Gately v0.6.2 released

October 31, 2026

Download v0.6.2 · GitHub Release

Protocol Routing

The new Protocol Routing module sits next to Port Forwarding in the sidebar. It identifies the protocol from the first bytes the client sends and sends connections on one port to different backends, without decrypting anything:

• TLS is routed by SNI domain and ALPN, HTTP by Host, and Minecraft by the server address in the handshake;
• SSH, RDP, SOCKS4/5, OpenVPN over TCP (including tls-auth and tls-crypt-v2), XMPP, MQTT, PostgreSQL, RTSP, SIP, Redis, AMQP, SMB, Git, IRC, ADB and BitTorrent get one route each; HTTP, RTSP and SIP are told apart by the version at the end of the request line;
• a wait-timeout route takes clients that send nothing after connecting (server-first protocols such as VNC or MySQL), and the detection timeout accepts tenths of a second;
• unrecognized or unmatched connections go to the default target; each route can send the PROXY protocol to its backend, and the list shows how many connections each route received.

See Protocol Routing for what each protocol is matched on, the matching order of domains and ALPN, and examples replacing haproxy SNI routing and sslh.

Grouping and sorting lists (#48)

Dynamic DNS, Port Forwarding, Protocol Routing, Web Service sites, STUN, SSL certificates, WAF, Intrusion Prevention, frp, Cloudflare tunnels, File Browser, storage mounts, Wake-on-LAN, scheduled tasks, notifications, saved Web terminal connections, API tokens and more now share the same list tools:

• search, drag-and-drop sorting (up/down arrows on phones), and moving several selected items to a group at once;
• moving whole groups, renaming and merging groups in place, and remembered collapsed groups;
• the DNS records inside a Dynamic DNS task can be grouped and sorted too.

Changing groups or order never restarts a running instance. See List grouping & sorting.

STUN addresses in Dynamic DNS (#47)

Record values and Webhooks can use {STUN_rule name_PORT}, {STUN_rule name_IP} and {STUN_rule name_ADDR}. When a STUN rule's public address changes, tasks that reference it sync right away; when the variables appear only in the Webhook, the Webhook is still called once. While the rule is disabled or has not traversed yet, the record is skipped for that round and its status shows why. See Dynamic DNS.

STUN behind multiple NATs

Rules with UPnP / NAT-PMP now ask the gateway for its own external address first. When it differs from the public address STUN reports (for example a router behind carrier-grade NAT), the public port belongs to the outer NAT, so only the tunnel port mapping is kept and no extra mapping is added on the router, and the public port no longer changes on every recheck. The STUN docs now cover full cone vs restricted carrier NAT, UPnP behind multiple NATs, fixing the local port and allowing it in the host firewall.

Security hardening

• While the default password is in use, the account, two-step verification, passkeys, additional accounts, API tokens, system settings and Web terminal security settings are read-only, and restoring a backup or rolling these settings back to a history version is refused as well, until the default password is changed;
• read-only accounts and read-only API tokens get masked shared-user passwords, share link tokens, header values and secrets, and URLs with their passwords, query values and path tokens masked, in configuration and logs;
• browsing directories under files/ and sftp/ needs write access;
• a password-only login no longer resets the failure counter, so two-step codes cannot be brute-forced;
• behind a trusted proxy, disagreeing X-Forwarded-For and X-Real-IP headers are handled more strictly, so a forged internal address cannot bypass "LAN only";
• in the API token dialog, modules whose write access can run commands on the server (Dynamic DNS, scheduled tasks, Intrusion Prevention, STUN, SSL, Web terminal, Docker, frp, File Browser, Cloudflare tunnels) are marked "Runs commands" and granting them shows a warning;
• the device description and control URLs returned by a UPnP gateway must belong to the device that replied.

Other improvements

• Each record on a Dynamic DNS task card can be deleted directly (the DNS record at the provider is kept);
• the Web terminal key bar on phones is a single scrolling row that shows and hides with the on-screen keyboard;
• home screen icons on Android Chrome and iOS are no longer transparent, and the admin UI and website provide a web app manifest;
• the website home page and README are redesigned.

Fixes

• Editing an Intrusion Prevention rule that has matched before failed with "unknown field lastSeen";
• when several certificates cover the same domain, the one that expires last is used, so the order and groups of the certificate list no longer change the certificate in use;
• Protocol Routing no longer forwards zero padding when a ClientHello is cut short by the detection timeout, and stopping or editing a rule closes connections still being identified right away;
• STUN variables in a JSON Webhook body were not replaced.

Upgrade notes

• On the first start after upgrading, SNI routing rules in Port Forwarding move to Protocol Routing with their keys, names, enabled state, groups and routes; if Port Forwarding was turned off, Protocol Routing is turned off too; API tokens with Port Forwarding access also get the same access to Protocol Routing.
• Scripts that manage routing rules through the API should use /api/protoroute/rules, where the routes field is routes instead of sniRoutes; /api/portforward/rules no longer accepts the mode field. Metrics for these rules are now gately_protoroute_*.
• Docker: pull the new image and recreate the container. OpenWrt: install the new .apk / .ipk over the old one. fnOS: install the new .fpk manually in the App Center. Other deployments can upgrade online in System settings.