It doesn't look like there's an option inside the configuration file. This is one way to do it, which will also allow you to filter by username (using PAM):
Create a file called
/etc/security/proftpd.conf containing the following lines:
+ : ALL : 127.0.0.1
+ : ALL : localhost
- : ALL : ALL
The + means allow, the second column is the username, and the third column is the hostname of the incoming connecion. So, for example,
+ : john : 127.0.0.2 will allow
john to connect from
A - denies them.
/etc/pam.d/proftpd to add the following somewhere near the top (I make it the first line after session) to make it read the new file:
auth required pam_access.so accessfile=/etc/security/proftpd.conf
It should take effect immediately without the need for a service restart.