Sending internet traffic through your own gateway

Make a group's internet traffic leave from one public address you control: test it on one device, then roll it out. About 45 minutes.

What you will achieve

The internet traffic of the people you choose leaves from one public address you control, wherever they work.

By the end, one test device reaches the internet from your gateway's address, and a device outside the group still uses its own.

When to use this

Use this when all internet traffic of a group of people has to leave from one place:

A partner only accepts connections from addresses on its allow list.
Your company requires internet traffic to pass one point where you can log and inspect it.
People often work on public Wi-Fi, and their traffic should leave from the company's address rather than the café's.

All traffic, or only a few services?

If only a few services need the fixed address, such as a partner's API or a bank portal, do not send everything through a gateway. Publish just those services as resources routed by the gateway machine and let everything else leave locally; that also works with the macOS and Windows apps. See targeted resources instead of a default route.

What you need

The rows marked Required are enough for the first test device.

	What	Why
Required	The Owner or Admin role in the dashboard	A Network Admin can do the rest, but cannot create the enrollment key or set a member's groups
Required	A Linux VM with a static public IPv4 address, root on it, and a firewall or security group that lets it reach the internet	It becomes `gateway-fra1` and sends everyone's traffic out. It must be Linux: only there does the agent switch on IP forwarding. `--block-lan-access` covers only the subnets on the gateway's own network interfaces; Where to run the gateway says how to keep it away from everything else
Required	A test device, installed and connected: a phone with the SXAccess app (iOS or Android), or a computer with the CLI agent (Linux or macOS)	The macOS and Windows apps do not use Internet gateways yet: their traffic keeps leaving through the local connection
Optional	A second device that stays outside the group	Proves the gateway applies only to the group
Optional	The people who will use it	Start with one device; add them in step 8
Advanced	A second Linux VM like the first	Becomes `gateway-fra2`, for failover in step 9

Before you start

The test device sends its internet traffic through the tunnel to gateway-fra1, and the internet sees the gateway's address.

What a default route changes

An Internet gateway is a route to 0.0.0.0/0, every IPv4 address on the internet. A device that receives it sends all its internet traffic into the tunnel, and the gateway sends it on from its own public address. Traffic to other SXAccess devices and to your private networks keeps its own path.

A device uses the gateway as soon as it receives it, unless someone has switched it off on that device. Nobody is asked first, and most people only notice when something is slow. That is why this guide starts with one test device.

Setup

1
Create the two groups
People › Groups › Create group. Type the name, then press Create group. Do it twice:
- internet-gateway - the gateway machine. This group becomes the gateway's Access Group.
- gateway-pilot - the devices whose internet traffic goes through the gateway. For now, only the test device.
Why: the gateway and its access rule name groups, so they stay correct when machines and people change.

You see: two new groups, both empty.
2
Create an enrollment key for the gateway
Access › Enrollment keys › Create enrollment key:
- Name - gateway-fra1.
- Make this key reusable - off. One machine.
- Expires in - 1 day.
- Temporary devices - off, or the gateway is removed after 10 minutes offline.
- Auto-assigned groups - internet-gateway.
Then press Create enrollment key.

Why the group: it puts the VM in internet-gateway as it joins, and the access rule in step 6 names that group.

You see: Enrollment key created successfully! and the key, with a warning that it will not be shown again. Copy it now.
3
Install the agent on the gateway VM
The key goes into a file, not onto the command line where the shell history would keep it. Run the block in bash or zsh, as root. Paste the whole block and press Enter once. When Enrollment key: appears, paste the key, and only the key, and press Enter. The key is not shown, and an empty line asks again. The key file is removed at the end, whether or not the join worked. If you stop the block with Ctrl-C, remove it with rm -f /run/secrets/sxaccess-key.

--block-lan-access covers only the subnets on the gateway's own network interfaces; Where to run the gateway says how to keep it away from everything else.

IP forwarding needs nothing from you: the agent switches it on itself.

You see: This device is now connected. Under Devices, open gateway-fra1 and note its Public IP: the address the internet will see for every device that uses the gateway.
shell
```
curl -fsSL https://pkgs.sxaccess.com/install.sh | sh{  install -d -m 700 /run/secrets  install -m 600 /dev/null /run/secrets/sxaccess-key  KEY=''  until [ -n "$KEY" ]; do printf 'Enrollment key: '; read -rs KEY || break; echo; done  [ -n "$KEY" ] && printf '%s' "$KEY" > /run/secrets/sxaccess-key && unset KEY &&    sxaccess start --enrollment-key-file /run/secrets/sxaccess-key --hostname gateway-fra1 --block-lan-access &&    sxaccess info  rm -f /run/secrets/sxaccess-key}
```
4
Put one test device in gateway-pilot
Only one device, and it must be a phone with the SXAccess app or a computer with the CLI agent. Give it the group in one of two ways:
- Just this device: Devices › the device › Assigned groups, add gateway-pilot, then press Save changes.
- Every device of one person: People › Members › the person › Access, add gateway-pilot to Auto-assigned groups, then press Save Changes. Group propagation moves every device the person already has, so use it only for someone whose one device is the test device.
Why only one: once step 6 is saved, this device's internet traffic moves to the gateway at once.

