Did anyone here here set up a good rsyslogd configuration where the receiving syslog collector limits incoming logs to only known ddns machines ?

I think I may be able to stitch something together with periodically reconfigured packet filters, but I'd appreciate an existing solution.

Bonus points if running on freebsd.