Allow SSH connections only from certain addresses using hosts.deny/hosts.allow

This is the method that can be used to allow SSH connections from certain IP networks. An example use for this is allowing SSH from certain public IP networks, as well as from my Tailscale network. If possible, it is probably better to use iptables/nftables/ufw or the firewall feature of your hosting provider if they provide such a feature.

First, edit /etc/hosts.allow and add address ranges in CIDR notation, single IP, or IP/Subnet format. Replace the following ranges with your desired IP ranges.

sshd: 1.1.1.0/8, 100.64.0.0/10, 127.0.0.0/8

Edit /etc/hosts.deny.

sshd: ALL

This can also be used to block other services and ports by replacing sshd.