Firewall Ports for Perspective and Vision

Hello,
our ignition is behind firewall.
We allowed our Gateway port: 8080, but Perspective application is not running.
It gets stuck on request: 101 Switching Protocol.

What ports we need to allow in our firewall?

I don’t think you need an additional port unblocked. It looks like the firewall may be blocking the websocket upgrade request.

Firewall is set to allow communication to Gateway:8080, i think, that our firewall does not care about HTTP request type. It checks just IP+Port (but I´m not completely sure).

My concern is, that websocket is trying to switch port of communication, I´m not sure.

WebSocket upgrades happen in place, on the existing connection. It’s just a protocol switch.

What do Ignition clients (vision and perspective) use for communiction with server, websockets or HTTP ? Just for clarification. I thought they use HTTP(S).

Vision uses HTTP(S), Perspective uses both HTTP(S) and WebSockets.

1 Like

Thanks a lot Kevin . Have a nice weekend .

Hello Guys,
i did some of testing and i found, that firewall is ok.
But Chrome settings is not much confortable with different port: 8080.

Based on docs it seems i may need to use SSL port or somehow setup proxy, but I´m not sure error is weird, because other devices with Chrome are running well (through same firewall).

Found in docs for websocket:

Warning: The server may listen on any port it chooses, but if it chooses any port other than 80 or 443, it may have problems with firewalls and/or proxies. Browsers generally require a secure connection for WebSockets, although they may offer an exception for local devices.

Copied out of here:

Is it possible to make ignition and vision run on different ports, for example Vision on 8088 and perspective on 8089? My company wants to go to perspective exclusively because it can work with DUO and other identity providers, but we will lose some vision functionality, so if I can make them run on different ports we can lock down security in other ways.

You would probably have to have them running on separate gateways. At least based on the knowledge that I have.

1 Like