中文
EasyTier 组网
「组网与穿透」新增 EasyTier：托管 easytier-core 进程，把本机加入 EasyTier 组网，优先 P2P 打洞直连，打不通时经公共节点或自建节点中继。
- 多实例：每个实例是独立的进程，同一台机器可以分别加入不同的组网；
- 在线安装、更新与回滚，Windows 安装包自带 wintun.dll 等依赖；
- 网络密钥经环境变量传给进程，不出现在命令行，日志中打码；共享本地网段或允许作为出口节点时必须设置密钥；
- 实例卡片显示虚拟 IP、监听地址与节点列表（直连 / 中继、延迟、连接协议），TUN 网卡无法创建或进程启动即退出时显示原因；
- 同时启用的实例端口、网卡名冲突时拒绝保存。
入侵防护
- TLS 握手失败规则（#90）：日志规则新增来源「TLS 握手失败」，按失败类型（中途断开、重置、超时、非 TLS 或协议错误、无法协商参数、未知域名、客户端中止、其他）、监听与次数封禁；内置「TLS 异常握手」与「TLS 握手中断」两个模板，可粘贴失败原因测试归类。来源是 Web 服务「可信代理」中的地址时不计数。
- 端口扫描检测识别模块端口：各模块监听成功后立即登记为开放端口（300 毫秒内生效），包括 frps 的绑定、vhost、对外 dashboard、allowPorts 范围与 frpc 申请的远程端口，EasyTier 的监听与端口转发，Tailscale、NetBird 对外的 SOCKS5 端口；停止监听后 10 分钟内仍视为开放，frpc 掉线重连期间的正常访客不会被当成扫描封禁。
通知中心
- 新地址登录提醒（#92）：新增事件
login.newip（警告级别），管理后台登录成功且来源地址此前从未登录成功过时发布；覆盖密码、Passkey、第三方与飞牛统一网关登录；第一次登录只建立基线，IPv6 按 /64 归并，最多记录 200 个来源。「安全与登录」模板已包含。
其他
- 只读账号与只读 API 令牌查看托管程序配置时，环境变量只显示变量名，额外参数整体隐藏。
- 登录页用户名或密码为空时直接提示；列表卡片操作按钮固定在底部对齐。
更新说明：https://gately.cn/news/v0.6.6.2
English
EasyTier
"Networking & Tunnels" adds EasyTier: Gately manages easytier-core to join this machine to an EasyTier network, preferring P2P hole punching and falling back to public or self-hosted relay nodes.
- Multiple instances, each its own process, so one machine can join several networks;
- Online install, update and rollback; the Windows package includes wintun.dll and other dependencies;
- The network secret is passed through an environment variable, never on the command line, and masked in logs; a secret is required when sharing local subnets or acting as an exit node;
- Instance cards show the virtual IP, listeners and peers (direct / relay, latency, tunnel protocol), plus the reason when the TUN device cannot be created or the process exits at start;
- Saving is refused when enabled instances conflict on ports or interface names.
Intrusion prevention
- TLS handshake failure jails (#90): log jails get a new source "TLS handshake failures" that bans by failure type (EOF, reset, timeout, not TLS or protocol error, cannot negotiate, unknown domain, client abort, other), listener and count, with "TLS abnormal handshake" and "TLS handshake aborted" templates and a test panel for failure reasons. Peers listed as trusted proxies in the web service are not counted.
- Scan detection knows module ports: modules register their ports as open as soon as they listen (effective within 300 ms), including frps bind, vhost, public dashboard, allowPorts ranges and the remote ports frpc requests, EasyTier listeners and port forwards, and the public SOCKS5 ports of Tailscale and NetBird. Ports stay open for 10 minutes after they stop listening, so visitors reconnecting while frpc reconnects are not banned as scanners.
Notifications
- New address sign-in alert (#92): a new
login.newipevent (warning) is published when an admin sign-in succeeds from an address that never signed in before; it covers password, Passkey, third-party and fnOS gateway logins, the first sign-in only builds the baseline, IPv6 is grouped by /64, and up to 200 sources are kept. The "Security & sign-ins" template includes it.
Other
- Read-only accounts and read-only API tokens see only variable names for managed program environment variables, and extra arguments are hidden.
- The login page warns about an empty username or password without sending a request; list card action buttons stick to the bottom and line up.
Release notes: https://gately.cn/en/news/v0.6.6.2