v0.6.2.2

中文

Web 服务拓扑视图（#54）

Web 服务页头新增「列表 / 拓扑」切换。拓扑视图按 互联网 → Gately → 监听 → 站点 / 监听级动作 → 后端 / 去向 排成五列，每 2 秒刷新：

• 节点显示运行状态、匹配方式、QPS 与进行中请求数，不可用的后端与启动失败的监听标红，默认站点断开、HTTPS 跳转、未匹配站点的 404 等预期配置以灰色显示；
• 连线粗细随 QPS 变化，悬停或点击节点高亮整条链路并标出 QPS 与流量；
• 详情面板列出 QPS、60 秒均值、流量、进行中与累计请求、后端错误、按原因的拦截次数、状态码分布、近 60 秒曲线与经过该节点的活动 IP，每项指标附口径说明；
• 选择一个活动 IP 后只高亮它走过的链路，精确到具体后端；
• 打码开关把 IP 末段与后端、监听、跳转目标和错误信息中的地址显示为 *，便于截图分享。

数据全部来自本实例内存中的计数，接口为 GET /api/webservice/topology，只读账号可以查看。站点统计同时新增按原因的拦截次数与各后端的请求数、流量，Prometheus 新增 gately_site_blocked_total、gately_upstream_requests_total、gately_upstream_response_bytes_total 与 gately_listener_requests_total。详见 Web 服务 · 拓扑视图。

可信代理下的访客真实 IP（#50）

Web 服务「全局设置」新增「访客真实 IP」：填写 CDN、WAF 等可信代理的回源地址或网段，并按顺序选择真实 IP 请求头（CF-Connecting-IP、X-Forwarded-For、X-Real-IP、True-Client-IP 或自定义）。只有直接对端属于可信代理时才读取这些头，访客直接访问时自带的头一律忽略；X-Forwarded-For 自右向左跳过可信代理。取到的地址用于访问日志、IP 名单、仅内网访问、国家过滤、封禁、统计与转发给后端的头。使用 Cloudflare 时建议选 CF-Connecting-IP。详见 Web 服务。

站点实时连接（#51）

站点列表的每个域名行显示进行中的请求数，「连接」窗口每 2 秒刷新：

• 实时列表显示来源地址、协议（h1 / h2 / h3，WebSocket 单独标记）、方法与路径（不含查询串）、已持续时间与上下行流量，可按 IP 搜索；
• 历史记录保留每个站点最近 200 条持续 1 秒以上或被手动断开的请求，只在内存中；
• 可以断开单个请求（HTTP/2、HTTP/3 只重置这个请求流），或断开并封禁来源地址，同时断开它在全部站点上的请求。不能封禁自己当前使用的地址、回环地址与可信代理。

来源 IP 访问控制（#49）

端口转发、协议分流、STUN 内置转发与 frps 实例都可以设置白名单或黑名单，名单由手填的 IP / 网段和 Web 服务中的订阅 IP 列表组成，订阅列表刷新后立即生效，不重启规则：

• 入侵防护的封禁最先检查，然后才是名单；
• 规则卡片显示访问模式与拒绝次数，IP 列表页显示哪些规则引用了它，被引用的列表不能删除；
• frps 的名单在 frpc 登录时检查，保护绑定端口；
• 从 Lucky 导入端口转发与 STUN 规则时，安全模式一并转换为来源 IP 访问控制（需同时上传 lucky_ipfilter.lkcf）。

详见 端口转发 与 内网穿透。

站点链接（#52）

站点列表中的每个具体域名都可以点击打开，旁边可复制带协议与端口的完整地址；经协议分流、端口映射、frp 或 CDN 访问时，可以在监听里填写对外的访问地址。frpc 的 http / https 代理、File Browser 访问地址、Cloudflare 临时隧道与 Tailscale 登录链接也可以点击和复制。域名保存时统一为浏览器发送的形式（小写，中文域名转为 punycode），带端口、路径等永远匹配不上的写法会被拒绝。

动态域名

• 记录备注（留空用任务备注）写入阿里云、Cloudflare、腾讯云、DNSPod 与华为云的控制台；
• 删除记录或任务时可勾选「同时从 DNS 服务商删除」，14 个服务商支持。只删除值与 Gately 最近一次同步结果相同的那条解析，值未知、在控制台改过或记录集中还有其他值时都不删除并说明原因；
• 模块开关移入「全局设置」，可设置删除勾选框的默认值。

