Warpgate

Warpgate is an open-source bastion host that manages secure access to internal network services. It acts as a transparent proxy for SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP, and VNC connections, allowing administrators to assign specific users to specific hosts or URLs within a network. The software is deployed as a single binary on a server, typically located within a DMZ, to gate access to sensitive infrastructure.

Users connect to the bastion using standard credentials without the need for a custom client application or an SSH wrapper. Warpgate authenticates the user locally, establishes a connection to the target service, and then joins both parties together. An integrated web admin interface allows for the management of user accounts, the definition of target lists, and the review of session activity in real time.

Key features

• Session recording and live playback via a web UI
• Native support for TOTP and OpenID Connect SSO
• Brute-force protection with IP blocking and user lockout
• Precise 1:1 assignment between users and services
• Support for non-interactive connections
• Temporary access credentials through a ticketing system
• Command-level auditing of user sessions

The application is written in Rust and uses an SQLite database to store session history and configuration. It provides a web-based administration panel built with Svelte and Bootstrap. When handling HTTPS traffic, Warpgate presents a selection of available targets to the user and proxies all session traffic to the chosen destination, allowing users to switch targets during a session. Because it functions as a transparent proxy rather than a traditional jump host, it maintains compatibility with standard clients while providing centralized access control and auditing.

Warpgate is designed for infrastructure management and privileged access management in enterprise environments where strict control over remote access is required.