Gately v0.5.6 released

October 22, 2026

This release adds the Intrusion Prevention module (#10), bringing the fail2ban features many people use in 1Panel into Gately: it finds the source IPs of brute-force attempts and port scans, bans them automatically and drops their traffic in the system firewall.

Download v0.5.6 · GitHub Release · Module docs

Intrusion Prevention

• Log jails: read log files (following rotation), the systemd journal, command output (such as logread -f on OpenWrt) or Docker container logs, find failures with regular expressions and <HOST>, and ban an IP that reaches the count within the time window. Templates are included for SSH, Dropbear, Nginx, Vaultwarden, Home Assistant, Proxmox VE and more, and you can paste sample lines into the editor to test them;
• Gately events: failed admin console logins and WAF blocks can feed a jail too, no regular expression needed;
• Trap ports: traps on ports this host does not use. Any source that connects is banned; ports that are listening are excluded automatically;
• Port-scan detection: a source that connects to closed ports on this host more often than the threshold per minute is banned;
• One ban list: manual bans (CIDR networks and permanent bans included) and the web service's failed-auth bans are managed here and survive restarts; repeat offenders get double the duration each time;
• Whitelist: LAN, loopback, 100.64.0.0/10 (Tailscale) and this host's IPv6 /64 networks are ignored by default;
• System firewall: bans are written to a separate inet gately table in nftables and dropped in the kernel, including traffic forwarded to Docker containers and LAN devices. Replies to connections this host opens to a banned address (DNS, for example) still get through. The rules are removed when Gately stops.

Port forwarding, web services, STUN, WebDAV, FTP and the admin console also reject banned addresses directly. Bans raise the "Intrusion Prevention: IP banned" event, which you can subscribe to in the Notification Center.

Where it works

• Linux running as root, the fnOS package, OpenWrt 22.03 and later: everything is available;
• Docker: needs host networking and NET_ADMIN (cap_add: [NET_ADMIN]); the image ships nftables;
• Windows, macOS, FreeBSD, and Linux without nftables or permission: bans apply only to Gately's own services, trap ports are served by Gately itself and port-scan detection is unavailable. The top of the page shows the reason and how to fix it.

Other improvements

• Docker settings show the Docker daemon's own registry mirrors (registry-mirrors in daemon.json) (#11);
• Fixed turning on scheduled backups failing with unknown field "hasPassword" (#9);
• The website has a new sponsor page.

Upgrade notes

• Linux binary installs upgrade from the About page; Docker pulls the new image and recreates the container; fnOS installs the new .fpk from the App Center; OpenWrt installs the new .ipk / .apk.
• For firewall-level bans in Docker, add cap_add: [NET_ADMIN] to the compose file and recreate the container. Everything else works without it.
• Linux instances running as root create the inet gately table after upgrading. With no bans it only holds empty rules and does not affect existing traffic. Turn sync off under "Intrusion Prevention → Settings" or disable the module under "Settings → Feature modules" if you do not need it.
• The web service's failed-auth bans now use the shared ban list, so with firewall sync on they apply to the whole host. "Ignore LAN addresses", on by default, keeps LAN addresses from being banned this way.
• For sites behind a CDN that passes the real IP in a header, the WAF and failed-auth bans see the CDN's addresses; do not enable those jails for such sites.
• Docker installs should use v0.5.6.1, which fixes the v0.5.6 image crashing an older nft on the host.