How to restrict access by IP address with Tomcat?

You add a Valve to the Context in context.xml (specifically, org.apache.catalina.valves.RemoteAddrValve). See the docs on Remote Host Filters.