# How to secure communications to MDM, using Secure Gateway? Last updated: July 24, 2026 This guide explains how to secure communications to the MDM server using Secure Gateway, which acts as an intermediary so the MDM server is never directly exposed to the internet or accessible via its own FQDN/IP. Secure Gateway must be installed on a separate machine with port 9383 open. Admins configure NAT settings on the MDM server with the Secure Gateway's FQDN, then install and configure Secure Gateway with the MDM server name and HTTPS port, verifying it's running via services.msc. ## Description As the devices to be managed are mobile and are always on the go, you need to expose your MDM server to external networks. This ensures the devices can contact the MDM server, ensuring continued management of devices. For those concerned with the security aspect of server exposure, you can use Secure Gateway. As the name suggests, Secure Gateway adds an additional layer of security ensuring all incoming communications are directed to the Secure Gateway instead of the MDM server. The Secure Gateway, acting as an intermediary, then routes the communication back to the MDM server. Secure Gateway ensures the MDM server is not directly exposed to the Internet, thus securing it from risks and threats. **Secure Gateway also ensures users cannot access the MDM server web console through the FQDN/IP of the machine running Secure Gateway**. You can learn more about configuring Secure Gateway in about three minutes through [this demo video](https://www.manageengine.com/mobile-device-management/demo/securing-mdm-server-access-using-forwarding-server-video.html). ![MDM Secure Gateway Architecture](https://manageengine.com/mobile-device-management/images/mdm-fs-arch.png) ## Pre-requisites - The Secure Gateway must be installed on a different machine than the one hosting the Central Server. - Ensure port **#9383** is open and accessible on the machine running the Secure Gateway. ## Steps - [Modify MDM server settings](https://www.manageengine.com/mobile-device-management/how-to/mdm-securing-server-communication-forwarding-server.html#step_1) - [Install and configure Secure Gateway](https://www.manageengine.com/mobile-device-management/how-to/mdm-securing-server-communication-forwarding-server.html#step_2) - [Verifying Secure Gateway installation](https://www.manageengine.com/system/workplace/editors/verify_SG) ### Modify MDM server settings - On the MDM server, click the **Admin** tab from the top menu and select **NAT Settings**, present under **Setting up MDMP**. - Provide the IP address/FQDN of the machine where the Secure Gateway is to be installed. **It is recommended that you provide the FQDN**. ### Install and configure Secure Gateway - [Download](https://download.manageengine.com/mobile-device-management/13579/SecureGatewayServer_64bit.exe) and install the Secure Gateway on a machine. - Specify the following details under the **Setting up the Secure Gateway** window, which opens after the installation process: - **Server Name**: Specify the FQDN/DNS/IP address of the MDM server. - **HTTPS Port**: Specify the port number used by mobile devices to contact the MDM server. Generally, port #9383 is used. ### Verifying Secure Gateway installation To verify that Secure Gateway has been installed and is running successfully, go to **services.msc** and ensure **ManageEngine Secure Gateway** is running. ### Troubleshooting tips 1. If there are issues with communication to or from the Secure Gateway, ensure the machine on which Secure Gateway is installed is running and that network connectivity allows it to contact the MDM server. 2. Check whether the Secure Gateway is running on the machine, as [explained above](https://www.manageengine.com/mobile-device-management/how-to/mdm-securing-server-communication-forwarding-server.html#verify_SG). 3. If you are using third-party certificates, ensure the certificates have been correctly copied as [explained here](https://www.manageengine.com/mobile-device-management/help/configuring_mobile_device_manager/mdm_nat_settings.html#Installing_the_Certificates). If you still face the issue, contact MDM Support (mdm-support@manageengine.com). ## Frequently asked questions ### Why should Secure Gateway be used instead of exposing the MDM server directly to the internet? Secure Gateway acts as an intermediary so all incoming device communications are directed to it instead of the MDM server, which keeps the MDM server and its web console from being directly exposed to or accessible via the internet, reducing exposure to external threats. ### What are the requirements for installing Secure Gateway? Secure Gateway must be installed on a machine different from the one hosting the MDM server, and port #9383 must be open and accessible on that machine. ### How can I confirm Secure Gateway is installed and running correctly? Open services.msc on the machine running Secure Gateway and verify that the ManageEngine Secure Gateway service is running. If there are communication issues, also confirm the machine is online, network connectivity to the MDM server is intact, and any third-party certificates were copied correctly.