Gately v0.6.5.2 released

November 8, 2026

Download v0.6.5.2 · GitHub Release

Synology DSM and other kernels without nf_tables

The Synology DSM kernel has no nf_tables, so intrusion prevention failed to write its firewall rules and retried every minute, and automatic firewall opening had no effect. In this release:

• Intrusion prevention uses iptables (legacy) and ipset when the kernel has no nf_tables or there is no nft command. The rules live in Gately's own chains in the mangle table, which runs before the rules of the Synology firewall and Docker; manual and permanent bans, trap ports and port-scan detection all take effect in the kernel, and bans with more than about 24 days left are written again before they expire;
• "Open firewall automatically" for port forwarding, the Web service and protocol routing uses a dedicated iptables chain of Gately's own, with its jump first in INPUT and restored within 30 seconds after the Synology firewall reloads; this works in Docker and with a direct install;
• The Docker image includes iptables-legacy and ipset; systems where nftables works behave as before;
• When neither is usable, intrusion prevention shows "Unavailable" with the reason instead of retrying.

Docker deployments need host networking and cap_add: NET_ADMIN. See Intrusion Prevention.

First-label wildcards for sites

A site domain may contain one * in its first label: api-*.example.com matches api-1.example.com and api-test.example.com, but not deeper subdomains. Exact domains match first, then wildcards, then *; a first-label wildcard beats *.example.com, and among wildcards of equal length the site listed first wins. Redirects can use {1} for the part matched by *; certificates are still requested for *.example.com. See Web Service.

Forward auth: 401 redirect

Forward auth has a new "401 redirect" switch for auth services such as Casdoor that put a dynamic login address in the Location of a 401 response. When it is on and "Login redirect" is empty, Gately sends the visitor a 302 to that address and passes Set-Cookie and Cache-Control along; relative addresses, javascript: and similar forms keep the 401 as it is. The switch is off by default.

Fixes

• Gately exited when a backend replied before reading the whole request body over HTTP/2, for example when logging in with the Home Assistant iOS app on the LAN;
• A domain with a trailing dot (such as example.com.) reaches the same site as without the dot;
• The diagnostics bundle replaces the host name as a whole word, ignoring case: a short host name such as gate no longer turns gately into <hostname>ly, and compound names such as nas-backup are still redacted;
• Masking in the network topology covers first-label wildcard domains; copying a site's share link uses its first concrete domain and skips every wildcard form.