Configuring OS X Firewall to enable SSH/SCP only on the local subnet?
IceFloor is a frontend/GUI for the system firewall pf and should be able to be configured to do just what you want.
http://www.hanynet.com/icefloor/