TCP wrappers are an access control system that allows control over which network addresses or address ranges can access particular network services on a computer host. This is controlled by the /etc/hosts.allow and /etc/hosts.deny files. This allows certain services to be only accessible from your local domain, for instance. A common use of this would be to limit exported NFS filesystems to only be accessible from your local domain, while allowing security logins through ssh to come in from anywhere. This would be done with a /etc/hosts.deny file that looks like this:
ALL: ALL
and a /etc/hosts.allow file that looks like this:
# allow NFS service to domain.net only portmap: .domain.net rpc.mountd: .domain.net # allow ssh logins from anywhere sshd: ALL