# Installing the On-prem Gateway

Connect Zato in the cloud to the systems in your private network.

The On-prem Gateway lets a Zato environment in the cloud connect to the databases, APIs and other systems in your private network, with no VPN and no inbound firewall rules.

- In the Dashboard, go to **System** and **On-prem gateways**, create a gateway and copy its enrollment token.
- Install the gateway on a Linux host in your private network:

  ```bash
  sudo curl -fsSL -o /usr/local/bin/zato-on-prem-gateway \
    https://github.com/zatosource/zato-on-prem-gateway/releases/latest/download/zato-on-prem-gateway-linux-amd64 && \
    sudo chmod +x /usr/local/bin/zato-on-prem-gateway && \
    sudo zato-on-prem-gateway install --token TOKEN
  ```

- On ARM64 hosts, use `linux-arm64` in place of `linux-amd64`.

- On Windows, the gateway runs under WSL2, in a Linux distribution with systemd enabled, and is installed with the same command. Setting up WSL2 is described in [Installation on Windows](https://zato.io/docs/admin/guide/install/windows.html).
- The gateway now runs as a service that starts on boot, and the Dashboard shows it as **Connected**.
- Outgoing connections in Zato can now use the addresses of your on-prem systems directly - see [On-prem Gateway](https://zato.io/docs/admin/on-prem-gateway/index.html).
- Commands, proxies, moving a gateway to another host and removing it are described in the [reference](https://zato.io/docs/admin/on-prem-gateway/reference.html).