Deploy Gateways

Gateways are the data plane of Firezone — they connect Clients to the Resources in a Site and route traffic securely between them. This section covers how to deploy them.

New to Firezone? Start with the Quickstart guide to stand up a basic deployment, then come back here to deploy production Gateways.

Before you begin

Review the sizing guidelines to choose a host, and the ports and protocols reference for any firewall rules.
In the admin portal, open Sites → <your Site> and click Deploy a gateway, which creates the Gateway and mints its single-owner token. Keep the token handy. The portal is app.firezone.dev for Firezone Cloud US and eu.app.firezone.dev for Firezone Cloud EU.
Gateways connect to Firezone Cloud US by default. For an account in Firezone Cloud EU, set FIREZONE_API_URL=wss://eu.api.firezone.dev on every Gateway. The deploy instructions in the EU admin portal include it, and each guide below shows where it goes.
For production, expect to deploy at least three Gateways per Site for high availability.

Choose an install method

Debian / Ubuntu — install from the Firezone APT repository.
systemd — a hardened service on any systemd-based distro.
Docker — run as a container (with a Docker Compose reference).
NixOS — declarative install via the first-party flake module.
Custom / standalone — run the binary directly.

To deploy Gateways as code on AWS, GCP, or Azure, see Automate your deployment. Once your Gateways are up, head to MDM Provisioning to roll the Client out to your team.

Need help? See all support options.