protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        String remoteIp = getHostFromRequest(request);
        for (IpAddressMatcher matcher : deniedIpMatchers) {
            if (matcher.matches(remoteIp)) {
                return false;
            }
        }
        for (String ip : ipSource.getDeniedIps()) {
            IpAddressMatcher matcher = new IpAddressMatcher(ip);
            if (matcher.matches(remoteIp)) {
                return false;
            }
        }
        for (IpAddressMatcher matcher : authorizedIpMatchers) {
            if (matcher.matches(remoteIp)) {
                return true;
            }
        }
        for (String ip : ipSource.getAuthorizedIps()) {
            IpAddressMatcher matcher = new IpAddressMatcher(ip);
            if (matcher.matches(remoteIp)) {
                return true;
            }
        }
        return false;
    }
Returns the remote host for a given HTTP request. By default uses the
remote method ServletRequest.getRemoteAddr(). May be overridden by
subclasses to obtain address information from specific headers (e.g. XFF
or Forwarded) in situations with reverse proxies.
web/src/main/java/org/apache/shiro/web/filter/authz/IpFilter.java