Limiting External Connections to IPSEC VPN

[TomT]

Hi.

I've got a IPSEC VPN configured and is working fine.
I'd now like to restrict access to it from a specific range of addresses.

My son is at UNI and he needs to connect from anything within a range.
eg: 109.100.100.x /16 (so he's telling me !!)

Currently my IPSEC rules has one rule of ANY for everything.
Do I need to add this rule to the IPSEC Rules or the WAN rules ?
What do I need to add ?

Thanks