Dynamic DNS
18 providers including Alibaba Cloud, Cloudflare, Tencent Cloud, DNSPod, Huawei Cloud, Route 53, OVH, Gandi and Namecheap; detect your IP by URL, network interface or command, IPv4 and IPv6, webhook notifications.
Skip to content
Scan with your phone to join the Telegram group
v0.5.7 is out: SMB share mounts and new themes →A network gateway toolkit
A network gateway toolkit
you can see through
DDNS, STUN NAT traversal, port forwarding, reverse proxy, certificates, WAF, Tailscale and frp, all in a single ~32 MB binary. Runs on home networks, NAS boxes, cloud hosts and servers of every kind.
~32 MBSingle binary with the admin UI embedded
0Connections to project servers by default
Cross-platformLinux / macOS / Windows / FreeBSD, including ARM, MIPS and RISC-V
Apache-2.0Open-source license, auditable source
The everyday network toolbox, managed in one place
Covers the features home networks and server ops rely on most. Every module can be enabled or disabled on its own.
STUN Traversal
TCP / UDP hole punching and keep-alive, UPnP / NAT-PMP, built-in forwarding; triggers webhooks and scripts when the public address changes.
Port Forwarding
TCP / UDP, IPv4 / IPv6, port ranges, multi-target failover, connection limits and traffic statistics; can send the PROXY protocol downstream to preserve the real client address; SNI routing lets several services share port 443.
SSL Certificates
Automatic ACME issuance and renewal with DNS-01 (including wildcards), HTTP-01 and EAB; map certificates to a directory and run a script after changes.
Web Services
Per-domain reverse proxy, redirects and static files; HTTPS, HTTP/3, WebSocket and PROXY protocol; weighted multi-backend policies, health checks, compression, rate limiting and response caching; can stand in for nginx: path backends, forward auth, and shared users with TOTP and single sign-on.
WAF Firewall
Built-in Coraza and OWASP CRS v4, rules enabled per file, custom SecLang support, block or detect-only mode.
Networking & Tunnels
Supervises Tailscale, frp (frpc / frps) and cloudflared tunnels as managed processes, always using the latest upstream release.
Docker Management
Create and edit containers, logs and terminals, Compose, image updates with one-click upgrade (automatic rollback on failure), networks and volumes.
Web Terminal
SSH, Telnet and a local shell (disabled by default) with proxy support, persistent sessions, SFTP file management and split panes.
File Services
WebDAV and FTP services plus storage mounts for local directories, remote WebDAV and SMB shares, with online file management.
Scheduled Tasks & Wake-on-LAN
Cron jobs that run commands or HTTP requests and keep run history; Wake-on-LAN magic packet broadcast and online probing.
Security Hardening
Passkey and two-factor authentication, read-only accounts, audit log, config history with one-click rollback, login rate limiting, secure entrance path and LAN-only access.
Access Control
Per-site path rules, temporary share links, automatic bans on repeated auth failures, GeoIP country filtering and IP allow/block lists.
Traffic Stats & Monitoring
Global Prometheus metrics and a Grafana dashboard covering certificates, DDNS, port forwarding and sites; a one-click network self-check for NAT, ports, clock and DNS resolution.
Notification Center
Webhook, Telegram, Bark, ntfy, Gotify, Pushover, Discord, Slack, ServerChan, PushPlus, WeCom, DingTalk, Feishu and email; built-in rule templates, with silencing and de-duplication.
Configuration Backup
Encrypted backups (scrypt + AES-GCM), retention policies and scheduled backups to a local directory or a storage mount.
Network Diagnostics
Ping, traceroute, port probing, DNS lookup, speed test and LAN scan, all run as background tasks.
API, CLI & MCP
Multiple tokens with per-module permissions and auto-generated OpenAPI docs; use gately ctl to drive an instance and gately mcp to connect AI assistants.
Native fnOS app
Install on fnOS, open from the desktop
Gately ships offline packages for fnOS (x86 / ARM) that you install manually from the App Center. It plugs into the fnOS unified gateway, shares the entry point you already use for fnOS, and can reuse the fnOS administrator's session.
Works with the fnOS unified gateway
Click the icon on the fnOS desktop and the admin UI opens under /app/gately/. Both the LAN address and your remote fnOS domain work, with no extra port to open or forward, and fnOS handles access control.
Sign in with your fnOS admin session
Turn on Sign in with fnOS and administrators already signed in to fnOS go straight into Gately, without a password or two-step code. Regular fnOS users still sign in. Off by default.
Every feature, running natively
Runs as root, so it can listen on 80/443, manage Docker and open the Web terminal. Config is kept on uninstall, and upgrading is installing the newer .fpk.
Software on your network edge should be easy to see through
It holds your DNS keys and certificate private keys, so every behavior should be open to inspection.
Transparent
No connections to project servers and no device reporting by default. Every outbound address, such as public IP lookup and STUN servers, is visible, editable and can be turned off.
Auditable
Configuration is plain JSON with 0600 permissions, ready for git diffs and rollbacks. Sensitive fields are masked in API output.
In your control
Third-party sign-in uses OAuth apps you register yourself, with no relay in between. Online upgrades run only when an admin clicks (Linux binary installs); nothing updates in the background.
Single-file deployment
One static binary with the frontend embedded. Runs under Docker, systemd and OpenWrt, covering NAS, soft routers and cloud hosts.
Up and running in a minute
Images are available for amd64, arm64 and arm/v7. After starting, open http://DEVICE_IP:16680 and sign in with the default account admin and default password gately.cn, then change the password right away.
docker run -d --name gately --network host \
-v ./gately-data:/etc/gately \
-v /var/run/docker.sock:/var/run/docker.sock \
ghcr.io/wangwanjie/gately:latestFAQ
Yes. Under Settings → Backup & Migration, choose a .lkcf file or a whole-site config zip, preview it, then import. Imported rules are disabled by default, so you can run alongside Lucky, switch over module by module and roll back at any time.
Take back control of your network edge
Open, transparent, single-file. Deploy Gately today.
Scan with your phone to join the Telegram group