Private web access · outbound connector · explicit grants
Open private web services securely from any browser.
Run one Gatehouse Connector on a server that can reach your private web application. Register the exact target, grant a named user access, and open it through Gatehouse without publishing the application or the surrounding network.
The complete path
Server. Connector. Authorized browser.
This is the whole Gatehouse model. Nothing is discovered automatically and no surrounding subnet becomes accessible.
You already have a web app
Gatehouse starts with an HTTP or HTTPS application that is reachable from one machine in your private network.
http://grafana:3000- No public DNS required
- No inbound firewall rule
- Exact host and port only
Run the connector beside it
Download the connector bundle, paste the one-time enrollment values from your workspace, and start the container.
docker compose up -d --build- Outbound WSS to the relay
- Credential stored locally
- Automatic reconnect
Open it through Gatehouse
Register that exact target, grant a named user access, and send the generated browser URL.
gatehousebox.com/access/…- Identity and expiry checked
- Methods explicitly allowed
- Immediate revocation
Step 02 · run it on your server
A connector bundle you can actually download and operate.
The bundle contains the .NET connector source, Dockerfile, Compose definition, environment template, and operating instructions. The connector enrolls once, stores its long-lived credential in a private Docker volume, and reconnects automatically.
- Required egress
- HTTPS/WSS to relay.gatehousebox.com
- Inbound ports
- None
- Private target
- One registered HTTP/HTTPS host and port
$ cp .env.example .env
$ docker compose up -d --build
enrolled connector office-edge
tunnel connected · epoch 1842
service grafana:3000 reachable
Step 03 · open the private application
The visitor sees exactly what is being authorized.
Before Gatehouse starts a session, the access page names the organization, private service, signed-in identity, permitted HTTP methods, and expiry. The relay checks that authority again for every request stream.
Authorized by a time-bound Gatehouse grant
Operator console
One workspace for the entire access lifecycle.
Security model
Narrow authority, independently enforced.
Gatehouse is not a VPN or an unrestricted reverse proxy. It grants one identity access to one registered service under one explicit policy.
Only explicitly registered protocols, hosts, ports, paths, and methods are eligible.
The bootstrap token is exchanged once and cannot reconnect a connector.
The connector initiates the persistent encrypted connection. It exposes no public listener.
The relay rechecks durable state and denies subsequent streams as soon as authority is revoked.
Read what Gatehouse implements directly, inherits from its platforms, treats as compatibility guidance, or has not yet shipped.
Pricing
Free during public alpha.
Use the complete connector, service, grant, browser gateway, revocation, and audit flow without billing.
Alpha
Free- 1 organization
- 2 connectors
- 5 private services
- Temporary browser access
- Basic audit history
Professional
For operating teams- Expanded connector fleet
- Policy templates
- Longer audit retention
- Notifications and API access
MSP
For client operations- Multiple client organizations
- Delegated administration
- Customer branding
- Fleet-wide policy controls