Skip to main content
The Gateway is deployed inside your private network, alongside the resources Infisical needs to reach. Infisical never touches those resources directly. It sends every request through the Gateway, which forwards it to the database or internal API on the other side. There are two ways the Gateway and Infisical reach each other, and they differ in one thing: which side opens the connection. Both carry the same mutually authenticated TLS between Infisical and the Gateway, with certificates issued by your organization’s own certificate authorities. In relay mode the relay routes bytes without holding the keys to read them.
Direct listen is only available on self-hosted Infisical.

​
Relay mode

On the Gateway host, allow outbound access only:
  • TCP 2222 to the relay server (managed relay IP/hostname, or your self-hosted relay’s address)
  • TCP 443 to the Infisical instance host (app.infisical.com for US, eu.infisical.com for EU, or your self-hosted domain)
No inbound rules are required. With the default Auto Select Relay option there is no single relay address to allowlist, since the gateway may fail over between managed relays. See Which relay address do I need to allowlist? below for the endpoints to include and how to pin to a single relay.

​
Self-hosted relay (optional)

If you run a self-hosted relay, that host needs:
  • Inbound TCP 2222 from your gateways (SSH reverse tunnels)
  • Inbound TCP 8443 from the Infisical instance host (platform to relay)
  • Outbound TCP 443 to the Infisical instance host (relay API + certificates)

​
Direct listen mode

On the Gateway host, allow:
  • Inbound access on the port you set with --listen-address, from the Infisical instance host only
  • Outbound TCP 443 to the Infisical instance host
The listen address is the one Infisical dials, and it’s written into the Gateway’s server certificate, so it has to be stable. An internal DNS name or a load balancer in front of the Gateway both work. Changing it means updating --listen-address and restarting the Gateway, so it’s issued a certificate for the new address. By default the Gateway binds the port from --listen-address on every interface. To bind somewhere else, such as one interface or a different local port behind a load balancer, pass --bind as well.

​
Frequently asked questions

In relay mode, no. The Gateway makes only outbound connections (TCP 2222 to the relay and TCP 443 to the Infisical API), and the platform reaches it back over that same tunnel.In direct listen mode, yes. The Gateway accepts inbound connections on the port you set with --listen-address, and that port needs to be open to the Infisical instance host. Scope the rule to that host rather than opening the port broadly.
Use direct listen when Infisical can already reach the Gateway host at a stable address, which is the common case when you self-host Infisical in the same network as your resources.Use relay mode when the Gateway sits behind NAT or a firewall you can’t open, when you’re on Infisical Cloud, or when PAM CLI users connect from outside the Gateway’s network. See Gateway deployment for the full comparison.
No. Depending on the target resource, the Gateway forwards either raw TCP or HTTP. Most resources (for example databases like PostgreSQL on 5432) are proxied as raw TCP, while resources such as Kubernetes are reached over HTTP forwarding. In both cases the Gateway connects to the resource on its own port inside your private network.
With the default Auto Select Relay, the Gateway may connect to, and fail over between, any managed relay Infisical operates for your region, so a strict outbound TCP 2222 allowlist must include every managed relay endpoint. You can find these under Organization Settings → Networking, or ask Infisical support. To allowlist a single address instead, pin the Gateway to one relay at enrollment with the --target-relay-name option; this removes automatic failover to other relays.
Not currently. In relay mode, the Gateway’s connection to the relay is a raw SSH tunnel over TCP (port 2222), and its connection to the Infisical API is TLS over TCP (port 443). Neither is HTTP, so an HTTP forward proxy can’t transparently carry this traffic.If an HTTP proxy is mandatory in your environment, you have two options:
  • Allow the Gateway’s outbound rules (TCP 2222 and TCP 443) to bypass the proxy for the relay and Infisical endpoints.
  • Deploy a self-hosted relay inside your own network so the TCP 2222 tunnel stays internal and only TCP 443 needs to leave. The Infisical platform must still reach that relay on inbound TCP 8443, so the relay needs a network path from the platform (a public or forwarded 8443 endpoint); this only removes all external egress when you also self-host the Infisical platform in the same network.