Define service access by network
You can configure which IP address ranges can access the services you provide. Sometimes this method of access control is referred to as firewall service.
You can create different IP address ranges for specific services or for all services. By default, all users can connect to all enabled services from all network address ranges.
In addition to the IP address ranges you create, you can use the following special designations:
Private networks: This automatically includes all non-routable IP address ranges (like 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16).
Only this Mac: This includes all IP addresses on all interfaces that the Mac uses, whether public or private.
Before starting this task, you should define your own custom IP address groups for easy use here. See Create custom network access definitions.
Define the default access
Select your server in the Server app sidebar, then click Access.
Click the “When connecting from” pop-up menu, then choose “only some networks.”
If you select a special network designation, skip to Step 5.
In the sheet, click Add 
, then select an IP address group.
If the IP address group you want isn’t listed as a choice, you need to create it first by choosing “Create a new network.” Then see Create an IP address group while customizing service access in Create custom network access definitions.
To add more address groups, repeat Step 3 as needed.
When you’ve added all the desired IP address groups, click OK.
Define custom access
Select your server in the Server app sidebar, then click Access.
Click Add below the Custom Access list, then select the desired service.
Some services have more configurable settings in this sheet than just the network access pop-up menu.
Click the “When connecting from” pop-up menu, then choose “only some networks.”
In the sheet, click Add , then select an IP address group.
If the IP address group you want isn’t listed as a choice, you need to create it first by choosing “Create a new network.” Then see Create an IP address group while customizing service access in Create custom network access definitions.
To add more address groups, repeat Step 4 as needed.
When you’ve added all the desired IP address groups, click OK.