中文
群晖 DSM 等内核没有 nf_tables 的系统（#74）
- 入侵防护在内核没有 nf_tables、或系统没有 nft 命令时改用 iptables（legacy）与 ipset：规则写在 mangle 表中 Gately 自己的链里，先于群晖防火墙和 Docker 的规则处理；手动封禁、永久封禁、诱饵端口与端口扫描检测都在内核层生效，剩余时间超过约 24 天的封禁在到期前自动续写。
- 端口转发、Web 服务、协议分流的「自动放行防火墙」使用 Gately 专用的 iptables 链（
GTLY_OPEN_开头），跳转放在 INPUT 第一位，群晖防火墙重新加载后 30 秒内恢复；Docker 部署与直接安装都适用。 - Docker 镜像内置 iptables-legacy 与 ipset，nftables 可用的系统行为不变；两者都不可用时，入侵防护显示「不可用」并说明原因，不再定时重试。
详见 入侵防护。
Web 站点首段通配（#75）
站点域名的第一段可以写一个 *，例如 api-*.example.com 匹配 api-1.example.com，不匹配更深一级的子域名。匹配顺序为精确域名、通配、*；首段通配优先于 *.example.com，长度相同的通配以列表中靠前的站点为准；重定向中可用 {1} 取 * 匹配的部分。详见 Web 服务。
转发认证：跟随 401 跳转（#76）
转发认证新增「跟随 401 跳转」开关（forwardAuth.loginFromLocation，默认关闭），适用于 Casdoor 等在 401 响应的 Location 中给出动态登录地址的认证服务：开启且未填写「登录跳转」时，把访客 302 跳转到该地址，并传递 Set-Cookie 与 Cache-Control；相对地址、//host、javascript: 等写法保持原样返回 401。
问题修复
- 后端在读完请求体之前就返回响应时（例如在局域网用 Home Assistant iOS 应用登录），HTTP/2 请求会导致 Gately 进程退出。
- 带末尾点的域名（如
example.com.）与不带点的写法匹配同一个站点。 - 诊断包按完整的词、不区分大小写替换主机名：主机名较短时不再把 gately 改成
<hostname>ly，nas-backup这类复合名中的主机名照常替换。 - 网络拓扑的打码覆盖首段通配域名；复制站点的分享链接时使用第一个具体域名。
更新说明：https://gately.cn/news/v0.6.5.2
English
Synology DSM and other kernels without nf_tables (#74)
- Intrusion prevention uses iptables (legacy) and ipset when the kernel has no nf_tables or there is no nft command: the rules live in Gately's own chains in the mangle table, which runs before the rules of the Synology firewall and Docker; manual and permanent bans, trap ports and port-scan detection take effect in the kernel, and bans with more than about 24 days left are written again before they expire.
- "Open firewall automatically" for port forwarding, the Web service and protocol routing uses a dedicated iptables chain (
GTLY_OPEN_…) with its jump first in INPUT, restored within 30 seconds after the Synology firewall reloads; this works in Docker and with a direct install. - The Docker image includes iptables-legacy and ipset; systems where nftables works behave as before. When neither is usable, intrusion prevention shows "Unavailable" with the reason instead of retrying.
See Intrusion Prevention.
First-label wildcards for sites (#75)
A site domain may contain one * in its first label: api-*.example.com matches api-1.example.com but not deeper subdomains. Exact domains match first, then wildcards, then *; a first-label wildcard beats *.example.com, and among wildcards of equal length the site listed first wins; redirects can use {1} for the part matched by *. See Web Service.
Forward auth: 401 redirect (#76)
Forward auth has a new "401 redirect" switch (forwardAuth.loginFromLocation, off by default) for auth services such as Casdoor that put a dynamic login address in the Location of a 401: when it is on and "Login redirect" is empty, the visitor gets a 302 to that address with Set-Cookie and Cache-Control passed along; relative, //host, javascript: and similar forms keep the 401 as it is.
Fixes
- Gately exited when a backend replied before reading the whole request body over HTTP/2, for example when logging in with the Home Assistant iOS app on the LAN.
- A domain with a trailing dot (such as
example.com.) reaches the same site as without the dot. - The diagnostics bundle replaces the host name as a whole word, ignoring case: a short host name no longer turns gately into
<hostname>ly, and compound names such asnas-backupare still redacted. - Masking in the network topology covers first-label wildcard domains; copying a site's share link uses its first concrete domain.
Release notes: https://gately.cn/en/news/v0.6.5.2