How to block the login for the Management Console of WSO2 IoT Server

Put the following config to <IoTS_HOME>/core/repository/conf/tomcat/carbon/WEB-INF/web.xml.

<security-constraint>
    <display-name>Restrict direct access to certain folders</display-name>
    <web-resource-collection>
        <web-resource-name>Restricted folders</web-resource-name>
        <url-pattern>/carbon/*</url-pattern>
    </web-resource-collection>
    <auth-constraint />
</security-constraint>

Then restart the server.