Securing ActiveMQ externally by IP filtering

Question

I have an instance of ActiveMQ running on an externally facing server and exposing a STOMP interface.

I would like to be able to ensure that externally connected clients can only receive topic notifications, and not send anything to the topic themselves. Any internally connected clients will be able to both receive and send.

I was hoping there might be some rules I could set up on the topic or server level that define permissions to the topic based on IP rules, but I cant find any reference to this.

Does anyone have any suggestions on how I can do this, or perhaps alternative ways to reach the desired effect?

Answer 1

There's not currently a distinction in the STOMP transport between IP ranges or internal v external IP addresses.

Could you use user roles though; having special users & roles for internal connections? Then use the normal access control lists so that external connections can only consume from topics and not publish?

See the ActiveMQ Security Support