Hi,

It is complicated to explain, so I’ll skip parts, but basically as far as I’m aware, not possible the way you would expect.

I would categorize it as a workaround-grade, but you can prevent a session to be made from a non-local address if it has the None mode. You can do that by attaching a SessionManagerListener to the SessionManager of the UaServer and throw (using StatusCodes.Bad_SecurityModeInsufficient for the StatusException) onCreateSession if the Session is tried to be made using None from a non-localhost remote via the given session parameter:

session.getChannel().getConnection().getRemoteAddress()

And check the messagesecuritymode from the channel + Session, but do note that a Session and transport layer security mode may differ (e.g. on opc.https the session is made with None or Sign, with the TLS layer providing the encryption and on Sign the app auth per ApplicationInstanceCertificates is done; on opc.tcp app auth and security for the transport layer is the same, there it would match).

However, it might not be obivious to the client why it is failing.

P.S.
Generally the issue is that there has been a long-open issue originally in the Stack that would enable network-interface-bound GetEndpoints results. That would be the correct way to do this in my opinion. SDK 4.x doesn’t have a “stack” anymore per se (see https://downloads.prosysopc.com/opcua/Prosys_OPC_UA_SDK_for_Java_4_Release_Notes.html#version-4-0-0), but the underlying logic is the same. We can implement this probably in a future version, depending how much it is asked (since we in general try to priorize those).