Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am successfully able to access my webapp using the external IP for my server. However I would now like to restrict access to the server by IP.

I have added the following in conf/server.xml:

<Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="true">

        <!-- SingleSignOn valve, share authentication between web applications
             Documentation at: /docs/config/valve.html -->
        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />

        <!-- Access log processes all example.
             Documentation at: /docs/config/valve.html
             Note: The pattern used is equivalent to using pattern="common" -->
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="localhost_access_log." suffix=".txt" 

               pattern="%h %l %u %t &quot;%r&quot; %s %b" resolveHosts="true"/>

        <Valve className="org.apache.catalina.valves.RemoteAddrValve" 
        allow="127\\.0\\.0\\.1|192\\.*\\.*\\.*|0\\.*\\.*\\.*|<my external machine ip>" deny=""/>

However i still cant access the webapp from my . If i remove the RemoveAddrValue block then i can access the webapp from the external machine.

I am using apache-tomcat-7.0.47

How can i restrict external access via IP. Is this the correct approach?

share|improve this question

I would use a different approach. Either use a firewall (this is the best method unless you need the web server to be accessable but the appserver to be not), or use Apache's own controls Allow and Deny.

share|improve this answer
i did try the firewall approach but i need port 8080 to be open therefore this didnt work. Which controls are you referring to in Apache? – Santiago Nov 22 '13 at 11:03
In Apache config you can (in the Location section or in teh Directory section) put Allow and Deny directives: – Envite Nov 22 '13 at 14:13
I have tried this but the its still open to all – Santiago Nov 22 '13 at 15:38

Envite is right, the firewall approach is way simpler:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -s $SOME_IP1 --dport 8080 -j ACCEPT
iptables -A INPUT -s $SOME_IP2 --dport 8080 -j ACCEPT
iptables -A INPUT --dport 8080 -j DROP

It is highly likely that you didn't configure your firewall properly, or there is another rule before the ones you inserted that allows traffic to that port/host

share|improve this answer
Im using Mac OS X, i have ipfw show has allow ip from any to any. Ive not used ipfw before, do you know how to restrict just to an external IP address? – Santiago Nov 22 '13 at 15:39

Have you examined the tomcat logs? That should be the first place you look in for troubleshooting such issues. That file is typically called catalina.out. Reproduce the issue and update your question with the corresponding log entries.

However, a couple of things stand out:

Try replacing the double \\ with a single \. For e.g., this in the Engine, Host or Context containers will allow access from and (from Remote Address Filter):

 <Valve className="org.apache.catalina.valves.RemoteAddrValve"

You could also try dropping the deny="".

share|improve this answer
yes i have tried all variations. Changing the firewall rules has an affect. However i cannot figure out the correct correct command. I assumed the following would work but unfortunately not: sudo ipfw add reject src-ip any dst-ip me dst-port 22 – Santiago Nov 22 '13 at 15:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.