Some embodiments provide a novel way to insert a service (e.g., a
third party service) in the path of a data
message flow, between two machines (e.g., two VMs, two containers, etc.) in a public cloud environment. For a particular tenant of the public cloud, some embodiments create an
overlay logical network with a logical
overlay address space. To perform a service on
data messages of a flow between two machines, the logical
overlay network passes to the public cloud's
underlay network the
data messages with their destination address (e.g., destination IP addresses) defined in the logical
overlay network. The
underlay network (e.g., an
underlay default downlink gateway) is configured to pass
data messages with such destination addresses (e.g., with logical overlay destination addresses) to a set of one or more service machines. The underlay network (e.g., an underlay default uplink gateway) is also configured to pass to the particular tenant's public cloud gateway the processed data messages that are received from the service
machine set and that are addressed to logical overlay destination addresses. The tenant's public cloud gateway is configured to forward such data messages to a logical forwarding element of the
logical network, which then handles the forwarding of the data messages to the correct destination
machine.