Secure deployment inquiry for Isaac Sim WebRTC remote access

Omniverse Isaac Sim
1

Important: Isaac Sim support

Note: For Isaac Sim support, the community is gradually transitioning from this forum to the Isaac Sim GitHub repository so that questions and issues can be tracked, searched, and resolved more efficiently in one place. Whenever possible, please create a GitHub Discussion or Issue there instead of starting a new forum topic.

Note: For any Isaac Lab topics, please submit your topic to its GitHub repo ( GitHub - isaac-sim/IsaacLab: Unified framework for robot learning built on NVIDIA Isaac Sim · GitHub ) following the instructions provided on Isaac Lab’s Contributing Guidelines ( Contribution Guidelines — Isaac Lab Documentation ).

Please provide all relevant details below before submitting your post. This will help the community provide more accurate and timely assistance. After submitting, you can check the appropriate boxes. Remember, you can always edit your post later to include additional information if needed.

Isaac Sim Version

6.0.1
6.0.0
5.1.0
5.0.0
4.5.0
4.2.0
4.1.0
4.0.0
4.5.0
2023.1.1
2023.1.0-hotfix.1
Other (please specify):

Operating System

Ubuntu 24.04
Ubuntu 22.04
Ubuntu 20.04
Windows 11
Windows 10
Other (please specify):

GPU Information

  • Model: Nvidia GeForce RTX 5090
  • Driver Version: 595.84

Topic Description

Hello NVIDIA Isaac Sim team,

This is not a bug report, but a security and deployment architecture inquiry.

We are planning to run Isaac Sim inside a Docker container on a host PC/workstation located in a university campus lab network. The host PC is behind the campus network/firewall. We would like to allow approved remote users, including possible external collaborators, to connect to Isaac Sim using the WebRTC streaming client.

We are concerned about the security of this setup. In particular, we would like to avoid relying only on IP allowlisting, because if access is provided through a campus VPN or shared IP pool, other users from the same network range may still be able to discover or attempt to access the Isaac Sim WebRTC service.We would like to ask:

  1. What is NVIDIA’s recommended secure deployment architecture for Isaac Sim WebRTC streaming in this situation?

  2. Does Isaac Sim WebRTC provide any built-in authentication/access-control mechanism, or should authentication be handled externally through VPN, firewall, zero-trust access, etc.?

  3. Is it a reasonable approach to place the Isaac Sim host behind an identity-based VPN or campus VPN, and then use host firewall rules so the WebRTC service is reachable only from approved users/networks?

We are not planning to expose the Isaac Sim WebRTC service directly to the public internet unless NVIDIA recommends a safe way to do so.

Any guidance or best practices for securing Isaac Sim WebRTC access in a university/collaborative research environment would be appreciated.

Thank you.

Steps to Reproduce

N/A

Error Messages

N/A

Screenshots or Videos

N/A

3

Treat this as general practice rather than official guidance:

In general, Omniverse Kit’s WebRTC streaming extension doesn’t include its own user-authentication layer — access control is expected to be handled outside the extension (network segmentation, reverse proxy/SSO, VPN, etc.), not by the streaming service itself. So the pattern you’re describing — keeping the host off the public internet and gating access via an identity-based VPN with firewall ACLs — is a commonly used approach for this kind of scenario, and I don’t see an obvious issue with it as a starting point.

A couple of things I’d double check rather than take my word for:

- Whether your specific Isaac Sim version has added any session/auth options to the streaming extension (this has evolved across releases).

- Whether you also want a reverse proxy in front of the signaling endpoint for auth logging/rate-limiting, separate from the VPN layer.

If you want an authoritative answer instead of general practice, it may be worth flagging this thread for your account team, since it touches deployment security.

4

Really thanks for your advises! we will specify things you mentioned.

5

Glad I could help here. Closing this ticket for now - feel free to re-open it or file a new one if you need futher support.