Anti Lockout with VLANs

[guardian]

I jumped into the deep end with trying to segment my network. There is nothing left on the LAN anymore and everything is on different VLANs.

What is the best approach for dealing with the antilockout since the default no longer works.

For illustration assume:

LAN - 10.0.0.1/24
VLAN20 - The VLAN that needs access 10.0.20.1/24

On what addresses do the WebGUI and SSH server listen to?

Best practices for making sure only the desired VLAN can access these services?

Thanks in advance for any assistance.