Tomcat – How to create a IP whitelist for tomcat

iptomcatwhitelist

I'm extremely new to tomcat but I need to configure my company's tomcat server so that we can allow restricted IP addresses only.

I understand this is normally the job of the firewall but in this case that is not an option.

We are doing a deployment to the production server and while that's happening we need to be able to show a maintenance page run by Apache which rests in the same server as tomcat.

In this case, what would I need to do in order to only allow access to selected ip addresses to the whole tomcat server?

Best Answer

Take a look at Tomcat's Remote Address Filter:

The Remote Address Filter allows you to compare the IP address of the client that submitted this request against one or more regular expressions, and either allow the request to continue or refuse to process the request from this client.

Edit: Which file to edit depends on whether you want the filter to apply to a single webapp or to all of them. From the same page linked above:

Tomcat provides a number of Filters which may be configured for use with all web applications using $CATALINA_BASE/conf/web.xml or may be configured for individual web applications by configuring them in the application's WEB-INF/web.xml.

Edit 2: Here's an example for 3 IPv4 addresses:

<filter>
  <filter-name>Remote Address Filter</filter-name>
  <filter-class>org.apache.catalina.filters.RemoteAddrFilter</filter-class>
  <init-param>
    <param-name>allow</param-name>
    <param-value>x\.x\.x\.x|y\.y\.y\.y|z\.z\.z\.z</param-value>
  </init-param>
</filter>
Related Topic