# Gateways

Secure routing and access across any network barrier

{% embed url="<https://www.youtube.com/watch?v=_FZhBhIbUvc>" %}

## Introduction

Gateways are a unified approach to providing several advanced features for secure user connections reliable network access behind restrictive networks (CGNAT, Double NAT, or firewalls) and more.

How Gateways work:

* WireGuard Clients - Allows unmanaged devices (smartphones, laptops, desktops, routers, IoT devices) to securely connect to a Netmaker network via WireGuard.
* Relay / Auto Relay - For devices behind CGNAT, Double NAT, or restrictive firewalls, Relay functionality routes traffic through a gateway to maintain connectivity when direct access isn’t possible.
* Internet Gateway - Provides full tunnel access to the internet for connected devices via the Gateway.
* User Access - The Gateway is how your end users will access the network over Netmaker Desktop and Mobile.

## How Gateways Work

A Gateway is a publicly reachable node in your Netmaker network that performs one or both of the following functions:

* Remote Access: Provides entry for Remote Access Clients using the Netmaker Desktop App or WireGuard configuration files. These clients connect to the gateway to securely access network services.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FgfjK9KKHHe7i6uxEJkMh%2Frelay1.png?alt=media&#x26;token=83533563-6641-4378-b46e-b9b36a2b165e" alt=""><figcaption></figcaption></figure>

* Relay: Routes traffic for nodes that cannot establish direct peer-to-peer connections due to network restrictions (e.g., NAT or firewalls).

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2F6RJaD2nT50kV3GF8tETs%2Frelay2.png?alt=media&#x26;token=9d33dc44-667f-4ccf-8356-0904d37797d1" alt=""><figcaption></figcaption></figure>

## Configuring a Gateway

{% stepper %}
{% step %}

### Create a Gateway

* Navigate to the Gateways interface of your network in the Netmaker dashboard.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2F4G5wD9NnOsydzgJY21oh%2Fg3.png?alt=media&#x26;token=fbb1c416-b9d5-4a26-bc66-c8b4c775ea3d" alt=""><figcaption></figcaption></figure>

* Click Create Gateway and select a node to act as the gateway. This node must have a public IP address (not behind a NAT).
  * If unsure, the Netmaker server is a good default choice.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FKRVWjwJ0Tj1NnjtHuAMl%2Fg4.png?alt=media&#x26;token=314cde18-b004-407c-93bb-6686dc9dc1a7" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Internet Gateway

Starting from Netmaker v1.0.0, an Internet Gateway option is available from the Gateways screen. This lets designated gateway nodes route traffic from your Netmaker network to the public internet (e.g., full-tunnel VPN access for remote clients).

* Only Linux devices can be configured as Internet Gateways. Windows, macOS, and Linux devices can connect to an existing Internet Gateway.
* Remote clients can connect to Internet Gateways using WireGuard config files, the Netmaker Desktop app, or the mobile Client App.

Creating an Internet Gateway:

* Go to the Gateways interface.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2Fu5koiiXut661wwotBHlw%2Fg5.png?alt=media&#x26;token=a34f6253-d75c-4878-a52f-83d6c6ba189c" alt=""><figcaption></figcaption></figure>

* Click Create Gateway.
* Select a Linux node with a public IP to act as the Internet Gateway.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2Fk6b7ZMRcKqN0pnpp6tHR%2Fg6.png?alt=media&#x26;token=7731eade-5c08-484a-aedc-5b8ede15e361" alt=""><figcaption></figcaption></figure>

* Toggle the Internet Gateway option.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2Fgk1CTsDWBP2VH0T86YjU%2Fg7.png?alt=media&#x26;token=ab3cd1c4-3b88-49b0-aa4e-159544b7d888" alt=""><figcaption></figcaption></figure>

* Click Create Gateway to finalize setup.

Notes:

* A node can only be connected to one Internet Gateway, regardless of how many networks it's in.
* A node connected to an Internet Gateway cannot itself act as a gateway (chaining is not supported).
  {% endstep %}

{% step %}

### Connecting Nodes to an Internet Gateway

* Click the gateway entry in the Gateways table to expand its details.
* Click the Connected Nodes tab.
* Click Add Connected Nodes.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FQmPiWbtrsm9lHesi3jYJ%2Fg8.png?alt=media&#x26;token=d99ab7c0-a39c-42aa-807d-23adb14cf26a" alt=""><figcaption></figcaption></figure>

* Select one or more nodes to route traffic through this Internet Gateway.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2F8P1fq4wNKAigozCX1Er0%2Fg9.png?alt=media&#x26;token=1a5eab1f-f03a-416a-a018-b57d1019d8c0" alt=""><figcaption></figcaption></figure>

Default behavior:

* Connected nodes are placed in split tunnel mode (only internal/VPN traffic routes through the gateway; regular internet traffic uses their local network).

