Gately v0.6.6.4 released

November 14, 2026

Download v0.6.6.4 · GitHub Release

Admin sign-in security

• Password rules: new passwords are 10 to 72 bytes. Common weak passwords (including common variations), passwords containing gately or the user name, sequential or repeated characters, and passwords with too few character types are refused (relaxed at 16 characters and above). Strength is shown live while typing.
• Forced change: after signing in with the default password or a weak password, a password change dialog appears that cannot be closed, and the server refuses other write operations until the password is changed. An existing weak password is detected at the next password sign-in.
• Escalating lockout: when the same source is locked out repeatedly, the lockout duration doubles each time, up to 24 hours.
• Unfamiliar-address failure budget: when the total number of password sign-in failures from addresses that have never signed in successfully reaches the limit within 10 minutes (20 by default, adjustable or switchable off in System settings), password sign-ins from unfamiliar addresses temporarily return 429 and a notification is sent. Familiar addresses and Passkey sign-ins are unaffected.
• Turn off password sign-in: once a Passkey is registered, password sign-in can be turned off so that only Passkeys or third-party sign-in work; gately reset-password turns it back on.
• Security score: the top of "System settings → Account & Security" shows the console security score, with a score and a link to the relevant setting for each of seven checks.

See Security Model & Privacy Promise.

Always-deny list (#95)

IP access control adds an "Always-deny list": enter addresses and ranges by hand, or reference subscribed IP lists (for example malicious IP threat feeds). Matching sources are always refused. The list is checked before the allowlist and blocklist, applies whatever the access control mode, and cannot be overridden by path rules, so deny always comes first. Web sites, port forwards, protocol routing, STUN built-in forwarding and frps instances (frpc login check) can all use it. A refreshed subscription list takes effect immediately, and a list that is referenced cannot be deleted. See Web Services.

Web services

• Knock admission and release after login: a site can require the source to hold a valid grant from a port knocking rule before it can be reached. A site can also act as a release entry: after a visitor passes the site's authentication, a grant is registered for their source IP (IPv6 by /64 by default), and sites, port forwards and the system firewall that reference the rule let it through right away. The entry page /__gately_knock shows and revokes releases and uses dual-stack probing to release both IPv4 and IPv6. Signing out, deleting the user or changing the password revokes the release automatically. When a knock rule does not enable firewall blocking, its ports can be left empty and the rule is used only for web login releases.
• Admin sign-in bypass: administrators who are signed in to the Gately admin no longer need the site's basic or web authentication on sites with this option enabled. Under the same parent domain it works through the SSO domain; when the site and the admin are under different parent domains, fill in the "Admin entry URL" and the handshake goes through a one-time ticket redirect. The credential is bound to the admin session, stops working immediately on sign-out, sign out of all devices or a password change, and is never forwarded to the backend.
• Shared user Passkey sign-in: when enabled, shared users can register a Passkey on the site's /__gately_auth/passkey page and then sign in with one click on the login page, without typing a password or a one-time code. It is offered only on the site's exact domain and the OIDC issuer domain. When an administrator changes a user's password or TOTP secret, that user's Passkeys are deleted as well.
• Cleartext HTTP/2 backends: the site option "Use HTTP/2 cleartext (h2c) for http:// backends" is for gRPC services that listen only on a cleartext port (such as NetBird management/signal). gRPC streaming and trailers are passed through unchanged; WebSocket requests on the same port automatically switch to HTTP/1.1.

Intrusion prevention

When kernel-level decoy ports and port scan detection ban a source, the ban reason, logs and notifications include the matched port. When the kernel or nftables cannot record the port, this is skipped automatically and the other rules keep working. See Intrusion Prevention.

Other improvements

• Scrolling inside an open dialog, confirmation box or drawer no longer moves the page underneath; terminals and editors inside overlays still scroll normally.
• Spacing between cards and grouped lists, sort bars and tabs is now consistent.

Upgrade notes

• Docker: pull the new image and recreate the container; OpenWrt: install the new .apk / .ipk over the old one; fnOS: install the new .fpk in the App Center; other installs can upgrade online from System Settings.
• If the admin password is weak, the next password sign-in after the upgrade asks for a new password; afterwards the security score is shown under "System settings → Account & Security".
• The unfamiliar-address failure budget is on by default (20 failures / 10 minutes) and only affects addresses that have never signed in successfully.