Whitelisting IP ranges via machine executor

Hi all, new to using Circle CI here. I’m using a machine executor to deploy my app via SSH, only to find out that IP ranges feature does not apply to this executor. I resorted to using a bastion host, slapping an elastic IP on it, but I’ve set it’s inbound rule to 0.0.0.0/0. Then my app would whitelist this EIP for a SSH proxy jump to occur. I just want to know if there are better methods or ways to go about this, if i want to proceed using a machine executor.