You see: gateway-pilot among the device's groups under Devices.
5
Create the Internet gateway
Networks › Internet gateways › Add Internet gateway. Start here, not from the device: only this way does the dashboard open the access rule for you in step 6. The sheet has four screens:
- Route - under Routing Device, pick gateway-fra1, then press Continue.
- Groups - Applies to: gateway-pilot, never All, which holds every device. Access Groups (optional): internet-gateway. Then press Continue, which stays greyed out until Applies to has a group. This screen has no Back: to pick another machine, press Cancel and start again.
- Name - Network Identifier: internet-fra1. It is the ID that sxaccess reach uses, so keep it short, without spaces and no longer than 40 characters. Then press Continue.
- Settings - leave Enable Route on and Metric at 9999; the metric only matters once a second machine carries the gateway. Then press Add Internet Gateway.
There is no masquerade switch: a gateway always masquerades, because the traffic has to leave from its own address.

Why Access Groups: with them, the gateway forwards only what an access rule to internet-gateway allows. Without them, it forwards everything the devices send, to any address it can reach.

You see: internet-fra1 on the Internet gateways tab, and an access rule sheet opening by itself.
6
Save the access rule the dashboard opens
The sheet that opens after Add Internet Gateway is the access rule, already filled in: Allow gateway-pilot to reach internet-gateway over any protocol, One-way. It is titled Edit access rule, but the rule does not exist until you save it.
- Access rule name - filled in as internet-fra1 access rule. Rename it after its intent, such as Pilot devices use the Internet gateway.
- over - keep any protocol. The gateway forwards for these devices only what this rule allows, so a narrower rule cuts off the rest of their internet traffic. The rule also opens every port on gateway-fra1 itself to them. Anything listening on the VM, SSH included, becomes reachable from those devices; keep such services to a minimum.
Then press Save access rule.

Why: a device receives the gateway only when an access rule connects it with the gateway machine. Closed the sheet too early? Create the same rule under Access › Access rules › Create access rule, and finish with Create access rule.

You see: the dashboard moves to Access › Access rules, where your rule is switched on and marked All ports · TCP + UDP. The page warns that it opens every port; for this rule, that is intended.
7
Check it on the test device
Before anyone else gets the gateway, run the checks under Verify on the test device.

Why now: one device is quick to undo; a whole team is not.

You see: the test device's traffic leaving from gateway-fra1's Public IP, and a device outside gateway-pilot keeping its own address.
8
Widen it
Once the test device passes, add people. The quickest way is to put them in gateway-pilot through their Auto-assigned groups, as in step 4. For the long run, use a group named after them, such as field-staff:
1. Create field-staff as in step 1. Add it to each person's Auto-assigned groups, then press Save Changes.
2. On the Internet gateways tab, open the internet-fra1 row and choose Edit in the menu of the gateway-fra1 entry. Add field-staff to Applies to, then press Save Changes.
3. Under Access › Access rules, open the rule from step 6, add field-staff to its source, then press Save access rule.
Why both places: Applies to decides who gets the gateway, and the rule decides who may use it. A group in only one of them gets nothing.

You see: field-staff in the Applies to column of the gateway-fra1 entry. Each device switches the moment it gets the group, so widen in batches and watch the VM's load: see sizing a gateway.
9
Add a second gateway machine
So that one machine going down does not cut people off:
1. Enrol gateway-fra2 as in steps 2 and 3. It needs a new key with internet-gateway under Auto-assigned groups, because the first key could be used only once. In the block from step 3, change only gateway-fra1 to gateway-fra2, and keep --block-lan-access.
2. On the Internet gateways tab, press Add Device in the Failover column of the internet-fra1 row. In Add routing device, pick gateway-fra2 and set Applies to and Access Groups (optional) exactly as for the first machine: gateway-pilot (and field-staff, if you added it) and internet-gateway. Then press Add Route. The form starts empty, and other groups here would change who gets the gateway whenever it fails over.
3. Both machines now have Metric 9999. Choose Edit on each entry and open the Settings tab of the Update internet-fra1 sheet. Give the preferred machine the lower Metric, for example 100 for gateway-fra1 and 200 for gateway-fra2, then press Save Changes.
You see: 2 Device (s) in the Failover column. When the preferred machine stops answering, devices move to the other; connections that were open break, because the address they leave from changes. Redundancy explains how each device chooses.

Verify

Test from a different network than the gateway's, such as mobile data on a phone. Two devices that share one way out to the internet already show the same public address, so the test would prove nothing.

Expected result

On the test device, open any website that shows your public address. It must show gateway-fra1's Public IP from step 3. On a computer without a browser, fetch such a page with curl.

