Skip to main content

​
What this is for

What to allow on your firewall for Guardway. Use the table for each part you run. Every connection is opened from your side; Guardway never connects into your network. Allow hosts by name, because Guardway’s hosts have no fixed IP addresses.

​
Self-hosted gateway

You run the gateway on your own host. Allow these on the gateway host:
  • Nothing needs to reach the gateway from the internet or from Guardway. The dashboard reaches it through the control plane.
  • Gateways installed before the regional hosts use api.guardway.ai and logs.guardway.ai instead. Your bundle’s .env shows which.
  • The bundle publishes Postgres on port 5432 on all interfaces. Block it from outside the host.
  • Give the host direct outbound HTTPS (a forward proxy isn’t supported) and exempt the Guardway hosts from TLS inspection.
  • Prompts go from your host straight to your providers. Guardway Cloud receives request metadata, guardrail events with a short redacted preview, and the text checked by Cloud-managed PII detection and Content moderation. Details are on Environment.

​
SaaS Gateway

Guardway runs the SaaS Gateway for you, so none of the self-hosted rules apply.
  • Requests pass through Guardway’s cloud (United States) on their way to your providers. Request logs are kept for 30 days.
  • Applications can reach it through a forward proxy. Idle connections close after 30 minutes.

​
Endpoint agent

The Guardway agent (gw-cli) on developer machines. Allow these on each machine:
  • A manual gw-cli upgrade also needs api.guardway.ai.
  • When an AI provider key (such as ANTHROPIC_API_KEY or OPENAI_API_KEY) is set on the machine, skill scans also call that provider. Turn this off with --no-llm or --air-gap.
  • The agent ignores proxy settings and trusts only public certificate authorities. Give machines direct HTTPS to these hosts and exempt them from TLS inspection.
  • To enforce through a self-hosted gateway, put it behind an HTTPS load balancer with a public name and a publicly trusted certificate.
  • The agent’s local ports (8788, 8789) listen on 127.0.0.1 only and need no firewall rule.

​
Dashboard users

Browsers need app.guardway.ai, api.us.guardway.ai, id.guardway.ai and scan.us.guardway.ai on port 443. Downloads also need *.s3.us-east-1.amazonaws.com (self-hosted gateway bundle) and 9caaea10bd4e26dd2f339e8b5dfc7a97.r2.cloudflarestorage.com (agent installers).

Requirements

Hardware and software for a self-hosted gateway.

SaaS Gateway

The gateway Guardway runs for you.

Endpoint AI Policy

Posture, gateway and telemetry settings for endpoint agents.

Privacy and Security

What Guardway stores and how it is protected.