iRULE to drop in-bound ssh connections

I am looking for an iRULE to drop in-bound ssh connections if they are not from an accepted network.     Here is my first attempt:     class allowed_client_IP {   "x.x.x.x"    ...