public static boolean passesAllowList(@Nonnull final ServletRequest req) {
        // In a proxied setup, org.jivesoftware.openfire.container.AdminConsolePlugin.ADMIN_CONSOLE_FORWARDED should be
        // set to 'true' to have the below report the true 'peer' address.
        final String remoteAddr = removeBracketsFromIpv6Address(req.getRemoteAddr());
        final Set<String> allowList = IP_ACCESS_ALLOWLIST.getValue();
        final boolean result = allowList.isEmpty() || IpUtils.isAddressInAnyOf(remoteAddr, allowList);
        Log.debug("IP address '{}' {} pass the allow list.", remoteAddr, result ? "does" : "does not");
        return result;
    }
Verifies that the remote address of the request is either on the allowlist, or the allowlist is empty.

If this method returns 'false', the request should not be allowed to be serviced.

@param req The request for which the check the remote address.
@return true if the remote address of the request is on the allowlist, or when the allowlist is empty.
xmppserver/src/main/java/org/jivesoftware/admin/AuthCheckFilter.java