# Add a gateway
Source: https://docs.infraista.com/en/networking/gatepass/add-a-gateway



A **gateway** is where GatePass traffic leaves for the internet. Sites see the gateway's **exit IP**,
so that's the address portals allowlist. The **Gateway Agent** is a small free service you install on
your own Linux server, at the office or in the cloud.

<Shot name="networking/gatepass/gateways" alt="The Gateways page with office-gw online and its exit IP" />

## Requirements [#requirements]

| Requirement                        | Detail                                                                                                                                                  |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Linux 5.6+**                     | Or an older kernel with the WireGuard module. Docker and the other tools it needs are installed automatically on Ubuntu, Debian and RHEL-family servers |
| **Outbound UDP to the hub server** | To its WireGuard port (51820 by default)                                                                                                                |
| **No inbound ports**               | The tunnel goes out from the server, so it works behind NAT                                                                                             |
| **A public IP sites can see**      | This becomes the exit IP portals allowlist                                                                                                              |
| **Runs as root**                   | curl, jq, wireguard-tools and iproute2 are installed if missing (apt or dnf)                                                                            |

## Add the gateway [#add-the-gateway]

1. Go to **GatePass › Gateways** and select **Add gateway**.
2. Choose **Gateway Agent** as the type and enter a **Name**.
3. Under **Hubs**, pick the hubs that use it. The gateway joins each hub's pool. Pick hubs in one
   region: a gateway tunnels to one region's hub server.
4. Select **Add gateway**.
5. Copy the &#x2A;*Install command (Linux)** and run it as root on the server traffic should exit from.

<Shot name="networking/gatepass/new-gateway" alt="The Add a gateway page with the gateway type, name and hubs" />

The token in the command is shown once and works once. Copy it now; if it expires, select **New
token** to make another (the previous one stops working).

When the agent connects, the gateway shows **Online** with its exit IP. Add that IP to the allowlists of
the sites you route.

<Shot name="networking/gatepass/gateway" alt="A gateway's page: status, exit IP, traffic, the hubs using it, pinned sites and details" />

## Gateway statuses [#gateway-statuses]

| Status                   | Meaning                                                                    |
| ------------------------ | -------------------------------------------------------------------------- |
| **Pending registration** | The agent hasn't registered yet: run the install command                   |
| **Online**               | Sending heartbeats; hubs route through it                                  |
| **Offline**              | No heartbeat for over 2 minutes. Hubs use the other gateways in their pool |
| **Drained**              | Hubs send it no new connections; it keeps its tunnel so you can resume it  |
| **Updating**             | The agent is updating; traffic resumes once the new version runs           |

If a gateway stays offline, check the server with `journalctl -u gatepass-agent -n 100`. If the tunnel
never connects, outbound UDP to the hub server's WireGuard port may be blocked.

## Drain, reinstall or delete [#drain-reinstall-or-delete]

* **Drain**: hubs stop sending it new connections; open ones finish normally. Use it before
  maintenance.
* **Reinstall agent**: for a new server, or to repair this one. The current agent keeps working until
  the new install registers. Sites see the new server's IP if it changes.
* **Uninstall the agent**: run the **Uninstall command** on the server. The gateway stays listed as
  offline until you delete it.
* **Delete gateway**: the agent's token stops working. This can't be undone.

Get told when a gateway goes offline: choose who's alerted in
[GatePass settings](/en/networking/gatepass/gatepass-settings#alerts).

## Related [#related]

* [Manage hubs](/en/networking/gatepass/manage-hubs)
* [Routing rules](/en/networking/gatepass/routing-rules)