Stream mode is the gateway operating mode used for layer 4 traffic instead of HTTP. It handles raw TCP connections, which allows the gateway to route and secure protocols such as SSH, email, and database traffic that do not fit layer 7 request processing.
What Stream Mode Is For
Stream mode is the gateway’s layer 4 operating mode for raw TCP traffic. Unlike HTTP-oriented modes that inspect requests, it forwards connections as protocol streams, which makes it suitable for SSH, email, and database protocols.
The practical distinction is that the gateway is no longer making decisions on application requests, headers, or routes inside HTTP semantics. It is working at the transport layer, so the unit of handling is the connection itself, not an individual web request.
How Stream Mode Changes Gateway Behavior
In stream mode, the gateway treats the traffic path as a bidirectional TCP flow. That allows it to proxy and secure protocols that do not speak HTTP, while preserving protocol behavior expected by clients and servers.
This matters whenever the upstream service depends on a long-lived socket, a binary protocol, or a non-web administrative channel. The gateway can still enforce exposure boundaries, but the security logic is shaped by connection handling rather than content inspection. For that reason, stream mode is often used when the deployment needs a controlled entry point for services that should not be directly exposed on the network.
Because the gateway is operating below the HTTP layer, features tied to request parsing, URL routing, and header-based policy do not apply in the same way. That is not a limitation so much as a different trust and control model: the gateway is a transport proxy, not an application reverse proxy.
When Stream Mode Is the Right Fit
Stream mode is appropriate when the protected service is not naturally expressed as HTTP. Common examples include SSH access to administration hosts, SMTP or IMAP for mail systems, and database connectivity for application backends.
It is also useful when you need a single controlled ingress point for multiple non-HTTP services, especially where the internal service should remain hidden behind a gateway boundary. In those cases, the gateway becomes a mediation layer for raw TCP connections rather than a web traffic policy point.
That same design choice also defines the trade-off. Stream mode gives broad protocol compatibility, but it generally offers less application awareness than HTTP-based handling. Security decisions therefore depend more heavily on network segmentation, endpoint hardening, and the correctness of the upstream service itself.
Operational Implications and Limitations
Stream mode changes how administrators reason about observability and policy. Since the gateway is not parsing HTTP requests, request-level controls, content-aware inspection, and web-specific telemetry are usually not available in the same way.
As a result, misconfiguration tends to show up as exposure at the connection boundary, not as a malformed request or URL issue. The main concern is whether the gateway is forwarding exactly the intended TCP destinations and whether the protected protocol is still governed by the right upstream authentication, encryption, and access rules.
In practice, stream mode is a boundary control for transport protocols. It can reduce direct exposure of internal services, but it does not by itself solve protocol-level authentication or authorization problems inside those services.
Risk and Threat Considerations
Stream mode can widen exposure if administrators treat a TCP proxy like an application-aware security control. The main risk is that sensitive services, especially databases and admin channels, become reachable through a gateway path without the stronger request-level guardrails people often assume exist in HTTP mode.
Failure mechanism: The gateway forwards raw connections with limited protocol visibility, so weak upstream authentication, permissive listener placement, or overly broad allow rules can turn a single entry point into a direct path to high-value services.
Impact: Attackers who gain access to the stream path may be able to reach internal protocols, probe exposed services, and exploit the upstream system’s own security weaknesses, increasing the chance of unauthorized access or lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Stream mode is a boundary control for raw TCP traffic crossing trust zones. |
| AC-4 — Information Flow Enforcement | Stream mode mediates network flows rather than HTTP requests, so flow enforcement is central. | |
| Recommendation — Enforce boundary protection to restrict which TCP services can traverse the gateway. Apply information flow rules to permit only approved stream destinations and ports. | ||
| NIST CSF 2.0 | PR.AA-05 — Network Access Control | Stream mode depends on controlling access to non-HTTP service paths at the transport layer. |
| Recommendation — Constrain network access to streamed services to only authorized sources and destinations. | ||
| ISO/IEC 27001:2022 | A.8.20 — Network security | Stream mode is a network security pattern for controlling exposure of TCP services. |
| Recommendation — Protect streamed services with network security rules that limit reachable ports and paths. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Stream mode is implemented through network path and exposure management for TCP services. |
| Recommendation — Manage gateway exposure and port forwarding so only required stream services remain reachable. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
