Purpose

Increased security, ensuring that Tomcat/Jira can only be reached by the appropriate addresses

Solution

Tomcat provides multiple methods to allow control access, here are two of the possible options:

1. Restricting which IP addresses that a defined connector port will listen on. http://tomcat.apache.org/tomcat-8.5-doc/config/http.html#Standard_Implementation
   1. Example: only allowing the host's loopback address (127.0.0.1) to connect to port 8080:

   2. Modify the Connector within server.xml:

      <Connector port="8080" protocol="HTTP/1.1" ... />
      
      to
      
      <Connector address="127.0.0.1" port="8080" protocol="HTTP/1.1" ... />

   3. Restart Tomcat
2. Setting remote IP filters for addresses that will be allowed or denied: http://tomcat.apache.org/tomcat-8.5-doc/config/valve.html#Remote_Address_Valve
   1. Example: only allowing requests from the local address and from address with IP 192.168.1.1:

   2. Modify server.xml and add:

      <Engine name="Catalina" defaultHost="localhost">
          ...
          <Valve className="org.apache.catalina.valves.RemoteAddrValve"
              allow="127\.0\.0\.1|192\.168\.1\.1"/>
          ...
      </Engine>

      
      

   3. Restart Tomcat