Modify the base sshd systemd stanza:

sudo systemctl edit sshd

Append the sshd [Service] stanza to your liking:


[Service]
#requires systemd 235+ and kernel 4.11+
IPAccounting=yes
IPAddressDeny=any
IPAddressAllow=192.18.1.22
IPAddressAllow=10.161.0.0/16
IPAddressAllow=100.64.0.0/24


reload for immediate effect:
sudo systemctl daemon-reload