Infisical Gateways enables secure communication between your private resources and the Infisical platform without exposing inbound ports in your network. This guide covers everything you need to deploy and configure Infisical Gateways.

​
Deployment Steps

To successfully deploy an Infisical Gateway for use, follow these steps in order.
1

Provision a Machine Identity

Create a machine identity with the correct permissions to create and manage gateways. This identity is used by the gateway to authenticate with Infisical and should be provisioned in advance. The gateway supports several machine identity auth methods, as listed below. Choose the one that best fits your environment and set the corresponding environment variables when deploying the gateway.
2

Set Up a Relay Server

Ensure a relay server is running and accessible before you deploy any gateways. You have two options:
  • Managed relay (Infisical Cloud, US/EU only): Managed relays are only available for Infisical Cloud instances in the US and EU regions. If you are using Infisical Cloud in these regions, you can use the provided managed relay.
  • Self-hosted relay: For all other cases, including all self-hosted and dedicated enterprise instances of Infisical, you must deploy your own relay server. You can also choose to deploy your own relay server when using Infisical Cloud if you require reduced geographic proximity to your target resources for lower latency or to reduce network congestion. For setup instructions, see the Relay Deployment Guide.
3

Install the Infisical CLI

Make sure the Infisical CLI is installed on the machine or environment where you plan to deploy the gateway. The CLI is required for gateway installation and management.See the CLI Installation Guide for instructions.
4

Configure Network & Firewall

Ensure your network and firewall settings allow the gateway to connect to all required services. All connections are outbound only; no inbound ports need to be opened.
ProtocolDestinationPortPurpose
TCPRelay Server IP/Hostname2222SSH reverse tunnel establishment
TCPInfisical instance host (US/EU, other)443API communication and certificate requests
For managed relays, allow outbound traffic to the provided relay server IP/hostname. For self-hosted relays, allow outbound traffic to your own relay server address.If you are in a corporate environment with strict egress filtering, ensure outbound TCP 2222 to relay servers and outbound HTTPS 443 to Infisical API endpoints are allowed.
5

Select a Deployment Method

The Infisical CLI is used to install and start the gateway in your chosen environment. The CLI provides commands for both production and development scenarios, and supports a variety of options/flags to configure your deployment.To view all available flags and equivalent environment variables for gateway deployment, see the Gateway CLI Command Reference.
For production deployments on Linux servers, install the Gateway as a systemd service so that it runs securely in the background and automatically restarts on failure or system reboot:
sudo infisical gateway systemd install --token <your-machine-identity-token> --domain <your-infisical-domain> --name <gateway-name> --relay <relay-name>
sudo systemctl start infisical-gateway
The systemd install command requires a Linux operating system with root/sudo privileges.
6

Verify Your Gateway Deployment

After deployment, verify your gateway is working:
  1. Check logs for “Gateway started successfully” message indicating the gateway is running and connected to the relay
  2. Verify registration in the Infisical by visiting the Gateways section of your organization. The new gateway should appear with a recent heartbeat timestamp.
  3. Test connectivity by creating a resource in Infisical that uses the gateway to access a private service. Verify the resource can successfully connect through the gateway.

​
Frequently Asked Questions