Gateways
Gateways are what Clients connect to in order to access Resources in a Site. They're the data plane workhorse of the Firezone architecture, responsible for securely routing traffic between Clients and Resources. Gateways are lightweight, written in Rust, and run on any Linux host.
A Gateway holds no long-term state and is configured entirely from the admin portal — it authenticates with a token, connects outbound to the Firezone control plane, and establishes encrypted WireGuard tunnels directly to Clients.
Where to deploy Gateways
Ideally, Gateways should be deployed as close to the Resources they're serving as possible — in some cases, even on the same host. This ensures the lowest possible latency and highest possible throughput for Client connections.
When multiple Gateways are deployed within a Site, Firezone automatically selects the closest Gateway to route Client traffic based on the Client's geolocated IP address, minimizing latency. All Gateways and Resources in a Site must have unobstructed network connectivity to each other for automatic failover and load balancing to work correctly.
For production deployments, run at least three Gateways per Site for high availability during rolling upgrades. To get started, see Deploy Gateways for install guides and sizing guidelines.
Gateway tokens
A Gateway authenticates to the control plane with a single-owner token: a
token minted for exactly one Gateway when you deploy it from the admin portal.
The first Gateway process to connect with the token claims it, and while it's
connected no other process can connect with the same token. Because the token
itself identifies the Gateway, the FIREZONE_ID a Gateway reports serves only
as a telemetry hint.
Binding each token to a single Gateway keeps credentials scoped to a single host: a token can be rotated or revoked without affecting the other Gateways in the Site.
Before single-owner tokens, Gateways connected with a multi-owner token
shared by every Gateway in a Site and were distinguished by their FIREZONE_ID.
These legacy tokens continue to work but are deprecated. See
Manage Gateway tokens for rotating tokens and upgrading
Gateways from legacy tokens.
Need help? See all support options.