diff --git a/samba/CHANGELOG.md b/samba/CHANGELOG.md
index 02b94fd..daeb7fc 100644
--- a/samba/CHANGELOG.md
+++ b/samba/CHANGELOG.md
@@ -1,4 +1,7 @@
 # Changelog
 
+## 4.0
+- New option `allow_hosts` to limit access
+
 ## 3.0
 - Update base image
diff --git a/samba/config.json b/samba/config.json
index ed4fdbf..f1613e1 100644
--- a/samba/config.json
+++ b/samba/config.json
@@ -1,6 +1,6 @@
 {
   "name": "Samba share",
-  "version": "3.0",
+  "version": "4.0",
   "slug": "samba",
   "description": "Expose Hass.io folders with SMB/CIFS",
   "url": "https://home-assistant.io/addons/samba/",
@@ -21,7 +21,12 @@
     },
     "username": "",
     "password": "",
-    "interface": ""
+    "interface": "",
+    "allow_hosts": [
+        "10.0.0.0/8",
+        "172.16.0.0/12",
+        "192.168.0.0/16"
+    ]
   },
   "schema": {
     "workgroup": "str",
@@ -36,7 +41,8 @@
     },
     "username": "str",
     "password": "str",
-    "interface": "str"
+    "interface": "str",
+    "allow_hosts": ["str"]
   },
   "image": "homeassistant/{arch}-addon-samba"
 }
diff --git a/samba/run.sh b/samba/run.sh
index 21920b8..3df7ceb 100644
--- a/samba/run.sh
+++ b/samba/run.sh
@@ -14,6 +14,7 @@ MAP_SSL=$(jq --raw-output '.map.ssl' $CONFIG_PATH)
 MAP_SHARE=$(jq --raw-output '.map.share' $CONFIG_PATH)
 MAP_BACKUP=$(jq --raw-output '.map.backup' $CONFIG_PATH)
 INTERFACE=$(jq --raw-output '.interface // empty' $CONFIG_PATH)
+ALLOW_HOSTS=$(jq --raw-output '.allow_hosts | join(" ")' $CONFIG_PATH)
 
 function write_config() {
     echo "
@@ -35,6 +36,7 @@ function write_config() {
 sed -i "s/%%WORKGROUP%%/$WORKGROUP/g" /etc/smb.conf
 sed -i "s/%%NAME%%/$NAME/g" /etc/smb.conf
 sed -i "s/%%INTERFACE%%/$INTERFACE/g" /etc/smb.conf
+sed -i "s/%%ALLOW_HOSTS%%/$ALLOW_HOSTS/g" /etc/smb.conf
 
 ##
 # Write shares to config
diff --git a/samba/smb.conf b/samba/smb.conf
index b2e052b..57ae352 100644
--- a/samba/smb.conf
+++ b/samba/smb.conf
@@ -8,9 +8,10 @@
    disable spoolss = yes
 
    log level = 2
-   
+
    bind interfaces only = yes
    interfaces = %%INTERFACE%%
+   hosts allow = %%ALLOW_HOSTS%%
 
    #guest account = root
    #map to guest = Bad Password