2020-07-24 21:07:36 +00:00
---
layout: docs
2022-09-13 20:48:39 +00:00
page_title: Gateway Types
2020-07-24 21:07:36 +00:00
description: >-
2022-09-16 15:28:32 +00:00
Ingress, terminating, and mesh gateways are proxies that direct traffic into, out of, and inside of Consul's service mesh. Learn how these gateways enable different kinds of service-to-service communication.
2020-07-24 21:07:36 +00:00
---
2022-09-13 20:48:39 +00:00
# Types of Gateway Connections in a Service Mesh
2020-07-24 21:07:36 +00:00
2022-08-26 05:49:29 +00:00
~> **Note**: The features shown below are extensions of Consul's service mesh capabilities. If you are not utilizing
2020-07-24 21:07:36 +00:00
Consul service mesh then these features will not be relevant to your task.
## Service-to-service traffic between Consul datacenters
2020-12-08 23:24:36 +00:00
2020-07-24 21:07:36 +00:00
-> **1.6.0+:** This feature is available in Consul versions 1.6.0 and newer.
Mesh gateways enable routing of service mesh traffic between different Consul datacenters. Those datacenters can reside
in different clouds or runtime environments where general interconnectivity between all services in all datacenters
isn't feasible. One scenario where this is useful is when connecting networks with overlapping IP address space.
These gateways operate by sniffing the SNI header out of the mTLS connection and then routing the connection to the
2022-11-14 20:03:17 +00:00
appropriate destination based on the server name requested.
2020-07-24 21:07:36 +00:00
2020-12-08 23:24:36 +00:00
As of Consul 1.8.0, mesh gateways can also forward gossip and RPC traffic between Consul servers.
2022-01-10 23:36:16 +00:00
This is enabled by [WAN federation via mesh gateways](/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways).
2020-07-24 21:07:36 +00:00
2022-11-14 20:03:17 +00:00
As of Consul 1.14.0, mesh gateways can route both data-plane (service-to-service) and control-plane (consul-to-consul) traffic for peered clusters.
See [Mesh Gateways for Peering Control Plane Traffic](/docs/connect/gateways/mesh-gateway/peering-via-mesh-gateways)
For more information about mesh gateways, review the [complete documentation](/docs/connect/gateways/mesh-gateway)
2022-09-06 15:35:01 +00:00
and the [mesh gateway tutorial](https://learn.hashicorp.com/tutorials/consul/service-mesh-gateways).
2020-07-24 21:07:36 +00:00
## Traffic from outside the Consul service mesh to services in the mesh
2020-12-08 23:24:36 +00:00
2020-07-24 21:07:36 +00:00
-> **1.8.0+:** This feature is available in Consul versions 1.8.0 and newer.
Ingress gateways are an entrypoint for outside traffic. They enable potentially unauthenticated ingress traffic from
2020-12-08 23:24:36 +00:00
services outside the Consul service mesh to services inside the service mesh.
2020-07-24 21:07:36 +00:00
These gateways allow you to define what services should be exposed, on what port, and by what hostname. You configure
an ingress gateway by defining a set of listeners that can map to different sets of backing services.
2022-08-26 05:49:29 +00:00
Ingress gateways are tightly integrated with Consul's L7 configuration and enable dynamic routing of HTTP requests by
2020-07-24 21:07:36 +00:00
attributes like the request path.
2020-08-17 16:19:04 +00:00
For more information about ingress gateways, review the [complete documentation](/docs/connect/gateways/ingress-gateway)
2022-09-06 15:35:01 +00:00
and the [ingress gateway tutorial](https://learn.hashicorp.com/tutorials/consul/service-mesh-gateways).
2020-07-24 21:07:36 +00:00
## Traffic from services in the Consul service mesh to external services
2020-12-08 23:24:36 +00:00
2020-07-24 21:07:36 +00:00
-> **1.8.0+:** This feature is available in Consul versions 1.8.0 and newer.
Terminating gateways enable connectivity from services in the Consul service mesh to services outside the mesh.
Services outside the mesh do not have sidecar proxies or are not [integrated natively](/docs/connect/native).
These may be services running on legacy infrastructure or managed cloud services running on
infrastructure you do not control.
Terminating gateways effectively act as egress proxies that can represent one or more services. They terminate Connect
mTLS connections, enforce Consul intentions, and forward requests to the appropriate destination.
2022-08-26 05:49:29 +00:00
These gateways also simplify authorization from dynamic service addresses. Consul's intentions determine whether
2020-07-24 21:07:36 +00:00
connections through the gateway are authorized. Then traditional tools like firewalls or IAM roles can authorize the
connections from the known gateway nodes to the destination services.
2020-08-17 16:19:04 +00:00
For more information about terminating gateways, review the [complete documentation](/docs/connect/gateways/terminating-gateway)
2023-01-18 01:18:04 +00:00
and the [terminating gateway tutorial](https://learn.hashicorp.com/tutorials/consul/terminating-gateways-connect-external-services).
2020-07-24 21:07:36 +00:00
