Restrict some users login to internal network

[Johnny Mumble]

Is it possible to restrict a user account to only be able to log on if they are on the internal network. For example, I would like the admin account to only be able to log on if they are behind my firewall but not from over the internet. Thanks for your help.