Guides / Migration
Migrate Without Downtime
Protection sits in front of your existing infrastructure, so migration is a DNS change, not a re-architecture. Do it in this order and there is no cutover moment your users can feel.
1. Provision in parallel
Create your protected IP and point its forwarding at your existing origin. Your current setup keeps serving traffic; nothing has changed for users yet.
2. Test against the protected address
Connect directly to the protected IP, or add a temporary DNS name like edge.yourdomain.com for it, and verify your service end to end: connections, logins, gameplay, whatever matters. Fix forwarding ports or trusted-network rules now, while nobody is watching.
3. Lower your DNS TTL
A few hours before cutover, drop the TTL on the record you are changing to 300 seconds or less, so the switch propagates quickly and a rollback would too.
4. Cut over
Change the A or SRV record to the protected address. Users migrate as DNS propagates; both paths keep working during the transition because your origin serves them either way.
5. Close the side door
Once traffic has moved, restrict your origin firewall to accept connections only from the edge. An origin that still answers the public internet directly is the bypass every attacker looks for.
Rollback
Rolling back is the same DNS change in reverse. Keep the old record value on hand until you are satisfied, and with a low TTL the round trip is minutes.
Keep Exploring
Getting Started
The first-time walkthrough, if this service is your first.
Trusted Networks
Set trust rules during step two, while nobody is watching.
Anycast Delivery
Choose the routing mode before you cut over, not after.
Full Documentation
The complete reference at docs.gatewaysentry.com, no login required.