Are you trying to restrict unauthenticated access from your local network to node-red and the dashboard?
Check out the documentation: Securing Node-RED : Node-RED
If you are planning to expose node-red to the internet, I created a small little service that might help you get what you want: Noralink - secure access to node-red via the internet