Types of Gateway Connections in a Service Mesh

Service-to-service traffic between Consul datacenters

Mesh gateways enable routing of service mesh traffic between different Consul datacenters. Those datacenters can reside in different clouds or runtime environments where general interconnectivity between all services in all datacenters isn't feasible. One scenario where this is useful is when connecting networks with overlapping IP address space.

These gateways operate by sniffing the SNI header out of the mTLS connection and then routing the connection to the appropriate destination based on the server name requested.

As of Consul 1.8.0, mesh gateways can also forward gossip and RPC traffic between Consul servers. This is enabled by WAN federation via mesh gateways.

As of Consul 1.14.0, mesh gateways can route both data-plane (service-to-service) and control-plane (consul-to-consul) traffic for peered clusters. See Mesh Gateways for Peering Control Plane Traffic

For more information about mesh gateways, review the complete documentation and the mesh gateway tutorial.

Traffic from outside the Consul service mesh to services in the mesh

Ingress gateways are an entrypoint for outside traffic. They enable potentially unauthenticated ingress traffic from services outside the Consul service mesh to services inside the service mesh.

These gateways allow you to define what services should be exposed, on what port, and by what hostname. You configure an ingress gateway by defining a set of listeners that can map to different sets of backing services.

Ingress gateways are tightly integrated with Consul's L7 configuration and enable dynamic routing of HTTP requests by attributes like the request path.

For more information about ingress gateways, review the complete documentation and the ingress gateway tutorial.

Traffic from services in the Consul service mesh to external services

Terminating gateways enable connectivity from services in the Consul service mesh to services outside the mesh. Services outside the mesh do not have sidecar proxies or are not integrated natively. These may be services running on legacy infrastructure or managed cloud services running on infrastructure you do not control.

Terminating gateways effectively act as egress proxies that can represent one or more services. They terminate service mesh mTLS connections, enforce Consul intentions, and forward requests to the appropriate destination.

These gateways also simplify authorization from dynamic service addresses. Consul's intentions determine whether connections through the gateway are authorized. Then traditional tools like firewalls or IAM roles can authorize the connections from the known gateway nodes to the destination services.

For more information about terminating gateways, review the complete documentation and the terminating gateway tutorial.