What Is a Gateway? Difference from a Router and the Types

Short answer: A gateway is the crossing point where one network talks to another. The "default gateway" in your computer's network settings is the device packets are sent to for every address outside your own subnet, and in practice that is a router. The word is not limited to that: devices that translate between protocols, servers that pass API traffic through a single point, and the entry doors for VPN and email traffic are called gateways too. The common thread is the same: a single, controlled passage between two worlds.

What is a gateway?

As a networking term, a gateway is the node that traffic leaving one network passes through to reach another. According to Wikipedia, the default gateway is the node in a network using the Internet protocol suite to which packets are forwarded when no other route is defined for the destination; in a home or small office that device is the router that contains the DSL or cable modem. The decision mechanism is simple: the device checks with the subnet mask whether the destination is inside its own subnet; if it is, the packet is sent directly, if not, it is handed to the default gateway and the gateway knows the rest.

That is why a good share of "no internet" complaints are really gateway problems: there is an IP address, but the gateway setting is wrong or the gateway device is unreachable.

Gateway versus router

The two are often the same box, but the concepts differ:

• A router is the device that forwards packets between networks; it consults its routing table and picks the best path. Details are in the router article.
• A gateway is the role of being a network's exit point. A router can take that role, so can a firewall, and so can a dedicated device that translates protocols.

In an enterprise network the default gateway is usually the layer 3 interface of the core switch or the firewall; traffic between VLANs passes through that point too, and NAT is mostly done there.

Types of gateway

• Default gateway: The meaning above; the address written in every device's settings.
• Protocol gateway: Translates between two different protocols. The VoIP gateway in the voice world (between the telephone network and the IP network), Modbus and OPC gateways in industrial settings and IoT gateways belong to this class.
• API gateway: Receives the requests to the APIs an application exposes at a single point; authentication, rate limiting, routing and logging happen here. It is the front door of a microservice architecture.
• VPN gateway: The device where remote-access and site-to-site encrypted tunnels terminate; details in the VPN article. Because it faces the internet, it is one of the doors attackers target most.
• Email gateway: The spam, phishing and malicious-attachment filter in front of the mail server; the entry and exit door of mail flow.
• Web gateway (secure web gateway): The layer that filters users' access to the internet, working on the proxy principle.
• Payment gateway: The service that passes card data securely to the bank in e-commerce; not a networking term, but the same "controlled passage" logic.

Why the gateway is a security boundary

Because all traffic passes through a single point, the gateway is where policy is enforced: which network may talk to which, which ports are open, which users may go out. That is why, in enterprise design, the default gateway is often the firewall itself. For the same reason the gateway is a single point of failure: one device without redundancy can take the whole network down and is also the attacker's first target. Internet-facing VPN and API gateways are among the systems whose patch window must be kept shortest; we explain why in the exploit article.

How to diagnose gateway problems

• If the device has an IP address but no internet, ping the gateway address first; no reply means the problem is in the local network or the gateway device.
• If the gateway replies but external addresses do not open, the next suspects are DNS and NAT.
• If some sites are reachable and others are not, look at the routing table or the firewall policy.
• For access problems from a remote branch, check the VPN gateway's tunnel state and the routes at both ends.

On the enterprise side

The design, redundancy and change management of core switches, firewalls and VPN gateways is the subject of our network and traffic engineering service; segmentation and zero-trust policy are on the network security page.

Frequently asked questions

What does gateway mean? A controlled crossing point where one network exits to another. The default gateway in a device's settings is the router that packets to external addresses are handed to.

What is a default gateway? The address a device sends packets to for every destination outside its own subnet; usually the inside interface of that network's router or firewall.

Are a gateway and a router the same thing? Usually the same device, but router describes the forwarding job and gateway describes the role of being the network's exit point; a firewall can be a gateway too.

What is the difference between a gateway and a modem? A modem converts the line's signal into digital data; a gateway provides passage between networks. Most home devices combine the two in one box.

What does an API gateway do? It receives requests to application interfaces at a single point: authentication, rate limiting, routing and logging; the front door of microservices.

How do I find my gateway address? ipconfig on Windows, ip route or netstat -rn on macOS and Linux show the default gateway.

Sources

• Wikipedia, Default gateway: definition, relationship to the router, forwarding of off-subnet destinations to the gateway
• How we run this layer: network and traffic engineering, network security