Gately v0.6.5.5 released

November 11, 2026

Download v0.6.5.5 · GitHub Release

Port Knocking (#80)

The new Port Knocking module (in the Network group) provides single packet authorization (SPA) compatible with the fwknop client: protected ports cannot be reached from outside, the client first sends an encrypted, authenticated knock packet, and once it is accepted only that source address is let in for a limited time. It suits direct SSH access, so scp, IDE remote development and other uses the Web terminal does not cover can connect safely from the internet.

• Security: packets are encrypted with AES and authenticated with HMAC, and the HMAC is checked before decryption; each packet can be used only once (replay protection), and packets whose timestamp is outside the validity window (120 seconds by default) are rejected; a rule can restrict the username and require the packet to state the address to open;
• Firewall blocking: knock packets are received on UDP 62201 by default; a rule can write the protected ports into the system firewall (nftables, or iptables + ipset when the kernel has no nf_tables), and an address that knocked successfully can open new connections during the open duration (30 seconds by default); established connections are not affected;
• No lockout: "LAN knock-exempt" is on by default, so private addresses and the public IPv6 prefixes of the local interfaces need no knock (the carrier-grade NAT range 100.64.0.0/10 is not included), and you can add a knock-exempt allowlist;
• Gately entries open by knock: IP access control in Port Forwarding, Protocol Routing and the built-in STUN forwarding can require a knock; Gately decides by itself without firewall permissions, so it also works on Windows, macOS and in containers without NET_ADMIN;
• One open port: Protocol Routing can require a knock per route and gains a Port Knocking route (protocol spa) that receives knock packets over TCP (fwknop -P tcp), so the same port takes the knock and then lets SSH and other routes through;
• Intrusion Prevention: rejected knocks can be used as an event source, and the built-in "Port knock failures" template bans for one day after 5 failures in 10 minutes by default; UDP packets that fail HMAC authentication are only counted and not used, because their source can be spoofed; successful and rejected knocks can be subscribed to in the notification center;
• Client setup: "Client" on the rule card generates the fwknop command line and a ~/.fwknoprc stanza, with keys in the same format as fwknop -k.

See Port Knocking.

Wake-on-LAN: remote shutdown through an agent

Remote shutdown gains an "Agent" method: install an agent on Windows, Linux, macOS or OpenWrt (as a scheduled task, or as a systemd / OpenRC, launchd or procd service). The agent long-polls Gately for commands, so the device needs no open ports and Gately stores no login credentials for it.

• The agent only runs three fixed actions: shut down, reboot and sleep; the API POST /api/wol/devices/{key}/shutdown takes {"action": "reboot"} or {"action": "sleep"} to reboot or sleep;
• A command is valid for 10 seconds after it is sent: the agent acknowledges it first and runs it only after Gately replies; when the agent is offline the request fails at once and is never queued for the next time it connects;
• The install command checks the script's SHA-256 first and stops if it does not match; credentials are passed in the request body and environment variables and never appear in URLs or command-line arguments;
• The device card shows whether the agent is online, with the host name, system and source address it reports; regenerating the credential disconnects the old agent immediately.

There is also a new "HTTP request" method for Home Assistant, smart plugs and other services with an HTTP API: enter the URL, method, headers and body, and a 2xx status code counts as success. See Wake-on-LAN · Agent.

Web service: trust signed-in users (#81)

Sites gain a "Trust signed-in users" option: visitors authenticated by this site's Gately authentication skip the WAF, and their requests are not counted by Intrusion Prevention's web path probing, for cases where the WAF or decoy path rules block your own users. Trusted credentials are Web authentication sessions, third-party login identities listed one by one in the allowlist, shared user single sign-on and verified Basic authentication; identities allowed through a provider:* wildcard such as github:* are not trusted. Bans, IP and country access control and rate limits still apply. See WAF.

Route by user for more site types (#79)

Redirect, static file, navigation panel and fixed text sites can also route by authenticated user: users matching a rule are reverse-proxied to that rule's backend, and other visitors are handled by the site type as before, for example administrators reach the admin backend while other signed-in users are redirected to an info page. See Web Service · Route by user.

Administrator requests skip the site WAF

When the admin UI is reached through a site with the WAF on, requests carrying a valid administrator session of this instance skip the site's WAF, so saving configuration that contains file paths, HTML or scripts is no longer blocked with 403 by CRS rules. Read-only accounts, visitors and admin requests for other instances are still checked.

Fixes

• OpenWrt packages (#82): the apk in OpenWrt 25.12 still replaces the files after the architecture check fails, so an arm64 package mixed into the offline folder when injecting packages into a firmware image made the binary crash in a loop after flashing. Now, when apk installs a package for another architecture, the running gately binary is kept and a message says so. When injecting packages into firmware or installing offline, put only the gately package matching the device architecture in the folder; see Installation · OpenWrt.

Other improvements

• The API docs list the login-free module endpoints (such as the Wake-on-LAN agent poll, acknowledgement and script download) and note that they use the module's own credentials, and add the Port Knocking fields.

Upgrade notes

• Docker: pull the new image and recreate the container. OpenWrt: install the new .apk / .ipk over the old one, and also install luci-app-gately of the same version if you want the LuCI page. fnOS: install the new .fpk manually in the App Center. Other deployments can upgrade online in Settings.
• Firewall blocking in Port Knocking needs root or CAP_NET_ADMIN; Docker deployments need the host network and cap_add: NET_ADMIN.