# Restricting View Permissions by Workstation IP / Security Zones

**URL:** <https://forum.inductiveautomation.com/t/restricting-view-permissions-by-workstation-ip-security-zones/115603>\
**Category:** Ignition\
**Tags:** perspective\
**Created:** [May 19, 2026, 3:33pm UTC](https://forum.inductiveautomation.com/t/restricting-view-permissions-by-workstation-ip-security-zones/115603 "2026-05-19T15:33:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![TechEnlive](https://avatars.discourse-cdn.com/v4/letter/t/3be4f8/32.png) [@TechEnlive](https://forum.inductiveautomation.com/u/TechEnlive)\
**Post date:** [May 19, 2026, 3:33pm UTC](https://forum.inductiveautomation.com/t/restricting-view-permissions-by-workstation-ip-security-zones/115603/1 "2026-05-19T15:33:44Z")

</div>

Hi everyone, I need some help with an Ignition Perspective architecture question.

We have users with multiple roles logging into different physical workstations. We want to restrict view permissions based on the **workstation's IP address** so they only see localized controls.

We tried using Gateway Security Zones mapped to our IP ranges, but the sessions aren't picking up the zones correctly (the `SecurityZones` session property remains empty). If anyone has configured this successfully or knows the exact expression workaround to enforce strict Role + Zone security, please let me know!

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/a/7a1527441e00e51d421b265832b5fa39789949ab.png)

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/6/5696a75319025c1c123a05be28c818643ae8d47c.png)

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/d/f/df4c11bde898e457c8cf02bd3dea82718f252381.png)

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [May 19, 2026, 3:38pm UTC](https://forum.inductiveautomation.com/t/restricting-view-permissions-by-workstation-ip-security-zones/115603/2 "2026-05-19T15:38:48Z")

</div>

Are your clients reaching your gateway through a NAT? If so, the gateway can only see the IP of the NAT router, not the real client IP, for security zone determinations.

---

<div class="post-metadata">

**Author:** ![TechEnlive](https://avatars.discourse-cdn.com/v4/letter/t/3be4f8/32.png) [@TechEnlive](https://forum.inductiveautomation.com/u/TechEnlive)\
**Post date:** [May 19, 2026, 4:32pm UTC](https://forum.inductiveautomation.com/t/restricting-view-permissions-by-workstation-ip-security-zones/115603/3 "2026-05-19T16:32:23Z")

</div>

Hi,  
No, we are using a direct connection. Both client and gateway are connected to the same switch.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [May 19, 2026, 4:39pm UTC](https://forum.inductiveautomation.com/t/restricting-view-permissions-by-workstation-ip-security-zones/115603/4 "2026-05-19T16:39:11Z")

</div>

Consider putting one or more labels on a shared docked view to display all of the security-relevant session properties. For you to inspect in actual client sessions (designer substitutes auth--not the same).