There are two ways.
1. Run a SecurityManager in the server and only grant SocketPermission 'accept' to 'localhost'.
2. Code your remote objects' remote method implementations to check java.rmi.server.RemoteServer.getClientHost() and abort the method with a SecurityException (for example) or a java.rmi.AccessException if the client isn''t calling from localhost.