# Set up GatePass
Source: https://docs.infraista.com/en/networking/gatepass/set-up-gatepass



The setup takes four short steps. You can leave and come back: the console picks up where you left
off.

**Before you start:** you need a Linux server for the gateway, with a public IP the portals allowlist
(an office server or a cloud server). See
[Add a gateway](/en/networking/gatepass/add-a-gateway#requirements) for its requirements.

Go to **Network & Library › GatePass** and start the setup.

## 1. Hub [#1-hub]

1. **Organization name**: a short name that goes in every hub endpoint (3–20 lowercase letters,
   digits and hyphens). Your team never needs to type it.
2. **Hub name**: shown to members in the extension, for example "Studio Ops". Add a **Description**
   if you like.
3. **Hub region**: where the hub runs. Pick one close to your gateway and the sites you route, not
   necessarily close to the people.

## 2. Gateway [#2-gateway]

1. Enter a **Gateway name** (3–32 lowercase letters, digits and hyphens) and select **Create hub and
   gateway**.
2. Copy the **Install the agent** command and run it as root on your server. It installs Docker and the
   tools it needs if they're missing.
3. Wait for **Agent connected**. The page shows the IP visits will exit from.

The command contains a one-time registration token that lasts an hour; keep it private. If it
expired, select **Get a new command**. You can also continue right away and let the agent connect in
the background.

## 3. Sites [#3-sites]

* **Routed sites**: only these go through your hub and gateway, and only these are logged. Use
  domains, wildcards, IP addresses or private ranges: `*.example.com` covers `example.com` and every
  subdomain; `10.20.0.0/16` covers a private range.
* **Excluded sites** (**Always go direct**): exclusions win over routed sites. Use them for video calls
  or streaming inside a routed domain, so they don't use gateway bandwidth and aren't logged.

Everything else goes direct, on the person's normal connection, and isn't logged.

## 4. Invite [#4-invite]

Enter the **Email addresses** of the people who need access and pick a **Role**:

* **Member**: uses the extension to reach this hub's sites;
* **Admin**: also marked as a GatePass admin. Console access still comes from your organization's
  roles.

Each person gets an email to set a password, turn on two-factor authentication (required for everyone)
and install the extension. Invites expire after 7 days. You can skip this step and invite people
later from **Users**.

Select **Finish setup** (or **Finish and send invites**).

## Related [#related]

* [Add a gateway](/en/networking/gatepass/add-a-gateway)
* [Routing rules](/en/networking/gatepass/routing-rules)
* [Manage users](/en/networking/gatepass/manage-users)