What is a managed cloud gateway?

A managed cloud gateway is an upstream access layer operated by WZ-IT for selected web applications. It receives requests under a defined domain, terminates TLS and forwards them to the target through the agreed path. WZ-IT manages the gateway layer; the application and origin server are included only when they are covered by an additional agreement.

Is the cloud gateway a managed reverse proxy?

Yes. Its technical core is a reverse proxy operated by WZ-IT. The term cloud gateway describes the complete managed service covering provisioning, domain and TLS configuration, routing, monitoring, updates and documented integration with the existing environment.

Which applications and protocols can be connected?

The standard starting point is designed for browser-based applications and HTTP(S) targets. WebSockets and application-specific requirements can be considered after technical review. RDP, SSH, database access and full network access require a more appropriate secure-access, VPN or remote-desktop solution.

Does the internal server need a public IP address?

Not necessarily. Depending on the environment, the gateway can reach the target through a private tunnel, site-to-site connection or a tightly restricted public origin. The suitable approach depends on the location, firewall, existing connectivity and availability requirements.

How does this differ from a VPN or NetBird?

The cloud gateway exposes one selected web service through a defined endpoint. A VPN or NetBird connects users, devices, sites and private networks. Secure access is generally more suitable for administration or several internal services, and both approaches can be combined.

Are the domain and TLS certificate included?

Integration of an agreed hostname and provisioning and renewal of its TLS certificate on the gateway are part of the planned service scope. Registration, provider charges and administration of a new domain are itemised separately where required.

Are WAF and DDoS protection automatically included?

No. A reverse proxy is not automatically a web application firewall and does not replace penetration testing or dedicated DDoS protection. Access restrictions and technical protection components are assessed separately according to the actual risk.

What does the starting price of €129.90 per month cover?

The starting point is intended for a manageable standard configuration with a managed gateway layer, one defined hostname and HTTP(S) target, TLS, proactive 24/7 monitoring, updates, configuration backup and documentation. The final scope and price depend on factors including the connection, access model, traffic, logs, availability and additional infrastructure.

Can WZ-IT operate the published application as well?

Yes. Managed Open Source, Managed Servers, App Node or software maintenance can be added as appropriate. The cloud gateway remains a separate component so that responsibilities for access, infrastructure and application remain transparent.

Can the gateway be used within the Section 203 operating framework?

Yes, after assessment under the separate Section 203 Managed Cloud. Booking the standard gateway alone does not establish that operating and contractual framework. The application, data paths, participating infrastructure and required addenda are assessed together.

Managed cloud gateway and reverse proxy for internal applications

WZ-IT operates an upstream gateway layer that makes selected web applications available through a defined domain. Application servers, administration interfaces and internal networks do not have to be exposed directly to the public internet.

Request a cloud gateway Review the scope

Reviews

IT Beratung Service Consulting Soforthilfe

Companies worldwide trust WZ-IT

Read client reviews

Starting point

Suitable for clearly scoped web access

An internal or on-premises web application should be accessible to customers, partners or employees
The origin server or administration interface should not be exposed directly to the public internet
Domain, TLS and routing should be managed on an ongoing basis
An App Node, private server or cloud workload needs an upstream external endpoint
Browser access is required but full private network access is not

Controlled access

Make internal web applications accessible through a controlled external endpoint

The gateway separates the public entry point from the actual target system. Domain, TLS, routing and the agreed access path are brought together in one managed layer.

Defined endpoint
Users access a documented hostname that is assigned to one clearly scoped web application.
Separated origin
The target system remains behind the gateway and is reached only through the agreed network path.
Managed gateway layer
WZ-IT monitors the gateway service, maintains the system and proxy and manages the agreed TLS configuration.

Service scope

Have a reverse proxy managed without exposing the application server directly

The starting point is intended for one clearly scoped HTTP(S) web application. Target system, reachability, user group and protection requirements are confirmed before provisioning.

Included

Managed gateway instance
WZ-IT provides the upstream gateway layer and assumes responsibility for its technical operation.
Hostname and routing
A defined domain or subdomain is mapped to the agreed HTTP(S) target.
TLS certificate
Certificate provisioning, renewal and the agreed TLS configuration are managed on the gateway layer.
Network path to the target
A direct, restricted or private connection path is designed around the existing environment.
Monitoring and updates
Availability is monitored proactively 24/7. Security advisories, the operating system and proxy component are assessed and updated within the agreed scope.
Configuration backup
The gateway configuration required for recovery is backed up within the agreed scope. Application data remains separate.
Personal contact
Configuration, changes and technical findings are coordinated with a dedicated contact.

Service boundary

Operating the gateway does not automatically include operating the application

Hosting, maintenance, backup or troubleshooting of the published application without an additional operating scope
Full private network access for employees or administration without a VPN or secure-access solution
Web application firewall, penetration testing or dedicated DDoS and bot protection without a separate scope
Unlimited hostnames, target systems or protocols other than HTTP(S)
SSO, complex authorisation, long log retention or increased availability without technical assessment

Process

From an internal target system to a managed external endpoint

The application is only exposed after the target, network path, TLS, access rule and technical validation fit together.

01
Assess the application
Capture the target system, protocol, user group, domain and required reachability.
02
Define the connection
Choose the appropriate path between gateway and application and identify required firewall rules.
03
Configure the gateway
Set up and test the hostname, TLS, proxy rules and agreed access restrictions.
04
Enable and operate
Activate the endpoint in a controlled process, monitor and update it and document changes.

What we need for initial assessment

Requested domain or subdomain
Target system, protocol and current reachability
User group and requested access restrictions
Expected traffic and required log retention
Availability requirements and desired service level

Starting price

Managed Cloud Gateway from €129.90 excluding VAT per month

The starting point applies to a manageable standard configuration. Before proposing the service, we review the target system, connection, access, traffic and operating requirements.

The price is a starting point, not a flat rate for arbitrary applications or access models. Additional hostnames and targets, private tunnels, SSO, dedicated protection controls, traffic, log retention, setup and higher service levels are assessed transparently in the proposal.

All prices are net and exclude statutory VAT. The offers are addressed to businesses.

Managed service

Managed Cloud Gateway

For one clearly scoped external access path to an internal, local or otherwise non-public web application.

from €129.90 / monthexcluding VAT, monthly

Managed gateway and reverse-proxy layer
Defined hostname and HTTP(S) target
TLS provisioning and certificate maintenance
Proactive 24/7 monitoring of gateway availability
Security advisory, system and proxy maintenance
Backup of the relevant gateway configuration
Essential service level for the gateway layer
Documented configuration and a personal contact

Relevant additions

Keep the gateway, private access and application operations clearly separated

Depending on the user path, the gateway can be combined with local infrastructure, private secure access or a dedicated operating framework.

WZ-IT App Node

Run open-source and business applications on a managed local application server at your organisation.

View App Node

VPN & Secure Access

Connect private networks, administration access, sites and users through identity-based controls.

View Secure Access

Section 203 Managed Cloud

Assess the separate WZ-IT infrastructure and contractual framework for professional secrets.

View the Section 203 service

Frequently asked questions about the Managed Cloud Gateway

Reverse proxy, TLS, private connectivity, access and service boundaries

Reviews & projects

Operations that visibly relieve customers

Customer feedback on monitoring, updates, maintenance, support and stable production systems.

WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.

Steve KirchnerManaging Director, nextGYM GmbH

View project

International

Built in Germany's Ruhr Valley. Running worldwide.

WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.