# VPN Or Public Gateway **URL:** \ **Category:** Ignition\ **Tags:** ignition80\ **Created:** [August 17, 2021, 12:35am UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991 "2021-08-17T00:35:37Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.inductiveautomation.com/u/John)\ **Post date:** [September 9, 2021, 3:12pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/21 "2021-09-09T15:12:06Z")
From everyone’s responses, it sounds like the best way is to use a VPN for user connection to the Ignition system. What about this scenario? There is a front end server with just Perspective that can be accessed from the public internet (just like any other website). It has access to the database that we will use across all our servers. This front end server has the remote tag provider reading the tag values from the backend server but is set to read only, just like @paul-griffith suggested. Now when a tag write needs to happen from the front end gateway, it writes to a database table. Then the back end server is constantly listening to this database table. When there’s a new record, perform that tag write. So the front end server does not have direct write access. Now is this more secure than the previous suggestion? Is this the best possible solution to get some sort of write access from the front end server which is accessible via the public internet? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [September 9, 2021, 3:14pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/22 "2021-09-09T15:14:06Z")
If you are going to write at all, you may as well use the tag provider. Consider using two–one read-only for most items, and the other read-write but only containing the items those users need. ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.inductiveautomation.com/u/John)\ **Post date:** [September 9, 2021, 3:47pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/23 "2021-09-09T15:47:16Z")
Would it help if there was a load balancer in front? I know the load balancer is to redirect traffic based on some set of reasons to multiple servers but can it help with security? Can it help prevent unwanted attacks and tag writes from something other than an Ignition HMI? ---
**Author:** ![BenKearney](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@BenKearney](https://forum.inductiveautomation.com/u/BenKearney)\ **Post date:** [September 9, 2021, 4:29pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/24 "2021-09-09T16:29:25Z")
What happens when an adversary finds a SQL injection vulnerability or some other sort of vulnerability and attacks your central databases to vandalise or control plant? What do you actually need the users to be able to control remotely? Are they filling out a form saying that they visited a site and checked that the toilets are clean or are you trying to give them access to control switchgear and pumps? ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.inductiveautomation.com/u/John)\ **Post date:** [September 9, 2021, 5:01pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/25 "2021-09-09T17:01:57Z")
Control pumps. ---
**Author:** ![dcamp1](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@dcamp1](https://forum.inductiveautomation.com/u/dcamp1)\ **Post date:** [September 9, 2021, 6:12pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/26 "2021-09-09T18:12:48Z")
I guess I must be confused as to why @John assumes a VPN Solution won’t work. This is exactly what I do. My company is in Oil & Gas and we have hundreds of very remote locations that the “Office” people can log into and take all kinds of reports, then we have “Production Managers” that can log in and they can turn pumps on/off, make adjustments to the VFD’s, set new alarm setpoints, adjust PID function, and since I am the administrator I can actually reprogram any device that is connected to our VPN network, this includes IP Camera, Modem, Router, HMI, Gateways, Etc… All this is through our Verizon Vpn and then my adding all the necessary IP and PORT redirects through are special VPN Router. Been using this setup for almost 6 years and have never had any problems! Works FLAWLESSLY!! I would do it NO OTHER WAY! ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.inductiveautomation.com/u/John)\ **Post date:** [September 9, 2021, 6:14pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/27 "2021-09-09T18:14:22Z")
How does someone do this, lets say from their house? Does this person connect to their home internet and then use some sort of VPN software to connect to the Ignition system? ---
**Author:** ![Matrix\_Engineering](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/matrix_engineering/32/19781_2.png) [@Matrix\_Engineering](https://forum.inductiveautomation.com/u/Matrix_Engineering)\ **Post date:** [September 9, 2021, 6:26pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/28 "2021-09-09T18:26:09Z")
Yes. ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.inductiveautomation.com/u/John)\ **Post date:** [September 9, 2021, 6:28pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/29 "2021-09-09T18:28:27Z")
That’s what I’m trying to get away from, is to not have anyone need software and credentials to keep up with. Sometimes it may be people, who will only had read access (controlled by HMI) and will only need to view for a week or 2 then they won’t need to view anymore. These people could be internal users or customers who are not direct employees. ---
**Author:** ![dcamp1](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@dcamp1](https://forum.inductiveautomation.com/u/dcamp1)\ **Post date:** [September 9, 2021, 7:42pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/30 "2021-09-09T19:42:42Z")
If you have a Verizon or AT&T VPN network you won’t need any software! You can connect to the VPN tunnel from any device that is connected to the internet through a special IP address that is not public accessible I connect from all over the USA. Think of it this way. Log into a special box (without the need of any software) and that box will keep everything secure and you allow who and what they can access just by programing the box.) ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.inductiveautomation.com/u/John)\ **Post date:** [September 9, 2021, 7:44pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/31 "2021-09-09T19:44:44Z")
So the IP address you enter into let’s say your web browser re-directs you to your Ignition HMI? ---
