I want to be able to log in to a (publicly-accessible) SSH server from the local network (192.168.1.*) using some SSH key, but I don't want that key to be usable from outside the local network.I want some other key to be used for external access instead (same user in both cases).Is such a thing possible to achieve in SSH?
How to make restrict an SSH key to certain IP addresses?
ssh
Yes.In the file ~/.ssh/authorized_keys on the server, each entry now probably looks likessh-ed25519 AAAAC3NzaC1lZSOMEKEYFINGERPRINT comment(or similar)There is an optional first column that may contain options.  These are described in the sshd manual.One of the options isfrom=pattern-listSpecifies that in addition to public key authentication, either               the canonical name of the remote host or its IP address must be               present in the comma-separated list of patterns.  See PATTERNS in               ssh_config(5) for more information on patterns.In addition to the wildcard matching that may be applied to               hostnames or addresses, a from stanza may match IP addresses               using CIDR address/masklen notation.The purpose of this option is to optionally increase security:               public key authentication by itself does not trust the network or               name servers or anything (but the key); however, if somebody               somehow steals the key, the key permits an intruder to log in               from anywhere in the world.  This additional option makes using a               stolen key more difficult (name servers and/or routers would have               to be compromised in addition to just the key).This means that you should be able to modify ~/.ssh/authorized_keys fromssh-ed25519 AAAAC3NzaC1lZSOMEKEYFINGERPRINT commenttofrom=pattern ssh-ed25519 AAAAC3NzaC1lZSOMEKEYFINGERPRINT commentWhere pattern is a pattern matching the client host that you're connecting from.