FAQ
Does it need to connect to the project's servers?
No. Gately does not connect to any project servers by default and does not report device information. Outbound addresses such as public IP lookup use third-party public services and can be changed in the corresponding tasks.
What are the default username and password?
The default account is admin and the default password is gately.cn. The default password is public, so change it under "Settings → Account & Security" right after signing in; until you do, the admin UI keeps showing a warning at the top. If the GATELY_INITIAL_PASSWORD environment variable was set at deployment, that password applies instead.
What if I forget the administrator password?
Run gately reset-password on the server (docker exec -it gately gately reset-password for Docker) and type yes to confirm. The password is reset to the default gately.cn, and a running instance picks it up within seconds. See Reset password and two-factor authentication.
What if I lose my two-factor authenticator?
Run gately reset-totp on the server (docker exec -it gately gately reset-totp for Docker) and confirm. Two-factor authentication is turned off; sign in with your password and enable it again.
Does it support fnOS?
Yes. Every release ships offline fnOS packages (.fpk) that you install manually from the App Center. Gately plugs into the fnOS unified gateway, so it opens from the desktop icon and also works over your remote fnOS domain. Turn on "Sign in with fnOS" under "Settings → Access control" and fnOS administrators who are signed in go straight in, without a password or two-step code. See fnOS native app.
Does it support OpenWrt / iStoreOS?
Yes. Every release ships OpenWrt packages: the .ipk for OpenWrt 24.10 and earlier (including iStoreOS), installed with opkg install, and the .apk for OpenWrt 25.12 and later, installed with apk add --allow-untrusted. The service starts right after install and keeps its config in /etc/gately; to upgrade, install the newer package. The binary is about 32 MB, so a soft router with ample storage is a good fit. See OpenWrt.
Why is --network host recommended?
Port forwarding, STUN and web services listen directly on host ports. With bridge networking you have to publish every port in use yourself.
Can it run alongside Lucky?
Yes. The admin port defaults to 16680, which does not conflict with Lucky's 16601. Imported rules are disabled by default so they do not compete with a still-running Lucky for ports and router UPnP mappings.
Why do I have to supply the Tailscale, frp and cloudflared binaries myself?
These three modules supervise the official external programs. Gately does not bundle them, so you can always use the latest upstream version. See Configuration & Runtime Options for where to put them.
My STUN rule is enabled but I still cannot connect from outside
If your router's WAN interface sits behind carrier-grade NAT (100.64.0.0/10), outside hosts cannot reach the traversed port. This is a limit of the network itself. Use Tailscale / frp / Cloudflare Tunnel instead.
How do I report issues or contribute?
Open an issue on GitHub Issues. Development conventions are in Contributing.