To enable full tunnel mode (route all traffic, including internet-bound), toggle Route All Traffic on the connected node entry.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FOJ2q6tUtzwAvpMV0SXez%2Fg10.png?alt=media&#x26;token=7e51c3f5-cd13-43a9-a7d5-eb85e721f658" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Removing an Internet Gateway

* Navigate to the Gateways interface.
* Click the meatballs menu (⋯) on the gateway and select Edit to open the edit modal.
* Toggle off the Internet Gateway switch.
* Save your changes.
  {% endstep %}
  {% endstepper %}

## Relay Configuration

{% stepper %}
{% step %}

### Adding Relayed Nodes

* Navigate to the Connected Nodes tab of your created Gateway.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FaNvVId7L6PX35G4aKpt3%2Fg11.png?alt=media&#x26;token=0060374e-90c8-47f2-b3e0-4aed51a19715" alt=""><figcaption></figcaption></figure>

* Click Add Connected Node and select the node that requires relaying.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FGETxpvrAljPApnj5PTD2%2Fg12.png?alt=media&#x26;token=6ad74279-c455-4241-9e46-f88bf0c43d28" alt=""><figcaption></figcaption></figure>

* The selected node will now route its traffic through the gateway.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FKmlEcW6BB2OQ9Q68qKTf%2Fg13.png?alt=media&#x26;token=cf1eae8f-16a3-4d90-9442-fd86aaad2319" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Relay Node on Enrollment

When adding a new node to the network, you can pre-configure it as a relayed node by:

* Generating an enrollment key and specifying the relay and network.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2Fjl8zUzLGwRAEZpLytezo%2Fg14.png?alt=media&#x26;token=c183a764-74cb-4c81-85ab-a548dbb1ff00" alt=""><figcaption></figcaption></figure>

* Using the enrollment key during node setup to automatically configure it as a relayed node.
  {% endstep %}
  {% endstepper %}

## Create WireGuard Config Files

{% stepper %}
{% step %}

### From the Nodes Interface

* From the left sidebar, open the Nodes page and click on the Config File tab.
* Click +Add config file.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FEaEanQLAEAufftH2Tz1Q%2Fg15.png?alt=media&#x26;token=998b2d5d-4c98-44e9-b987-d37a99889331" alt=""><figcaption></figcaption></figure>

* Fill in the required details:
  * Node name: Assign a unique name to identify the client.
  * Gateway: Select the gateway the node should connect to.
  * Public Key (Optional): Use a client-specific public key if available.
  * DNS (Optional): Define a custom DNS server for the client.
  * Address (Optional): Specify a static IP address or subnet for the node.
  * Additional Addresses (Optional): Add multiple IP addresses if required.
  * Post Up / Post Down (Optional): Include optional scripts to run when the client connects or disconnects.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FP8YQOCg5rLkmUnop22sP%2Fg16.png?alt=media&#x26;token=e3eb2a66-1c08-4d9d-9578-30b3d3bda590" alt=""><figcaption></figcaption></figure>

* Click Create Config to add the node.
* The node will appear under the Nodes list and its configuration can also be found in the gateway’s Conf Files tab.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FALPqoqWSdCnivn25q0yQ%2Fg17.png?alt=media&#x26;token=ccfa5100-aae1-4314-a3b3-c2d1ef6d5a56" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### From the Gateway’s Conf Files Tab

* Click Create Config in the Conf Files tab of your gateway.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2Fp7c1OK0pSukdOQ0pio4P%2Fg18.png?alt=media&#x26;token=dc930a49-930e-4947-8ec4-c5feac65d5f8" alt=""><figcaption></figcaption></figure>

* Optionally configure the following parameters (leave blank for auto-generation):
  * Name: Assign a unique name to the client.
  * Public Key: Enhance security with a client-specific public key.
  * DNS: Specify a custom DNS server for the client.
  * Additional Addresses: Assign multiple IP addresses to the client.
  * Post Up: Add a custom script to execute after the client connects.
  * Post Down: Add a custom script to execute after the client disconnects.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FqSVxWR006rbfpI72fC7i%2Fg19.png?alt=media&#x26;token=8ef35043-e0c9-4988-9fff-e7fb521dc84e" alt=""><figcaption></figcaption></figure>

* Download the WireGuard configuration file (conf file) or scan the QR code for unmanaged devices (routers, IoT devices, desktops) that support WireGuard.

Once configured, the external client can securely connect to the network through the gateway. You can disable or delete the client at any time from the Nodes interface.
{% endstep %}
{% endstepper %}

Example WireGuard configuration:

{% code title="example.conf" %}

```plaintext
[Interface]
Address = 100.70.101.254/32,fd3c:2f98:6bb1:2e37:ffff:ffff:ffff:fffe/128
PrivateKey = UJBMEgy5KlWq/lpDy/3k2FewP1nlSjchOkIhYazA+Fo=
MTU = 1420
DNS = 1.1.1.1

[Peer]
PublicKey = KsHJHPJO4b6sviElK1XdGkw3M+oQFYJbVKnXBlLGGFA=
AllowedIPs = 100.70.101.0/24,fd3c:2f98:6bb1:2e37::/64,192.168.1.0/24
Endpoint = 134.122.28.173:443
PersistentKeepalive = 20
```

{% endcode %}

## Connected Users

You can view and manage connected desktop clients from the Nodes screen.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2F5I4OR5yh3ITUQtgEmboM%2Fg20.png?alt=media&#x26;token=8baf1d7f-77bb-4085-9581-29b1f46ca7ea" alt=""><figcaption></figcaption></figure>

The Connected Users tab under your gateway provides another way to monitor and manage connections established via the Netmaker Desktop App.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2F25M0Ju3QHCyIlwHwuOOi%2Fg21.png?alt=media&#x26;token=1082d673-08bd-4f81-9aba-6004e7320b0c" alt=""><figcaption></figcaption></figure>

For each connected user, you can:

* View their WireGuard configuration file.
* Delete the node if required.

