from="192.0.2.*",command="/root/limit-rsnap" ssh-rsa AAAAB3N...

#!/bin/bash

shopt -s extglob

test -n "$SSH_ORIGINAL_COMMAND" || exit 1

case "$SSH_ORIGINAL_COMMAND" in
  'rsync --server --sender -'+([vnlHogDtprRxe.isfLS])' --numeric-ids . '*)
    RSYNCPATH="${SSH_ORIGINAL_COMMAND#rsync --server --sender -+([vnlHogDtprRxe.isfLS]) --numeric-ids . }"
    test -e "$RSYNCPATH" && exec $SSH_ORIGINAL_COMMAND || exit 1
    ;;
  *)
    exit 1
  ;;
esac