There is a comment in web.xml for solr in modules/tags/dspace-solr-184.108.40.206 (which is currently pulled into 1.6.2) for turning off the LocalHostRestrictionFilter. The comment has cut and paste code for turning off the filter by placing it in a Tomcat context file. However, the wrong parameter name is given. Instead of LocalHostRestrictionFilter.enabled, it should be LocalHostRestrictionFilter.localhost as is required for the filter code.
We had to disable this filter in order to get SOLR working for a rather complex setup where localhost would not work in the solr.log.server configuration value. To restrict access we implemented RemoteAddrValve in the same context file that the altered code resides.
The patch attached is to go against modules/tags/dspace-solr-220.127.116.11