Protected web portal
Put an identity check in front of an internal web application without moving the application itself onto a public host.
Public Application Ingress
Publish the application. Keep control at the entrance.
Use identity-aware L7 ingress for web applications and APIs, with an explicit compatible Grant on every path. Public L4 ingress for TCP and UDP uses source-IP control instead. The protection stays visible and matched to the protocol.
L7 identity modesGrant / source IPPublic L4 source IP
Public ingressRole ready
L7 · HTTPSportal.example.comOIDC · Grant · Source IP
Verified userBrowser
Customer portalPrivate origin
L4 · TCPgateway.example.com:9443Source IP allowlist only
203.0.113.0/24Allowed source
TCP endpointPrivate origin
Common situations
Different public applications deserve different front doors.
Use application-aware controls where L7 context exists. Use an honest source-IP boundary where the protocol exposes only TCP or UDP.
Partner API and webhook
Use a credential mode suited to service-to-service traffic, pair it with an explicit compatible Grant, and optionally narrow callers by source IP.
Share a signed link
Publish a specific L7 path with signed-link validation instead of opening the entire origin application.
Public TCP or UDP
Expose a protocol that has no L7 identity context and restrict the callers by explicit source-IP ranges.
Controls match the protocol
Use identity-aware access where L7 context exists.
Every L7 path pairs its authentication or explicit anonymous mode with a compatible Grant. Public TCP and UDP use source-IP policy because the protocol has no L7 identity context.
Authentication or explicit anonymous mode
Choose OIDC, API Key, Basic, mTLS, Signed URL or an explicitly selected anonymous mode.
Compatible Grant on every L7 path
The selected mode always pairs with an explicit compatible Grant; source-IP filtering can add a narrower boundary.
Source-IP control only
Public TCP and UDP do not inherit OIDC, API Key or other application-layer identity modes.
Role readiness is independent
The public-ingress role reports its own readiness; another gateway role being ready does not imply this one is ready.
Public ingress
Give every public application the right boundary.
Use NSD to choose the ingress type, origin and protection that match the protocol you are publishing.