Documentation

Gateway Overview

What Gateways are, how they work, and their lifecycle states

Gateway Overview

What is a Web Gateway?

A Gateway is a lightweight set of services that you deploy on a server inside your network. Once enrolled, it creates a secure connection back to the GAccess platform, giving the platform a trusted data path into your environment.

This architecture means your internal servers never need to be exposed to the internet. End users connect to GAccess through the browser, the platform routes the session through the enrolled gateway, and the gateway forwards it to the target machine.

How it works

When a user wants to connect to a target server or applications, GAccess will:

  1. Locates the gateway that has a network route covering that server's IP address.
  2. Sends a signed, time-limited session token to the gateway.
  3. The gateway will transparently inject the credentials in the session and establishes a connection to the target server.
  4. The remote session is proxied end-to-end through the gateway.
Note: The connection may also be established directly from the client application like Putty or Microsoft Remote Desktop Connection to the target. For more details the available options, please see Connecting to Remote Targets.

The gateway communicates with the GAccess platform exclusively over mutual TLS (mTLS). Both sides present certificates, so the platform only accepts connections from gateways it has explicitly enrolled, and the gateway only trusts the platform's own certificate authority — nothing from the public internet.

Network Routes

Each gateway is configured with one or more network routes — a CIDR range paired with a friendly name (for example, 10.10.0.0/24 named Production Servers).

When a user launches a session to a target, GAccess matches the target's IP address against the routes of all online gateways and selects the most specific match. A gateway only handles traffic for IP ranges covered by its routes.

Gateway lifecycle

Status Meaning
Pending Enrollment The gateway record has been created and an installation token issued. The gateway software has not yet connected.
Online The gateway is enrolled and actively reporting to the platform. Sessions can be routed through it.
Offline The gateway was enrolled but has stopped reporting. Sessions cannot be routed through it until it reconnects.
Enrollment Expired The one-time installation token expired before the gateway completed enrollment. A new token must be generated.
Revoked An administrator has explicitly revoked this gateway. All active sessions were terminated. The record is preserved and can be re-enrolled.
Note: A gateway moves to Offline automatically when it stops sending health updates. It returns to Online on its own once connectivity is restored, no administrator action is needed.

What you need to deploy a gateway

For step-by-step deployment instructions, see Gateway Deployment.