Yii2 Gii Forbidden code 403 You are not allowed to access this page

I had a similar issue and tried all different ipFilter changes. In the end I needed to add this to main-local.php. Which was strange because I had an advanced application, and the settings were for a 'yii2 basic' setup.
http://www.yiiframework.com/doc-2.0/guide-start-gii.html

if (!YII_ENV_TEST) {// configuration adjustments for 'dev' environment$config['bootstrap'][] = 'debug';$config['modules']['debug'] = 'yii\debug\Module';$config['bootstrap'][] = 'gii';$config['modules']['gii'] = 'yii\gii\Module';}

I should also point out, I did add this to main.php

    'modules' => [    'gii' => [        'class' => 'yii\gii\Module',        'allowedIPs' => ['127.0.0.1', '::1', '192.168.1.*', 'XXX.XXX.XXX.XXX'] // adjust this to your needs    ],],

After init in dev mode I had to change my \backend\config\main-local.php and add the 'allowedIPs'.

Allows ALL IPs, so only recommended for internal dev use!Adjust to your needs.

$config['bootstrap'][] = 'gii';$config['modules']['gii'] = [    'class' => 'yii\gii\Module',    'allowedIPs' => ['*'],];

Change your /common/config/main-local.php as follows:

    return [    'components' => [        'db' => [            'class' => 'yii\db\Connection',            'dsn' => 'mysql:host=localhost;dbname=YourDatbase',            'username' => 'YourDBUserName',            'password' => 'YourDBPassword',            'charset' => 'utf8',        ],        'mailer' => [            'class' => 'yii\swiftmailer\Mailer',            'viewPath' => '@common/mail',            // send all mails to a file by default. You have to set            // 'useFileTransport' to false and configure a transport            // for the mailer to send real emails.            'useFileTransport' => true,        ],    ],    // Add this to get debug and gii to work    'modules' => [        'gii' => [            'class' => 'yii\gii\Module',             // permits any and all IPs             // you should probably restrict this            'allowedIPs' => ['*']        ],        'debug' => [            'class' => 'yii\debug\Module',             // permits any and all IPs             // you should probably restrict this            'allowedIPs' => ['*']        ]    ]];