wangwanjie/gately v0.6.5.5

on GitHub

中文

端口敲门（#80）

新增「端口敲门」模块（网络组），兼容 fwknop 客户端的单包授权（SPA）：AES 加密 + HMAC 认证，先校验 HMAC 再解密，防重放并校验时间戳。默认在 UDP 62201 接收敲门包。

• 规则可在系统防火墙中拦截受保护端口（nftables；内核没有 nf_tables 时用 iptables + ipset），敲门成功的地址在放行时长内可以建立新连接，已建立的连接不受影响；Gately 停止时删除拦截规则。
• 默认内网免敲门（私有地址、本机 IPv6 网段，不含 100.64.0.0/10），可追加免敲门白名单。
• 端口转发、协议分流、STUN 的访问控制可选择「需要敲门」，由 Gately 自己检查，不需要防火墙权限；协议分流可按路由要求敲门，spa 路由经 TCP 接收敲门包（fwknop -P tcp），只开一个端口即可。
• 入侵防护可把敲门被拒绝作为事件来源（模板：10 分钟 5 次封禁一天）。UDP 来源地址可伪造，未通过 HMAC 认证的 UDP 包只计数、不计入封禁。
• 规则卡片生成 fwknop 命令行与 ~/.fwknoprc 配置段。

网络唤醒：客户端关机与 HTTP 关机

• 客户端方式：在 Windows、Linux、macOS、OpenWrt 上安装客户端（计划任务或 systemd / OpenRC / launchd / procd 服务），客户端主动长轮询 Gately，设备不必开放端口，只执行关机、重启、睡眠，执行前先确认、10 秒未确认即作废。安装命令先校验脚本 SHA-256 再执行，凭据不出现在命令行参数中。
• HTTP 方式：发送配置的请求（Home Assistant、智能插座等），2xx 视为成功。

Web 服务

• 信任已登录用户（#81）：站点开关，已通过本站点 Gately 认证的访客跳过 WAF，也不计入入侵防护的路径探测；封禁、IP / 国家访问控制、限流照常生效。第三方登录只信任允许列表中逐个列出的身份，提供方:* 通配身份照常经过 WAF。
• 按用户分流支持重定向、静态文件、导航面板、固定文本站点（#79）：命中规则的用户反代到规则后端，其余访客按站点类型处理。
• 带本实例有效管理员会话的请求跳过站点 WAF：经站点访问管理后台时，保存配置不再被 CRS 规则误拦成 403；只读账号仍经过 WAF。

修复

• OpenWrt 安装包（#82）：apk 装了其他架构的包时不再替换可以运行的 gately 程序（OpenWrt 25.12 的 apk 在架构校验失败后仍会替换文件，把安装包注入固件时离线目录混入 arm64 包会导致刷机后 crash loop）。注入固件或离线安装时，目录里只放对应架构的包。
• 接口文档列出模块的免登录接口（网络唤醒客户端）。

更新说明：https://gately.cn/news/v0.6.5.5

English

Port knocking (#80)

A new Port Knocking module (Network group) implements Single Packet Authorization compatible with the fwknop client: AES encryption with HMAC authentication checked before decrypting, replay protection and timestamp checks. Knock packets are received on UDP 62201 by default.

• Rules can block their protected ports in the system firewall (nftables, or iptables + ipset when the kernel has no nf_tables); an address that knocked successfully can open new connections for the grant period, established connections are unaffected, and the rules are removed when Gately stops.
• Local networks need no knock by default (private addresses and the host's IPv6 prefixes, not 100.64.0.0/10), plus an allow list.
• Port forwarding, protocol routing and STUN access control can require a knock, checked by Gately itself without firewall permissions; protocol routing can require a knock per route, and an spa route accepts knock packets over TCP (fwknop -P tcp), so a single open port is enough.
• Intrusion prevention can use rejected knocks as an event source (template: 5 in 10 minutes bans for a day). UDP source addresses can be forged, so UDP packets failing HMAC authentication are only counted and never lead to a ban.
• Rule cards generate the fwknop command line and a ~/.fwknoprc stanza.

Wake-on-LAN: agent and HTTP shutdown

• Agent: install it on Windows, Linux, macOS or OpenWrt (scheduled task or systemd / OpenRC / launchd / procd service). It long-polls Gately, so the device opens no port, and it only shuts down, reboots or sleeps, each confirmed before it runs and expiring after 10 seconds. Install commands verify the script's SHA-256 before running it and keep the token out of command lines.
• HTTP: sends a configured request (Home Assistant, smart plugs) and treats 2xx as success.

Web services

• Trust signed-in users (#81): per-site option; visitors authenticated by the site's own Gately authentication skip the WAF and are not counted by intrusion prevention's path probing, while bans, IP / country access control and rate limits still apply. Third-party logins are only trusted for identities listed one by one; provider:* wildcard identities still go through the WAF.
• Routing by user works on redirect, static file, navigation panel and fixed text sites (#79): users matching a rule are proxied to its backends, other visitors get the site type's own response.
• Requests carrying a valid administrator session of this instance skip the site's WAF, so saving configuration through an admin site is no longer blocked with 403 by CRS rules; read-only accounts are still checked.

Fixes

• OpenWrt packages (#82): installing an apk built for another architecture no longer replaces a working gately binary (the apk in OpenWrt 25.12 still replaces files after the architecture check fails, so an offline folder that also held the arm64 package caused a crash loop after flashing an image with injected packages). Keep only the package for the device architecture when injecting packages or installing offline.
• The API docs list login-free module endpoints (Wake-on-LAN agent).

Release notes: https://gately.cn/en/news/v0.6.5.5