# Resources for setting up a gateway on AWS **URL:** \ **Category:** Ignition\ **Tags:** ignition79, ignition80\ **Created:** [December 11, 2018, 8:40pm UTC](https://forum.inductiveautomation.com/t/resources-for-setting-up-a-gateway-on-aws/21350 "2018-12-11T20:40:39Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [December 11, 2018, 8:40pm UTC](https://forum.inductiveautomation.com/t/resources-for-setting-up-a-gateway-on-aws/21350/1 "2018-12-11T20:40:39Z")
My company is trying to put our in-house ignition application on AWS. We have the server already, a copy of our prod database, and ignition installed on the EC2 instance. I am able to run our application on it no problem when I remote in. How do I go from here, to allowing other external users to easily remote in and use the application as intended? The Ignition documentation on this seems sorely lacking. If anyone could point me in the right direction, I’d greatly appreciate it. ---
**Author:** ![craigb](https://avatars.discourse-cdn.com/v4/letter/c/9f8e36/32.png) [@craigb](https://forum.inductiveautomation.com/u/craigb)\ **Post date:** [December 11, 2018, 10:34pm UTC](https://forum.inductiveautomation.com/t/resources-for-setting-up-a-gateway-on-aws/21350/2 "2018-12-11T22:34:57Z")
As far as I know you won’t need to remote in a such. Set up the AWS firewall to allow port 8088 then using the external ip:8088 you will get to the admin pages to download the client launchers. Some extra stuff will be needed if your using SSL or a ddns Incase the AWS isn’t a fixed IP address but in a nutshell that’s it. If your server is windows it may have additional firewall. I installed ignition on AWS a while back doing some testing during their trial period with no issues. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [December 12, 2018, 1:29pm UTC](https://forum.inductiveautomation.com/t/resources-for-setting-up-a-gateway-on-aws/21350/3 "2018-12-12T13:29:23Z")
Ok so I think I was misunderstanding the architechture. Basically my AWS EC2 will run the gateway server, I download the client launchers that I want to be able to connect to said gateway on other computers, and once the firewall is set up correctly I should be able to then launch. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [December 12, 2018, 1:48pm UTC](https://forum.inductiveautomation.com/t/resources-for-setting-up-a-gateway-on-aws/21350/4 "2018-12-12T13:48:33Z")
You really don’t want to expose unencrypted Ignition on a public IP address. Any man-in-the middle who captures your traffic will get all usernames and passwords in the clear. ---
**Author:** ![craigb](https://avatars.discourse-cdn.com/v4/letter/c/9f8e36/32.png) [@craigb](https://forum.inductiveautomation.com/u/craigb)\ **Post date:** [December 12, 2018, 1:52pm UTC](https://forum.inductiveautomation.com/t/resources-for-setting-up-a-gateway-on-aws/21350/5 "2018-12-12T13:52:02Z")
Setting up SSL would correct that ? ---
**Author:** ![craigb](https://avatars.discourse-cdn.com/v4/letter/c/9f8e36/32.png) [@craigb](https://forum.inductiveautomation.com/u/craigb)\ **Post date:** [December 12, 2018, 1:54pm UTC](https://forum.inductiveautomation.com/t/resources-for-setting-up-a-gateway-on-aws/21350/6 "2018-12-12T13:54:42Z")
For info… [http://forum.inductiveautomation.com/t/ssl/2668](http://forum.inductiveautomation.com/t/ssl/2668) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [December 12, 2018, 1:55pm UTC](https://forum.inductiveautomation.com/t/resources-for-setting-up-a-gateway-on-aws/21350/7 "2018-12-12T13:55:33Z")
> [@craigb](#): > > Setting up SSL would correct that ? Yes. You still have to leave the unencrypted port open, as Ignition uses it for static resources even when SSL is turned on, but all of the critical traffic is encrypted. ---
**Author:** ![craigb](https://avatars.discourse-cdn.com/v4/letter/c/9f8e36/32.png) [@craigb](https://forum.inductiveautomation.com/u/craigb)\ **Post date:** [December 12, 2018, 2:06pm UTC](https://forum.inductiveautomation.com/t/resources-for-setting-up-a-gateway-on-aws/21350/8 "2018-12-12T14:06:40Z")
The client launcher then points to the SSL port? So its more or less the same steps as above with the addition of installing the SSL on the server and opening 2 ports. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [December 12, 2018, 2:10pm UTC](https://forum.inductiveautomation.com/t/resources-for-setting-up-a-gateway-on-aws/21350/9 "2018-12-12T14:10:20Z")
I have it running now. I’m going to be following the [Ignition Security Hardening Guide](http://pages.inductiveautomation.com/rs/966-TUX-261/images/IgnitionSecurityHardeningGuide_9-13-17.pdf). Thanks for the information. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [December 12, 2018, 4:05pm UTC](https://forum.inductiveautomation.com/t/resources-for-setting-up-a-gateway-on-aws/21350/10 "2018-12-12T16:05:37Z")
Last question - [https://www.geocerts.com/geotrust-ssl-certificates](https://www.geocerts.com/geotrust-ssl-certificates) Here, the GeoTrust QuickSSL Basic DV or QuickSSL Premium DV should work for my needs? We will not be accessing Gateway on a domain through the browser, we are only going to be installing native client launchers on the computers that will be using our application if that makes a differnece.