I’m running Tomcat 10.1.26 on Ubuntu 20.04, and I’m attempting to restrict access to a specific webapp by IP address. I have looked at these articles, followed their instructions, and cannot get it to work:

How to restrict access by IP address with Tomcat?

Restrict tomcat access by ip

https://tomcat.apache.org/tomcat-10.0-doc/config/filter.html#Remote_Address_Filter

In /opt/tomcat/conf/server.xml, I have this entry:

    <Host name="localhost"  appBase="webapps"
           unpackWARs="true" autoDeploy="true">

           <Valve className="org.apache.catalina.valves.RemoteAddrValve"
                  allow="192.168.d+.d+"
                  deny=".*" />

           <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                  prefix="localhost_access_log" suffix=".txt"
                  pattern="%h %l %u %t "%r" %s %b" />

    </Host>

This should allow access only to 192.168.x.x IP addresses and deny access to all others, yet access from any IP address is restricted. I have tried the following:

1. Using this RemoteAddrValve:

           <Valve className="org.apache.catalina.valves.RemoteAddrValve"
                  allow="192.168.d+.d+" />
   

In this case, the webapp is accessible from any IP address. The “allow” entry appears to be ignored.

2. Using this RemoteAddrValve:

           <Valve className="org.apache.catalina.valves.RemoteAddrValve"
                  deny=".*" />
   

In this case, the webapp cannot be accessed from any IP address, which tells me the valve is working.

3. Added the valve to the /opt/tomcat/conf/content.xml instead of the server.xml as some comments in the above articles suggested to do. This failed.

4. Added the valve to //META-INF/content.xml as some comments suggested to do. This caused the webapp to fail to load.

I’m out of ideas and hoping someone here can identify the issue. Thanks in advance for any assistance.