Gateway Management

Viewing gateways

Navigate to Gateways in the GAccess console to see all gateways in your environment. The list shows:

• Status — current state of each gateway (see the status reference).
• Gateway name and FQDN — the identifier and the DNS hostname assigned to this gateway.
• Networks — the CIDR ranges and friendly names this gateway covers.
• IP addresses — the private (internal) and public IP addresses last reported by the gateway.

Click a gateway's name to open a detail panel with the full configuration and last-seen timestamp.

Monitoring status

The gateway reports its status automatically. You do not need to refresh or poll manually — the list reflects the current state.

If a gateway appears Offline, it has stopped sending health updates. This typically means:

• The server is powered off or unreachable.
• The gateway service has stopped (check manage_gaccess status on the server).
• Network connectivity between the server and the GAccess platform has been interrupted.

The gateway will automatically return to Online once it reconnects. No administrator action is required.

Editing a gateway

Click the ⋮ (actions menu) next to a gateway and select Edit, or click the pencil icon in the detail panel.

You can change:

• Description — update the gateway's description at any time.
• Network Routes — add, edit, or remove CIDR ranges. Changes take effect immediately for new sessions; active sessions are not affected.
• Reconcile Account — link a credential used for automatic password rotation on target servers reachable through this gateway.
• Connectivity Information — see below.

Connectivity Information (advanced)

The gateway's FQDN and public IP address control where end-user clients connect to reach the gateway. There are two modes.

Managed connectivity (default)

GAccess automatically assigns a DNS name in the form gatewayname.yourcompany.gaccess.cloud and keeps it in sync:

• On every health check, the gateway reports the public IP address it detects.
• If the IP has changed since the last check, GAccess updates the DNS A record automatically.
• A TLS certificate for this hostname is provisioned and renewed by GAccess — no administrator action is needed.

This is the recommended mode for most deployments. The gateway will work correctly even if its host is moved to a different server or IP address, as long as it can reach the platform on port 443.

Manual connectivity

Enable Manual Connectivity when your environment requires a fixed IP that GAccess should not overwrite — for example when the gateway sits behind a NAT or load balancer and the auto-detected IP is an internal address rather than the reachable external one.

When manual connectivity is enabled, provide:

• FQDN — the DNS name clients will use to reach this gateway.
• Public IP Address — the reachable IPv4 address. GAccess will not overwrite this value from health check reports.

The behavior of the DNS record depends on which FQDN you enter:

Keeping the managed hostname (gatewayname.yourcompany.gaccess.cloud)

GAccess continues to manage the DNS A record, but uses the IP address you supply instead of the auto-detected one. Use this when the gateway is behind NAT: set the Public IP to the external address and leave the FQDN as the managed hostname. The DNS record will point to the correct external IP rather than the internal one the gateway reports.

Using a custom hostname (e.g. gw.internal.yourcompany.com)

GAccess will not touch DNS at all. You are responsible for creating and maintaining the DNS record in your own zone. If the IP changes you must update your record manually.

Operational impact summary

TLS certificate

If you use a custom FQDN, you must also install a certificate valid for that hostname — see Custom SSL Certificate below. No certificate change is needed when keeping the managed hostname.

Custom SSL Certificate

By default, the gateway uses a certificate provisioned by GAccess for its managed gaccess.cloud hostname when serving connections to RDP and Web proxies. If you configure a custom FQDN under manual connectivity, you need to install a certificate that is valid for that hostname — otherwise browsers and native clients may reject the connection.

When to use this

• You have enabled manual connectivity and set a custom FQDN.
• Your organization requires certificates issued by your own CA or a specific commercial CA.
• Your security policy does not permit Let's Encrypt certificates.

Installing a custom certificate

Obtain a certificate (and private key) from your CA for the gateway's FQDN, copy the files to the gateway server, then run:

sudo manage_gaccess ssl-import CERT=/path/to/cert.pem KEY=/path/to/key.pem

If your CA issues a separate intermediate chain file, include it:

sudo manage_gaccess ssl-import CERT=/path/to/cert.pem KEY=/path/to/key.pem CHAIN=/path/to/chain.pem

The command will:

1. Validate that the certificate is a valid PEM, has not expired, and that the private key matches it.
2. Install the files with the correct permissions for the gateway processes.
3. Extract the certificate's Common Name (CN) and update the gateway's FQDN configuration.
4. Reload nginx and restart the RDP proxy so both services use the new certificate immediately.
5. Disable the automatic Let's Encrypt renewal, since the certificate is now externally managed.

Certificate renewal

GAccess does not renew externally managed certificates. Before the certificate expires, obtain a new one from your CA and repeat the ssl-import command. The gateway will continue serving the existing certificate until you replace it.

Handling enrollment issues

If a gateway shows Pending Enrollment or Enrollment Expired, the installation token was never used or expired before enrollment completed.

To issue a new token:

1. Open the gateway's edit page (⋮ → Edit or the pencil icon in the detail panel).
2. Click Regenerate Token.
3. A new one-time code is displayed. Copy or download it — it will not be shown again.
4. Return to the server and re-run the installation command with the new code.

The new token is valid for 5 hours.

Revoking a gateway

Revoking a gateway immediately terminates its access to the platform. Use this when a gateway server has been compromised, decommissioned, or you need to take it offline urgently.

What revocation does:

• The gateway's certificate is invalidated and the platform will reject any further connections from it.
• All active sessions routed through this gateway are terminated within approximately 30 seconds.
• The gateway record is preserved with Revoked status. It can be re-enrolled later using Regenerate Token if needed.

What revocation does not do:

• It does not delete the gateway configuration or network routes.
• It does not affect other gateways.

To revoke a gateway, click ⋮ → Revoke and confirm the action. Revoke is only available for gateways in Online or Offline status.

Deleting a gateway

Deleting permanently removes the gateway and all its configuration. This action cannot be undone.

To delete a gateway, click ⋮ → Delete and confirm the action.

If you want to retire a gateway without losing its configuration — for example, to re-enroll it later on a different server — use Revoke instead of Delete.