On a phone: Resources lists internet-fra1, marked as an Internet gateway, with its switch on. See iOS and Android.
With the CLI agent: run the two commands below. sxaccess reach list shows internet-fra1 with network: 0.0.0.0/0 and state: Selected. In sxaccess info -d, the entry for gateway-fra1 shows Reaches: 0.0.0.0/0, and its Transferred figures grow as you browse.
In the dashboard: under Devices, gateway-fra1 has a signpost icon next to its name. Point at it, and a note starting This device is an internet gateway. appears. Only Owners and Admins see the icon.

shell - on the test device with the CLI agent

sxaccess reach listsxaccess info -d

Then check the half that must not change

On a device not in gateway-pilot, the same website still shows that device's own address. Its Resources screen does not list internet-fra1, and sxaccess reach list shows no 0.0.0.0/0.

Take one device out, and back in

On a phone, switch internet-fra1 off on Resources. Switching it on again asks first: Route all traffic through internet-fra1? and Route all traffic on an iPhone, Use internet-fra1 for Internet traffic? and Enable Internet Gateway on Android. Select all never switches a gateway on, and Android uses one gateway at a time.

With the CLI agent, run the first command below to take the device out. It prints The networks are no longer selected., and the website shows the device's own address again. The second command puts it back and prints The networks are now selected.; with -a, the device's other networks stay selected.

shell - take the test device out of the gateway

sxaccess reach remove internet-fra1

shell - put it back, keeping its other networks

sxaccess reach add -a internet-fra1

Troubleshooting

Top to bottom. The first three cover most cases.

Ask	If no	Where
Is the test device a phone with the SXAccess app, or a computer with the CLI agent?	The macOS and Windows apps list the gateway under Resources but do not route through it yet, even if its switch shows as on; their traffic keeps leaving locally. Test with a phone or the CLI agent.	The test device
Does the test device list `internet-fra1`, on Resources or in `sxaccess reach list`?	It has not received the gateway. Under Devices, check that it is in `gateway-pilot` and that `gateway-fra1` is in `internet-gateway`; without that group, the rule connects the device with nothing. Then check that the access rule from step 6 exists and is switched on, and that the `gateway-fra1` entry is Active.	Devices, Access rules, Internet gateways
Is it switched on (with the CLI agent, `state: Selected`)?	On a phone, switch it on and confirm. On Android, turn Private DNS off first (Settings › Network & internet › Private DNS); until then the gateway cannot start, and the app says why. With the CLI agent, run `sxaccess reach add -a internet-fra1`.	The test device
Does the internet still work on the test device?	Is `gateway-fra1` online under Devices? Can the VM itself reach the internet, past its firewall or security group? Does the rule still say any protocol? The gateway forwards only what it allows. To give people their own connection back meanwhile, switch off Active on the gateway's entries.	Devices, the VM, Access rules
Does the site have an IPv4 address?	Only IPv4 goes through the gateway, and IPv6 internet traffic does not work while a device uses it, so a site reachable only over IPv6 does not load. Switch the gateway off on that device to reach it.	The test device
Do the devices stay out of the VM's network?	If they reach a subnet on the VM's own network interfaces, it joined without `--block-lan-access`: on `gateway-fra1`, run `sxaccess stop && sxaccess start --block-lan-access`. Run it as one line: a connection that goes through SXAccess, such as an SSH session to this machine, drops until `start` has finished. It does not work in a session opened with `sxaccess shell`: stopping the agent closes that session and ends the command, so use the console or an OpenSSH session. The devices that use it lose the internet for those seconds. `--block-lan-access` covers only the subnets on the gateway's own network interfaces; Where to run the gateway says how to keep it away from everything else.	A terminal on the VM
Is it fast enough?	A gateway carries all the internet traffic of its devices. Watch the VM's network throughput and CPU, give it more, or add a second machine as in step 9.	Sizing
Still stuck?	Take the connection apart one stage at a time.	Trace a blocked connection

Advanced configuration

None of this is needed for a working setup.

Turn it off at once

On the Internet gateways tab, open the internet-fra1 row and switch off Active on each machine's entry. Every device goes back to its own connection; switch the entries on again to undo it. To take one group out instead, choose Edit on each entry and remove the group from Applies to.

Remove it

Choose Delete in the menu of the internet-fra1 row and confirm Delete network 'internet-fra1'?. Then delete the access rule from step 6 and, if nothing else uses them, the two groups. The agent does not switch IP forwarding off again: run sudo sysctl -w net.ipv4.ip_forward=0 on the VM, or reboot it.

A device group instead of single machines

On the Route screen, Device group takes one group whose machines all carry the gateway. They share one metric, so none is preferred, and the Failover column offers Go to Devices instead of Add Device.

Starting from the device

The same sheet, without the Route screen, also opens from the device. Use Set Up Internet Gateway in its menu under Devices, or Make this an Internet gateway under Routes on its page (Add Internet gateway once it is one). Neither opens the access rule afterwards: create it yourself, as in step 6. The Network Identifier is then filled in as Internet Gateway (gateway-fra1); replace it with a short ID without spaces.

Only a few services need the fixed address

Then you need no default route: publish just those services as resources routed by the gateway machine. See targeted resources.

Internet gatewaysThe reference: every setting, and which devices use a gateway.Read more Route private networksHow a device chooses between routing devices.Read more Access rulesEverything a rule can say.Read more iOS and AndroidWhere people see the gateway and switch it on or off.Read more