Gately v0.6.6.2 released

November 14, 2026

Download v0.6.6.2 · GitHub Release

EasyTier networking

"Tunnels and networking" adds EasyTier: Gately manages the easytier-core process and joins this machine to an EasyTier network, preferring direct P2P hole punching and falling back to relaying through public or self-hosted nodes.

• Multiple instances are supported. Each instance is its own process, so one machine can join several different networks;
• Online install, update and rollback; the Windows package ships with wintun.dll and other dependencies;
• The network secret is passed to the process through an environment variable, stays off the command line and is masked in logs; a secret is required when sharing local subnets or acting as an exit node;
• Instance cards show the virtual IP, listen addresses and the peer list (direct / relay, latency, protocol); when the TUN device cannot be created or the process exits right after starting, the reason is shown;
• Saving is refused when enabled instances listen on the same port, when port forwards bind the same local port, or when device names collide.

See Networking & Tunnels.

Intrusion prevention

• TLS handshake failure source (#90): jails gain the source "TLS handshake failures", which counts handshake failures on the web service HTTPS listeners and bans by failure type, listener and count. Types can be picked separately: dropped mid-handshake (EOF), connection reset, handshake timeout, not TLS or protocol error, cannot negotiate parameters, unknown domain, client aborted and more. Two built-in templates are included, "TLS abnormal handshake" (5 times in 1 minute, banned for 1 day) and "TLS handshake aborted" (20 times in 1 minute); in the jail editor you can paste a failure reason to test which type it falls into. Addresses listed under the web service's "trusted proxies" (CDN origin-pull nodes) are not counted.
• Port scan detection recognizes module ports: as soon as a Gately module starts listening, its port is registered as open, taking effect within 300 milliseconds. This covers frps bind, vhost, public dashboard and allowPorts ranges, remote ports requested by frpc after login, EasyTier listeners and port forwards, and the public SOCKS5 ports of Tailscale and NetBird. A port that stops listening is still treated as open for 10 minutes, so legitimate visitors during an frpc reconnect or a program restart are not banned as port scanners.

See Intrusion Prevention.

Notifications: login from a new address (#92)

A new notification event "Management UI: login from a new address" (login.newip, warning level) is published when an admin login succeeds from an address that has never logged in successfully before. The "Security & sign-ins" template includes it. Password, Passkey, third-party and fnOS unified gateway logins are all checked; the first login only builds the baseline; IPv6 is grouped by /64; up to 200 source addresses are remembered. See Notification Center.

Other improvements

• When read-only accounts and read-only API tokens view the settings of managed programs, environment variables show only their names and extra arguments are hidden entirely.
• The login page now reports an empty user name or password right away instead of sending a request.
• Action buttons on list cards stay at the bottom of the card so cards of different heights line up; fields on narrow cards use two columns.

Upgrade notes

• Docker: pull the new image and recreate the container; OpenWrt: install the new .apk / .ipk over the old one; fnOS: install the new .fpk in the App Center; other installs can upgrade online from System Settings.
• Existing intrusion prevention rules and notification rules are unaffected. To get new-address login alerts, add a rule for login.newip in the Notification Center or apply the "Security & sign-ins" template again.