SSH Tectia Server can be configured to reject connection attempts from unknown hosts. For example the following allows connections only from the internal network 10.1.0.0/8 IP addresses and from an external host with the IP address 195.20.116.1:

<connections>
  <connection action="allow">
    <selector>
      <ip address="10.1.0.0/8" />
      <ip address="195.20.116.1" />
    </selector>
  </connection>
  <connection action="deny" />
</connections>

Using the SSH Tectia Server Configuration GUI on Windows, the same settings can be made under the Connections and Encryption page, on the Selectors tab. See Editing Connection Rules.

For information on the selectors, see Using Selectors in Configuration File.

On systems with several network interfaces, SSH Tectia Server can also be bound to a specific network interface so that the server can be only accessed from the intended network. For example, the following will bind the listener to address 10.1.60.25 using the Secure Shell default port 22:

<params>
  <listener id="intranet" address="10.1.60.25" />
  ...
</params>

Using the SSH Tectia Server Configuration GUI on Windows, this can be set on the Network page. See Network.