URGENT SSH / TCP Wrappers active by default on proxmox

Some of my nodes are under attack via ssh. I am trying to block access.

I am trying to only allow SSH to certain IP's on my proxmox nodes v3.3-1.

hosts.allow looks like where X.X.X.X is my IP and Y.Y.Y.Y is the cluster network

sshd: X.X.X.X Y.Y.Y.Y/255.255.255.0

hosts.deny

sshd: ALL

For some reason this is not working. Is TCP Wrappers turned on by default or am I missing something?

Also, if I want to change SSH ports do I just set change Port XXX in /etc/ssh/ssh_config and sshd_config?

Thanks,
Eric