# Need tips for perspective security

**URL:** <https://forum.inductiveautomation.com/t/need-tips-for-perspective-security/39044>\
**Category:** Maker\
**Created:** [September 24, 2020, 8:45pm UTC](https://forum.inductiveautomation.com/t/need-tips-for-perspective-security/39044 "2020-09-24T20:45:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tordvd](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tordvd/32/11525_2.png) [@tordvd](https://forum.inductiveautomation.com/u/tordvd)\
**Post date:** [September 24, 2020, 8:45pm UTC](https://forum.inductiveautomation.com/t/need-tips-for-perspective-security/39044/1 "2020-09-24T20:45:20Z")

</div>

**Hi!**  
I want everyone in my **household** to be able to access the perspective app **without** having to authenticate with a **password**.

At the same time I will setup my gateway with SSL for accessing the system **externally**. Here i will of course **use a password**.

All trusted devices (on my wifi), has manually setup of IP adresses, based on MAC addresses.

My initial though here was to map all local/fixed IP adresses into a public security level. And give this security level client access to the perspective project.

The rest of the clients (external, or guest wifi) will have to authenticate.

**Is this possible, and safe? Any comments?**

_Just some sidenotes:_

- I am running the whole system on a RPI4
- I am running all systems in a dockerized environment
- Using Home Assistant & Nodered as backend apps, which I will also setup with SSL to enable Google voice commands.

**Really appreciate your input!**

---

<div class="post-metadata">

**Author:** ![Sanderd17](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sanderd17/32/8735_2.png) [@Sanderd17](https://forum.inductiveautomation.com/u/Sanderd17)\
**Post date:** [September 25, 2020, 6:01am UTC](https://forum.inductiveautomation.com/t/need-tips-for-perspective-security/39044/2 "2020-09-25T06:01:59Z")

</div>

I would suggest installing a VPN server (could be installed on your RPi). Then remote users can connect over VPN to the local network.

This will have more guarantees to be secure.

If you don’t want that, you’ll probably have to figure something out with security zones ([https://docs.inductiveautomation.com/display/DOC80/Security+Zones](https://docs.inductiveautomation.com/display/DOC80/Security+Zones))

---

<div class="post-metadata">

**Author:** ![tordvd](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tordvd/32/11525_2.png) [@tordvd](https://forum.inductiveautomation.com/u/tordvd)\
**Post date:** [September 25, 2020, 1:03pm UTC](https://forum.inductiveautomation.com/t/need-tips-for-perspective-security/39044/3 "2020-09-25T13:03:41Z")

</div>

I also think that a VPN connection is the easiest way to secure the system. But then the household must first access the VPN app in order to use the perspective app, which is kind of the same hassle as a password.

As per your link, I am my wonder if using only security zones is secure enough.

If someone verify/comment if using security zones to allow local users to not use password, is secure with regard to external (SSL) connections?

Is the security zones there to just block access within Ignition, or does it actually have the “stopping” power of a firewall (is security zones just a top layer software block?). Not a good question, but I am not sure how to explain my concern any better.  
Edit: Can an external user that has been allowed through the modem/router firewall somehow hack their Ignition authentication level?

---

<div class="post-metadata">

**Author:** ![Kyle\_Chase](https://avatars.discourse-cdn.com/v4/letter/k/9de0a6/32.png) [@Kyle\_Chase](https://forum.inductiveautomation.com/u/Kyle_Chase)\
**Post date:** [September 26, 2020, 8:38am UTC](https://forum.inductiveautomation.com/t/need-tips-for-perspective-security/39044/4 "2020-09-26T08:38:50Z")

</div>

Check out wireguard. Super easy to configure, roams in and out of the house when configured properly, and not chatty. I use it to secure home and business systems.

---

<div class="post-metadata">

**Author:** ![tordvd](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tordvd/32/11525_2.png) [@tordvd](https://forum.inductiveautomation.com/u/tordvd)\
**Post date:** [September 29, 2020, 5:49am UTC](https://forum.inductiveautomation.com/t/need-tips-for-perspective-security/39044/5 "2020-09-29T05:49:06Z")

</div>

Thank you Kyle, I will give it a go with Wireguard for both iOS and android devices.