Question: I want to restrict access to certain URLs in my Tomcat webapp. 
Only 3 known IP addresses should be allowed access to URLs that fit a certain pattern.

e.g. `http://example.com:1234/abc/personId`

How can I achieve this?

Answer: 
Use org.apache.catalina.filters.RemoteAddrFilter and map it to the URL you wish to protect. See <http://tomcat.apache.org/tomcat-7.0-doc/config/filter.html#Remote_Address_Filter> for configuration details.
You can do that with this in server.xml:

```
 <Valve
    className="org.apache.catalina.valves.RemoteAddrValve"
        deny="117.40.83.*,122.224.95.*,119.255.28.*,218.8.245.*,218.85.139.*,219.117.197.*,124.89.39.*,58.18.172.*,180.153.225.*"
        />

```

(these are real IP addresses: owners, you know why :-|) but as you can see it is really a blocker not an enabler. A better solution would be to put Apache HTTPD in front of it with Deny All and Allow From statements, which will let you allow only the 3 IP addresses you need to access the service.