How to allow ssh access only through vpn?

Question

linux

How to allow access to SSH server for only one vpn connection. The VPN server is lifted by the same machine.
Tried through:

/etc/hosts.allow
SSHD: ip.адрес.сервера
/etc/hosts.deny
SSHD: ALL

connected to vpn tried to log in, but the server kicked me off.
Also tried with iptables

iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED --source ip.адрес.сервера -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 22 -j DROP

But the result is the same.

Answer 1

Why --source ip.server.address? The IP address of the client must be the one that is issued by the VPN.
Or the IP address of the server on the VPN interface, but then the destination address of the packet.

Answer 2

1) In hosts.allow, you need to write not the IP address of this server, but the IP address of the computer from which you will connect.
2) In iptables in --source is the same.
3) Well, it's more correct to write "-m tcp - p tcp --dport" instead of "-p tcp --dport".
4) You were rightly pointed out that the second rule essentially cancels the first.