**Author:** ![dcamp1](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@dcamp1](https://forum.inductiveautomation.com/u/dcamp1)\ **Post date:** [September 9, 2021, 7:46pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/32 "2021-09-09T19:46:47Z")
If that’s how you have programmed the redirect in the VPN Tunnel. ---
**Author:** ![scotteolson3](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@scotteolson3](https://forum.inductiveautomation.com/u/scotteolson3)\ **Post date:** [September 13, 2021, 6:01pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/33 "2021-09-13T18:01:20Z")
I had this battle when I was setting up our system as well. What we decided to do was to run Ignition in AWS which we then connect to via an onsite VPN. This means it technically has a public IP however the AWS EC2 instance’s firewall only allows access via the VPN IP, essentially making it private. We then also have all of our local devices tunnel through a site-to-site VPN which allows for the local machines to connect to the cloud Ignition instance. So anyone on our local network (requires login credentials) or with VPN credentials is able to connect to the Ignition instance. I had to learn quite the bit more networking to iron this one out. ---
**Author:** ![Ryan\_Allen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan_allen/32/47013_2.png) [@Ryan\_Allen](https://forum.inductiveautomation.com/u/Ryan_Allen)\ **Post date:** [December 18, 2022, 3:21am UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/34 "2022-12-18T03:21:31Z")
How much is this service, approximately? I assume it's a monthly/yearly fee? ---
**Author:** ![dcamp1](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@dcamp1](https://forum.inductiveautomation.com/u/dcamp1)\ **Post date:** [December 18, 2022, 1:18pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/35 "2022-12-18T13:18:29Z")
To get the service setup and running it took a (1) time fee from Verison for $500.00 - Then we had to purchase a Router that was capable of implementing all of the VPN/Security protocols that needed to be put in place. This was about $800-$1000, now from that point on, it depends on the amount of bandwidth your "Edge of Network" device uses. Almost all of my "EON" are on the $18.00 dollar a month plan, however I do have a couple of larger "EON" setups that cost $25.00, The 10gig a month plan is $50.00 a month. We use MQTT as are remote communication protocol so this really heps to keep bandwidth usage down. I collect 1000's of tags (refreshed-every 3 minutes, 24/7) from all across the US and I am still only using 10% of my purchased bandwidth. One of the best features about this configuration is that I can program-debug-upload-download to any device on the Private Network just as if that device is on my bench. And I might be 1000's of miles from that unit. Hope this helps. ---
**Author:** ![Ryan\_Allen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan_allen/32/47013_2.png) [@Ryan\_Allen](https://forum.inductiveautomation.com/u/Ryan_Allen)\ **Post date:** [December 18, 2022, 2:13pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/37 "2022-12-18T14:13:49Z")
This helps a lot thanks so much ---
**Author:** ![chaoliang](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@chaoliang](https://forum.inductiveautomation.com/u/chaoliang)\ **Post date:** [February 17, 2023, 3:17am UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/38 "2023-02-17T03:17:20Z")
Similar setup here in Australia. But I am not using Telstra VPN (like Version in US) but using Tosibox VPN Instead. ---
**Author:** ![Joe\_Bonhage](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/joe_bonhage/32/45543_2.png) [@Joe\_Bonhage](https://forum.inductiveautomation.com/u/Joe_Bonhage)\ **Post date:** [August 8, 2023, 7:56pm UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/39 "2023-08-08T19:56:50Z")
I'm looking to expose Ignition server running on the edge to a public URL (subdomain), not sure if anyone has used Cloudflare tunnel but is looks like a good solution. Cloudflare will protect the edge endpoint while adding its own authenication to allow traffic to be forwarded to the edge device from the domain. Also it automatically makes the connect SSL even if the edge device doesn't support it. > **[Tunnel | Zero Trust App Connector](https://www.cloudflare.com/products/tunnel/)** > > Connect applications, servers, and other resources to Cloudflare's network via encrypted outbound tunnels. No publicly routable IPs or VMs required. ---
**Author:** ![deon.korb](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@deon.korb](https://forum.inductiveautomation.com/u/deon.korb)\ **Post date:** [August 9, 2023, 6:15am UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/40 "2023-08-09T06:15:41Z")
I have tested this and it works exceptionally well for Perspective in a browser. I cannot get the Android app authenticated.Have not tried iOS or Workstation. See here: > [@Perspective App via Cloudflare Tunnel](https://forum.inductiveautomation.com/t/perspective-app-via-cloudflare-tunnel/70733): > > I set up a Cloudflare tunnel to my Ignition gateway running on a Docker container and use Google idp for security. Everything works beautifully using a browser. I can connect to the gateway and launch the Perspective project in the browser. When I try to add this in the Android app, it says the host is valid, but no applications found. [https://igntion.mydomain.com](https://igntion.mydomain.com) maps via the Cloudflare tunnel to http://:8088, using all their magic and certificates. Any idea how… ---
**Author:** ![greg3](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/greg3/32/16671_2.png) [@greg3](https://forum.inductiveautomation.com/u/greg3)\ **Post date:** [September 16, 2023, 3:24am UTC](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991/41 "2023-09-16T03:24:17Z")
@deon.korb How did you setup the cloud flare routes? I am able to connect to the tunnel and I can visit the gateway page, I can launch the project, but before the login screen comes on up the app, it just hangs there. I am wondering if I have a port issue. I do have one more layer to this. I am running ignition in a docker container. Outside port is 8089 and maps to 8088 on docker container. The app pulls up fine locally with no issue. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/3/235726c67a4a38e29f13742c964f253e63ffa115.jpeg) [Previous page](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991.md?page=1) [Next page](https://forum.inductiveautomation.com/t/vpn-or-public-gateway/49991.md?page=3)