diff --git a/unix/x0vncserver/x0vncserver.cxx b/unix/x0vncserver/x0vncserver.cxx
index eac9edf..c406e3c 100644
--- a/unix/x0vncserver/x0vncserver.cxx
+++ b/unix/x0vncserver/x0vncserver.cxx
@@ -60,6 +60,9 @@
 StringParameter rfbunixpath("rfbunixpath", "Unix socket to listen for RFB protocol", "");
 IntParameter rfbunixmode("rfbunixmode", "Unix socket access mode", 0600);
 StringParameter hostsFile("HostsFile", "File with IP access control rules", "");
+BoolParameter localhostOnly("localhost",
+                            "Only allow connections from localhost",
+                            false);
 
 //
 // Allow the main loop terminate itself gracefully on receiving a signal.
@@ -259,7 +262,10 @@
       listeners.push_back(new network::UnixListener(rfbunixpath, rfbunixmode));
       vlog.info("Listening on %s (mode %04o)", (const char*)rfbunixpath, (int)rfbunixmode);
     } else {
-      createTcpListeners(&listeners, 0, (int)rfbport);
+      if (localhostOnly)
+        createLocalTcpListeners(&listeners, (int)rfbport);
+      else
+        createTcpListeners(&listeners, 0, (int)rfbport);
       vlog.info("Listening on port %d", (int)rfbport);
     }
 
diff --git a/unix/x0vncserver/x0vncserver.man b/unix/x0vncserver/x0vncserver.man
index 5aaf694..2e6edc4 100644
--- a/unix/x0vncserver/x0vncserver.man
+++ b/unix/x0vncserver/x0vncserver.man
@@ -162,6 +162,11 @@
 connection.  Default is \fB10\fP.
 .
 .TP
+.B \-localhost
+Only allow connections from the same machine. Useful if you use SSH and want to
+stop non-SSH connections from any other hosts.
+.
+.TP
 .B \-AlwaysShared
 Always treat incoming connections as shared, regardless of the client-specified
 setting. Default is off.