such as sudo ufw allow proto tcp from 203.0.113.0/24 to any port 22. Choose the smallest range that covers approved clients.
Should I use sshd_config, UFW, or my VPS provider firewall?
They enforce different layers. OpenSSH controls accounts and source matching, UFW blocks packets on the VPS, and a provider firewall blocks traffic before it reaches the VPS. Combining them gives defense in depth, but all layers must be updated together.
Does an IPv4 allowlist protect SSH over IPv6?
No. IPv4 and IPv6 are separate policies. If SSH accepts IPv6, add and test an IPv6 CIDR rule in every applicable layer, or otherwise ensure that the IPv6 listener is not reachable from untrusted sources.
Why did my fixed IP rule stop working?
Your ISP, mobile connection, VPN exit, or NAT gateway may have changed its public address. Check the source address presented to the VPS. A stable VPN exit or bastion can avoid constant changes; widening the CIDR range increases the number of trusted addresses.
Can AllowUsers use a numeric user ID?
No. The directive matches account names and source hosts. Use the login username, and review any AllowGroups or DenyUsers rules that also affect the account.
How can I avoid locking myself out while changing the firewall?
Keep the current SSH session open and confirm a VPS console or other recovery path. Add the source-specific allow rule before removing a broad SSH rule, validate with sudo sshd -t, and prove both an allowed and denied connection from separate sessions.
Does a provider firewall always cost extra?
Pricing and feature limits are provider-specific. Check the current provider plan, region, IPv6 behavior, rule limits, logging, and charges. No single price or syntax applies to every VPS service.
The Bottom Line
Use AllowUsers user@address-or-cidr for a direct OpenSSH allowlist, add Match Address when settings must vary by source, and use UFW or a provider firewall to stop unwanted packets earlier. Cover both IPv4 and IPv6, account for NAT and changing addresses, run sudo sshd -t, and keep a tested recovery path before tightening access.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
