v0.5.6

Highlights / 亮点

Intrusion Prevention (fail2ban-style) / 入侵防护（类 fail2ban） (#10)

• Log jails read log files (following rotation), the systemd journal, command output such as logread -f on OpenWrt, or Docker container logs, find failures with regular expressions and <HOST>, and ban an IP that reaches the count within the time window. Templates for SSH, Dropbear, Nginx, Vaultwarden, Home Assistant, Proxmox VE and more, anchored so user-controlled fields cannot inject another IP; paste sample lines into the editor to test. / 日志规则读取日志文件（自动跟随轮转）、systemd 日志、命令输出（如 OpenWrt 的 logread -f）或 Docker 容器日志，用正则与 <HOST> 找出失败记录，同一 IP 在统计窗口内达到次数即封禁。内置 SSH、Dropbear、Nginx、Vaultwarden、Home Assistant、Proxmox VE 等模板，均锚定行尾，用户名等字段无法注入其他 IP；编辑时可粘贴日志样例测试。
• Failed admin console logins and WAF blocks can feed a jail without any regular expression. / 管理后台登录失败、WAF 拦截也能作为规则来源，不用写正则。
• Trap ports ban any source that connects to ports this host does not use; port-scan detection bans sources that hit closed ports more often than the threshold per minute. / 诱饵端口：连接本机未使用端口的来源立即封禁；端口扫描检测：每分钟连接未开放端口超过阈值即封禁。
• One ban list for manual bans (CIDR networks and permanent bans), the web service's failed-auth bans and everything above; persisted, escalating durations for repeat offenders, and a whitelist that ignores LAN, loopback, 100.64.0.0/10 and this host's IPv6 /64 networks by default. / 统一封禁表：手动封禁（支持网段与永久）、Web 服务认证失败封禁与上述来源都在这里，重启保留，重复违规时长翻倍；白名单默认忽略内网、回环、100.64.0.0/10 与本机所在的 IPv6 /64。
• Bans are written to a separate inet gately table in nftables and dropped in the kernel, including traffic forwarded to Docker containers and LAN devices; replies to connections the host opens itself still get through; the table is removed when Gately stops and rewritten if another program deletes it. Port forwarding, web services, STUN, WebDAV, FTP and the admin console also reject banned addresses. / 封禁写入 nftables 中独立的 inet gately 表并在内核层丢弃，发往 Docker 容器与内网设备的转发流量同样拦截；本机主动发起连接的回包不受影响；Gately 停止时删表，被其他程序删除后自动重写。端口转发、Web 服务、STUN、WebDAV、FTP 与管理后台也直接拒绝被封地址。
• Where nftables is unavailable (Windows, macOS, FreeBSD, Linux without nftables or permission), bans apply to Gately's own services, trap ports fall back to user-space listeners and scan detection is off; the page explains why. / 没有 nftables 或权限的平台：封禁只对 Gately 自身的服务生效，诱饵端口改由 Gately 监听，扫描检测不可用，页面会说明原因。
• New “Intrusion Prevention: IP banned” event, overview summary, Prometheus metrics and self-check results. / 新增「入侵防护：IP 已被封禁」事件、总览摘要、Prometheus 指标与自检项。

Other / 其他

• Docker settings show the Docker daemon's own registry mirrors (registry-mirrors in daemon.json). / Docker 设置显示 Docker 守护进程自己的镜像加速地址。(#11)
• Fixed turning on scheduled backups failing with unknown field "hasPassword". / 修复开启定时备份时报 unknown field "hasPassword"。(#9)

Upgrading / 升级

• Linux binary installs upgrade from the About page; Docker: pull the new image and recreate the container; fnOS: install the new .fpk; OpenWrt: install the new .ipk / .apk. / Linux 二进制在「关于」页直接升级；Docker 拉取新镜像后重建容器；飞牛安装新版 .fpk；OpenWrt 安装新版 .ipk / .apk。
• Docker: add cap_add: [NET_ADMIN] (with network_mode: host) for firewall-level bans; the image now ships nftables. / Docker 需在 compose 中加入 cap_add: [NET_ADMIN]（并使用 host 网络）才能在防火墙层封禁，镜像已内置 nftables。
• Linux instances running as root create the inet gately table after upgrading; with no bans it holds only empty rules. Turn sync off under Intrusion Prevention → Settings, or disable the module, if you do not want it. / 以 root 运行的 Linux 升级后会自动创建 inet gately 表，没有封禁时只有空规则；不需要可在「入侵防护 → 设置」关闭同步或关闭整个模块。
• The web service's failed-auth bans now use the shared ban list and apply to the whole host when firewall sync is on; “Ignore LAN addresses” (on by default) keeps LAN addresses from being banned this way. For sites behind a CDN that passes the real IP in a header, do not enable the WAF jail or failed-auth bans. / Web 服务认证失败封禁并入统一封禁表，开启防火墙同步后对整机生效；默认开启的「忽略内网地址」使内网地址不再被这类封禁。经 CDN 按请求头传递真实 IP 的站点不要启用 WAF 规则与认证失败封禁。

Release notes: https://gately.cn/en/news/v0.5.6 · 更新说明：https://gately.cn/news/v0.5.6