Skip to main content
An office network rule checks the internet address a person’s connection comes from. If it matches a range you listed, they count as being at work. This is the reliable check on a computer.

​
What an office network rule is

Your office has a public internet address, or a range of them, given to you by your internet provider. Everyone connecting through that office shares it. You list those ranges. Anyone connecting from one of them passes. Anyone else does not.
A range is the whole network, not one person. Everyone on that Wi-Fi matches, including guests, contractors and anyone in the coffee shop downstairs sharing the same building connection.

​
When to use it

  • A fixed office where people work from desks.
  • Anywhere people use laptops rather than phones – a laptop’s reported place is often kilometres out, but its network address is exact.
  • A stricter control than a geofence, because faking a network address is much harder than faking a GPS position.

​
Where the settings are

Open a rule and find the Office networks card: “Anyone connecting from one of these counts as being at work.” It has two parts – the address you are connecting from right now, and the list of ranges.

​
Your current address

The card at the top reads “You’re connecting from <address>” with the note:
If that looks like your office, add it. Remember this is the address of the whole network – anyone on the same Wi-Fi will match it too.
Click Add this address to add exactly that one address as a range.
The fastest way to set this up correctly is to sit in the office you want to allow, open the rule, and click Add this address.

​
Two things this card may say instead

Both mean network rules are not usable yet and need a hosting change. Places still work – only network rules are affected.

​
Adding a range

Click Add address range. Each row has: Up to 50 ranges per rule.

​
Single address or range

Type an address with no / and it becomes an exact single-address rule.

​
The live hint

Under each range you see how many addresses it covers – 1 address, 256 addresses, 16,777,216 addresses.
Read that number. If it says millions, you have written a range far wider than your office and you are allowing most of the internet.
Two other hints appear:

​
IPv4 and IPv6

Both work. A few details worth knowing: If your office has both IPv4 and IPv6, add both. A person on IPv6 will not match your IPv4 range.

​
Saving

The sticky bar at the bottom of the page saves the whole rule at once. Save errors name the exact problem:

​
Example

Northwind Studio’s office is on 203.0.113.0/24.
1

Maya sits in the studio

She opens the Studio rule.
2

She reads her own address

The card says You’re connecting from 203.0.113.42.
3

She asks IT for the range

IT confirms the whole office is 203.0.113.0/24.
4

She adds it

Name Studio, range 203.0.113.0/24. The hint reads 256 addresses.
5

She adds the IPv6 range too

Their provider also gives an IPv6 /64. Without it, anyone on IPv6 would be stopped.
6

She saves and watches

A week in Watching confirms nobody in the studio is caught.
Ana Ferreira working from home connects from a different address, so she does not match. That is the point of the rule.

​
What an IP check cannot detect

Be honest with your team about all of these.
There is no VPN detection anywhere in TimeTracker. If you need to stop VPN use, that belongs on your network, not in this product.

​
The gap after someone leaves

A check stays good for the interval you set – 5, 15, 30 or 60 minutes – plus a short allowance for patchy Wi-Fi. Somebody who passes a check and then walks out can keep working until it expires. Shorten the interval if that matters. It costs more checks and slightly more interruption.

​
Combining with places

In The rule card, Someone counts as here when they are: Either is the usual choice when some people are on laptops in the office and others are on phones at client sites.

​
Permissions

​
Common questions

Your office’s public address range, from whoever runs your network. Not 192.168.x.x or 10.x.x.x – those are internal and identical in every office in the world.
Ask your provider for a static address, or use a range wide enough to cover what they hand you. A rule built on an address that changes will stop people at random.
Yes, if the VPN puts them on your office network. TimeTracker cannot detect a VPN. Network rules make casual working-from-anywhere obvious, not impossible.
Anything narrower than /64 pins one device. Modern phones change that part of their address regularly, so a narrow rule stops working within hours.
Up to 50 per rule. That is enough for a lot of offices.
If the guest network shares your public address, yes. Ask IT whether guest traffic leaves on a different address.

​
Troubleshooting

Everyone is stopped. Your rule requires a network but has no ranges, or the ranges are wrong. Sit in the office and compare the You’re connecting from card against what you typed. Some people are stopped and others are not, in the same office. Almost always IPv6. Some machines use it, some do not. Add both families. The card says it cannot read your address. Network rules need your hosting to pass the real address through. Places still work in the meantime. The card shows an internal address. Same cause. Every person looks identical to a rule built on it, so do not build one until this is fixed.

Location rules overview

The concept and what it cannot see.

Create a location rule

The full end-to-end walkthrough.

GPS restrictions

The other kind of check.

Activity log

See which address each check reported.

Location permissions

Who can manage rules.

Time Clock

The most common thing a rule limits.