it has to be firewall...if it's in the allowedips on the client and the host can reach that range, the only other piece is the iptables command