Gateway
A gateway is a small locked virtual machine that does two jobs:
- Egress. Subnets attached to it reach the internet, leaving from your organisation’s public address.
- Zero Trust (optional). The gateway joins a Tailscale-style network and advertises your private subnets, so your laptop reaches private addresses directly — with nothing published to the internet.
Without a gateway, a private subnet has no internet access at all. Not slow, not filtered — none. That is the default, and it is intentional.
Why egress leaves from your address
Section titled “Why egress leaves from your address”Shared outbound NAT means your reputation is your neighbour’s reputation. When someone else on the platform gets an address blocklisted, your traffic is blocked too.
Here, outbound traffic from your subnets carries your organisation’s own public address. Abuse is attributable to whoever caused it, and the platform’s addresses stay clean.
What runs underneath
Section titled “What runs underneath”| Function | Technology |
|---|---|
| Base | Ubuntu 24.04, locked — no SSH daemon, no login shell, no user accounts |
| Egress | iptables — MASQUERADE on the public interface, FORWARD default deny with explicit accepts |
| Zero Trust | Tailscale, joined with a one-time key you paste from your own coordination server |
| Configuration | Applied at each boot by a small script; the VM converges rather than being configured once |
| Identity | SMBIOS bootstrap token exchanged for a device identity — see Appliances |
The default-deny forwarding policy is worth noting: a gateway forwards only what it was told to forward. Two private networks sharing one gateway still cannot reach each other.
Creating one
Section titled “Creating one”Ağ → Ağ Geçidi → Kur (Network → Gateway → Install). You choose:
- Ad (Name).
- Çıkış alacak subnet’ler (Subnets to give egress) — the gateway takes one leg in
each.
datatier subnets are not listed; they cannot have egress. - Public IP — which of your free addresses becomes the egress address. Leave it on the automatic choice or pick one deliberately.
- Zero Trust (optional) — paste the “Add device” command from your coordination server. The key is used once and not stored.
Preconditions
Section titled “Preconditions”| Requirement | Failure if missing |
|---|---|
| One free public address allocated to your organisation | The form says so and the button is disabled |
At least one non-data subnet in the region | Nothing to attach |
If the panel says you have no free address while the Public IP screen shows one, the address is probably attached to something already — an attached address is not free.
Adding and removing subnets later
Section titled “Adding and removing subnets later”Open the gateway and attach or detach subnets. Each attachment adds a leg and the routes that make it work; servers in that subnet pick up the route without being restarted, and new servers get it at boot.
Zero Trust
Section titled “Zero Trust”Turning it on later is a single action on the gateway page — paste a fresh “Add device” command. Turning it off removes the machine from the network.
The gateway advertises your private subnets as routes. Once approved in your coordination server, any device on that network reaches your private addresses directly. This is the recommended way to administer machines: no public address, no exposed SSH port, nothing to scan.
The join key is used once and never stored. Losing it costs you nothing; generate another.
One gateway or several
Section titled “One gateway or several”One gateway per organisation per region is the common case, and subnets from different private networks may share it — they still cannot reach each other, because forwarding is default-deny and only the specific paths are allowed.
Separate gateways make sense when you want separate egress addresses for different environments.
Troubleshooting
Section titled “Troubleshooting”A server has no internet after attaching the gateway. Check that the server’s subnet is actually attached, and that the server has been rebooted or has picked up the route. The gateway’s own page lists each leg and its state.
The gateway itself has no internet. It needs a working public address; check the address is attached and that the pool’s own gateway is configured.
Zero Trust shows the device but routes do not work. Subnet routes must be approved in your coordination server. That approval is outside zone9 by design — it is your network’s policy decision, not the platform’s.
Limits
Section titled “Limits”- IPv4 only.
- No inbound port forwarding. The gateway is an exit, not an entrance; use a load balancer or a public address for inbound traffic.
- One public address per gateway.
datasubnets can never be attached.