## High Availability (HA) Gateways

### Overview

High Availability (HA) Gateways, introduced in version 1.2.0, add automatic gateway selection and failover switching. Nodes can automatically connect to the best available gateway and seamlessly switch when their current gateway becomes unavailable, improving reliability, uptime, and ease of management.

### How HA Gateway Works

* Nodes can have their gateway mode set to Auto.
* Netmaker periodically checks gateway availability and latency (approximately every 30 seconds).
* The node connects through the nearest and healthiest gateway.
* If that gateway goes down, the node reconnects through another available gateway seamlessly.

### UI Configuration Example

* When viewing network devices, click Assign Gateway next to any node to open the gateway selection menu.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2Ft2v9wHSZDfQ2nCU0p1bi%2Fg22.png?alt=media&#x26;token=914bb4b0-cd6e-478a-8943-a6f14bf47a6c" alt=""><figcaption></figcaption></figure>

* In the Assign Gateway window, toggle Auto-select Gateway to let Netmaker automatically pick the best available gateway for that node.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FCP6j1f67XVwDGgtGRZ3k%2Fg23.png?alt=media&#x26;token=ccd1533a-2092-4669-a4a6-4d65900baf68" alt=""><figcaption></figcaption></figure>

* Toggle **Auto-select Gateway** to enable automatic gateway selection for this node.
* When enabled, Netmaker will automatically choose the **best available gateway**.
* The peer will automatically **switch gateways** when its current one is offline.

<figure><img src="https://1465744049-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqMcN3gvfPLhO0hh4agC%2Fuploads%2FdOTocFOExXBHA4qL7pFl%2Fg24.png?alt=media&#x26;token=5938a41b-4eba-459b-a30c-1cdfeddce171" alt=""><figcaption></figcaption></figure>

### Notes

* Introduced in Netmaker v1.2.0
* Gateway status checks occur approximately every 30 seconds.
* Currently labeled as BETA.
* Switching happens seamlessly — users won’t notice the transition.
* Works best in multi-gateway or distributed environments.

### Use Case Examples

* Server Clusters: Redundant gateways ensure zero downtime during maintenance or outages.
* Multi-site VPN Networks: Automatically route client traffic through the nearest or most responsive gateway.
* Remote Workers: As clients move between locations, Netmaker automatically connects them to the gateway with the lowest latency.
* IoT Devices: Field units maintain connectivity even when one gateway goes offline.

## Auto-Relay (Pro)

Automatically routes traffic through the closest, lowest-latency gateway.

{% hint style="info" %}

#### Overview

The **Auto-Relay** feature (formerly called Failover) allows multiple gateways to act as relays for peers, making the network more flexible and resilient.

Key points:

* Multiple auto-relays can be configured simultaneously.
* Peers automatically select the relay with the **lowest latency**.
* All gateways are **auto-relay enabled by default**, meaning any new gateway can act as a relay immediately.
* **Useful in NAT scenarios:** Auto-Relay is especially beneficial when nodes are behind CGNAT, Double NAT, or restrictive firewalls, where direct peer-to-peer connections may fail.
  {% endhint %}

## How Auto-Relay Works

{% stepper %}
{% step %}

### Gateway advertisement

Each gateway advertises its Auto-Relay status across the network.
{% endstep %}

{% step %}

### Reachability & latency measurement

Peers evaluate which gateways are reachable and measure latency.
{% endstep %}

{% step %}

### Relay selection

Peers connect through the active Auto-Relay gateway with the lowest latency.
{% endstep %}

{% step %}

### Automatic failover

If that gateway becomes unavailable, the peer automatically switches to another reachable Auto-Relay gateway.
{% endstep %}
{% endstepper %}

This creates **dynamic redundancy** and ensures smooth network performance **without manual failover setup**.

## Default Behavior

* Every new gateway is automatically set as **Auto-Relay = ON**.
* You can view or edit this setting in the **Edit Gateway** modal.
* Manual configuration is optional — Auto-Relay works automatically across gateways.

{% hint style="info" %}

### Notes

* Auto-Relay replaces the older Failover logic but **retains backward compatibility**.
* Any gateway can act as a relay without explicit assignment.
* Latency-based routing **balances network load** and maintains optimal data flow.
* Particularly **helpful when NAT or firewall restrictions prevent direct peer-to-peer connections**.
  {% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://learn.netmaker.io/features/gateways.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.