Gately v0.6.2.2 released

November 1, 2026

Download v0.6.2.2 · GitHub Release

Web Services topology view (#54)

The Web Services page header gains a List / Topology switch. The topology view lays out Internet → Gately → listeners → sites / listener actions → backends / destinations in five columns and refreshes every 2 seconds:

• nodes show their state, match type, QPS and requests in progress; unavailable backends and listeners that failed to start are red, and expected setups such as a default site that closes the connection, the HTTPS redirect and the 404 when no site matches are gray;
• edge width follows QPS, and hovering or clicking a node highlights its whole path with QPS and traffic on the edges;
• the details panel shows QPS, the 60-second average, traffic, requests in progress and in total, backend errors, blocked requests by reason, status codes, 60-second charts and the active IPs passing through the node, each metric with a note on how it is counted;
• picking an active IP highlights only the path it took, down to the exact backend;
• the mask switch shows the last part of IPs and the addresses in backends, listeners, redirect targets and error messages as * for sharing screenshots.

All numbers come from in-memory counters of this instance through GET /api/webservice/topology, which read-only accounts can view. Site statistics also gain blocked requests by reason and per-backend requests and traffic, and Prometheus gains gately_site_blocked_total, gately_upstream_requests_total, gately_upstream_response_bytes_total and gately_listener_requests_total. See Web Services · Topology view.

Real visitor IP behind trusted proxies (#50)

Web Services → Global settings gains "Visitor real IP": enter the origin-facing addresses or ranges of trusted proxies such as a CDN or WAF, and pick the real IP headers in order (CF-Connecting-IP, X-Forwarded-For, X-Real-IP, True-Client-IP or a custom name). These headers are read only when the direct peer is a trusted proxy; headers sent by visitors connecting directly are ignored, and X-Forwarded-For is read right to left skipping trusted proxies. The resulting address is used by access logs, IP lists, LAN-only access, country filtering, bans, statistics and the headers sent to backends. With Cloudflare, CF-Connecting-IP is the recommended header. See Web Services.

Live connections per site (#51)

Each domain row in the site list shows the number of requests in progress, and the Connections window refreshes every 2 seconds:

• the live list shows the source address, protocol (h1 / h2 / h3, with WebSocket marked), method and path (without the query string), duration and traffic in both directions, searchable by IP;
• the history keeps the latest 200 requests per site that lasted at least 1 second or were closed manually, in memory only;
• a single request can be closed (HTTP/2 and HTTP/3 reset only that stream), or closed with its source address banned, which also closes its requests on every site. Your own current address, loopback addresses and trusted proxies cannot be banned.

Source IP access control (#49)

Port Forwarding, Protocol Routing, STUN built-in forwarding and frps instances can each use an allowlist or a blocklist built from IPs / subnets typed in by hand and the subscribed IP lists of Web Services; a refreshed list takes effect at once without restarting the rule:

• Intrusion Prevention bans are checked first, then the list;
• rule cards show the access mode and refusal count, the IP list page shows which rules reference a list, and a referenced list cannot be deleted;
• the frps list is checked when frpc logs in and protects the bind port;
• importing port forwarding and STUN rules from Lucky converts their safe mode into source IP access control (upload lucky_ipfilter.lkcf in the same import).

See Port Forwarding and Tunnels.

Site links (#52)

Each exact domain in the site list opens in a new tab, with a button that copies the full URL including scheme and port; when visitors come through Protocol Routing, a port mapping, frp or a CDN, the listener can be given the public access address. frpc http / https proxies, File Browser access URLs, the Cloudflare quick tunnel address and the Tailscale login link can be opened and copied the same way. Domains are saved in the form browsers send (lowercase, internationalized domains in punycode), and values that could never match, such as ones with a port or a path, are rejected.

Dynamic DNS

• Record remarks (or the task remark when empty) are written to Alibaba Cloud, Cloudflare, Tencent Cloud, DNSPod and Huawei Cloud;
• deleting records or tasks offers "Also delete from the DNS provider", supported by 14 providers. Only the record whose value matches Gately's last sync is deleted; when the value is unknown, was changed in the console, or the record set holds other values, nothing is deleted and the reason is shown;
• the module switch moves into Global settings, which also sets the default of the delete checkbox.

Other improvements

• The Docker page can upgrade the container Gately itself runs in: the new image is pulled first and, only when there is a new version, a temporary helper container recreates the container, restoring the old one if the new one fails to start; the Web Terminal's local shell points to this action when it runs inside the Gately container;
• on phones, pressing and holding the Web Terminal for about half a second enters a selection mode with the system selection handles and copy menu, and soft-wrapped lines are joined back when copied; the key bar gains a paste key that opens a paste panel over HTTP, where the last 10 texts copied or typed in this tab can be sent again; pasting several lines asks first when the remote program has not enabled bracketed paste;
• the Auth users page can clear sites that authenticate only with shared users, confirming before it turns their authentication off;
• editing a Protocol Routing rule keeps the hit counts of routes whose protocol, domains and ALPN are unchanged;
• the Network Tools speed test asks for 50 MB per request, fixing HTTP 403 from Cloudflare, adds Vultr, Hetzner and OVH test nodes, and task titles show only the target of the current tool;
• denials on a default site that closes the connection for visitors outside its list count as 444 for Web path probing (#53);
• the home screen icon on iOS no longer falls back to a letter placeholder when a safe entry path is set.

Fixes and hardening

• The Web Terminal strips control characters from pasted text, so an embedded end-of-bracketed-paste sequence cannot skip the multi-line confirmation; text read straight from the system clipboard is not added to the clipboard history, and the history is cleared on sign-out or when the session expires;
• closing a request at the moment it ends no longer affects the next request on the same connection;
• a second upgrade of Gately itself started while one is in progress is rejected; the upgrade helper container is removed together with its anonymous volume, and several Gately instances on one Docker host only handle their own helpers;
• when editing a Dynamic DNS task removes records with "Also delete from the DNS provider" checked, the configuration about to be saved is validated first and nothing is deleted at the provider if validation fails; Tencent Cloud syncing matches the host record exactly;
• fixed a data race between hot-reloading sites and requests in flight; backend addresses in logs, events and metrics leave out the user name, password and query string;
• the Connections and statistics windows stop polling after leaving the page; the ban dialog stays open when banning fails; frp subdomains reject IPv6 addresses; importing a Lucky rule in blocklist mode warns when its list is missing.

Upgrade notes

• Docker: pull the new image and recreate the container; when the Docker socket is mounted, Gately can also upgrade itself from its Docker page. OpenWrt: install the new .apk / .ipk over the old one. fnOS: install the new .fpk manually in the App Center. Other deployments can upgrade online in Settings.