// Module included in the following assemblies:
//
// * networking/ingress_load_balancing/routes/securing-routes.adoc

:_mod-docs-content-type: PROCEDURE
[id="nw-ingress-creating-a-passthrough-route_{context}"]
= Creating a passthrough route

[role="_abstract"]
To send encrypted traffic directly to the destination without decryption at the router, configure a route with passthrough termination by running the `oc create route` command. This configuration requires no key or certificate on the route, as the destination pod handles TLS termination.

.Prerequisites

* You must have a service that you want to expose.

.Procedure

* Create a `Route` resource:
+
[source,terminal]
----
$ oc create route passthrough route-passthrough-secured --service=frontend --port=8080
----
+
If you examine the resulting `Route` resource, it should look similar to the following:
+
.A Secured Route Using Passthrough Termination
[source,yaml]
----
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: route-passthrough-secured
spec:
  host: www.example.com
  port:
    targetPort: 8080
  tls:
    termination: passthrough
    insecureEdgeTerminationPolicy: None
  to:
    kind: Service
    name: frontend
----
+
where:
+
`metadata.name`:: Specifies the name of the object, which is limited to 63 characters.
`tls.termination`:: Specifies the `termination` field is set to `passthrough`. This is the only required `tls` field.
`tls.insecureEdgeTerminationPolicy`:: Specifies the type of edge termination policy. Optional parameter. The only valid values are `None`, `Redirect`, or empty for disabled.
+
The destination pod is responsible for serving certificates for the traffic at the endpoint. This is currently the only method that can support requiring client certificates, also known as two-way authentication.
