Blocking Remote Logins

This seems simple, but maybe I’m making it hard. I have a web server with public access, but I don’t want remote users trying to login. Is there a way to block this without blocking web services, ftp access, etc.? I have trouble with hackers that continuously lockout all my users. They apparently have gotten my SAM and is trying to hack the passwords. I keep having to unlock accounts, but he just comes back and locks them out again. I can see his domain name (Felix) in the security logs, but there is no other info like IP or MAC address. Is there a cheap monitor program that will give me that info? If I deny access to PCs off my LAN, will that block access to my web and ftp services? He even tries the system built-in accounts. It’s getting very annoying. How do I block logins from remote sites except for ftp?