其他改进

• Docker 页面可以直接升级 Gately 自身所在的容器：先拉取新镜像，有新版本时由临时辅助容器完成重建，失败时恢复旧容器；Web 终端的本机 Shell 运行在 Gately 容器内时会提示改用这里升级；
• 手机上的 Web 终端长按约半秒进入选择模式，可用系统的选择手柄与复制菜单，换行被拆开的长行复制时会还原；按键栏新增粘贴键，HTTP 访问时打开粘贴面板，可重发本标签页最近复制或输入的 10 条文本；粘贴多行且远端程序没有开启括号粘贴时先确认；
• 认证用户页可以直接取消只靠共享用户认证的站点，保存前确认会关闭这些站点的认证；
• 协议分流修改规则时，协议、域名与 ALPN 不变的路由保留命中次数；
• 网络诊断测速默认节点改用 50 MB 请求，修复 Cloudflare 返回 403，新增 Vultr、Hetzner、OVH 测速节点，任务标题只显示当前工具的目标；
• 默认站点按名单断开访问时，拒绝按 444 计入 Web 路径探测（#53）；
• 安全入口开启时 iOS 添加到主屏幕的图标不再显示为字母占位。

修复与加固

• Web 终端粘贴时去掉控制字符，内嵌的括号粘贴结束序列无法绕过多行确认；从系统剪贴板直接读到的内容不写入剪贴板记录，退出登录或会话失效时清空记录；
• 断开请求与请求自然结束同时发生时，不再影响同一连接上的下一个请求；
• 同时发起两次升级 Gately 自身时拒绝第二次；升级辅助容器连同匿名卷一起删除，同一 Docker 上的多个 Gately 只处理自己的辅助容器；
• 编辑动态域名任务时删除记录并勾选同时从服务商删除，先校验待保存的配置，校验失败时不删除服务商处的解析；腾讯云同步时按主机记录精确匹配；
• 修复热更新站点时与进行中的请求之间的数据竞争；后端地址在日志、事件与监控指标中去掉用户名、密码与查询串；
• 离开页面后连接与统计窗口停止轮询；封禁失败时保留封禁窗口；frp 子域名拒绝 IPv6 地址；从 Lucky 导入黑名单模式的规则缺少名单时给出提示。

升级提示

• Docker 拉取新镜像后重建容器，已挂载 Docker 套接字的也可以在 Gately 的 Docker 页面直接升级 Gately 自身；OpenWrt 覆盖安装新的 .apk / .ipk；飞牛在应用中心手动安装新版 .fpk；其他部署方式可在「系统设置」中在线升级。

English

Web Services topology view (#54)

The Web Services page header gains a List / Topology switch. The topology view lays out Internet → Gately → listeners → sites / listener actions → backends / destinations in five columns and refreshes every 2 seconds:

• nodes show their state, match type, QPS and requests in progress; unavailable backends and listeners that failed to start are red, and expected setups such as a default site that closes the connection, the HTTPS redirect and the 404 when no site matches are gray;
• edge width follows QPS, and hovering or clicking a node highlights its whole path with QPS and traffic on the edges;
• the details panel shows QPS, the 60-second average, traffic, requests in progress and in total, backend errors, blocked requests by reason, status codes, 60-second charts and the active IPs passing through the node, each metric with a note on how it is counted;
• picking an active IP highlights only the path it took, down to the exact backend;
• the mask switch shows the last part of IPs and the addresses in backends, listeners, redirect targets and error messages as * for sharing screenshots.

All numbers come from in-memory counters of this instance through GET /api/webservice/topology, which read-only accounts can view. Site statistics also gain blocked requests by reason and per-backend requests and traffic, and Prometheus gains gately_site_blocked_total, gately_upstream_requests_total, gately_upstream_response_bytes_total and gately_listener_requests_total. See Web Services · Topology view.

Real visitor IP behind trusted proxies (#50)

Web Services → Global settings gains "Visitor real IP": enter the origin-facing addresses or ranges of trusted proxies such as a CDN or WAF, and pick the real IP headers in order (CF-Connecting-IP, X-Forwarded-For, X-Real-IP, True-Client-IP or a custom name). These headers are read only when the direct peer is a trusted proxy; headers sent by visitors connecting directly are ignored, and X-Forwarded-For is read right to left skipping trusted proxies. The resulting address is used by access logs, IP lists, LAN-only access, country filtering, bans, statistics and the headers sent to backends. With Cloudflare, CF-Connecting-IP is the recommended header. See Web Services.

Live connections per site (#51)

Each domain row in the site list shows the number of requests in progress, and the Connections window refreshes every 2 seconds:

• the live list shows the source address, protocol (h1 / h2 / h3, with WebSocket marked), method and path (without the query string), duration and traffic in both directions, searchable by IP;
• the history keeps the latest 200 requests per site that lasted at least 1 second or were closed manually, in memory only;
• a single request can be closed (HTTP/2 and HTTP/3 reset only that stream), or closed with its source address banned, which also closes its requests on every site. Your own current address, loopback addresses and trusted proxies cannot be banned.

Source IP access control (#49)

Port Forwarding, Protocol Routing, STUN built-in forwarding and frps instances can each use an allowlist or a blocklist built from IPs / subnets typed in by hand and the subscribed IP lists of Web Services; a refreshed list takes effect at once without restarting the rule:

• Intrusion Prevention bans are checked first, then the list;
• rule cards show the access mode and refusal count, the IP list page shows which rules reference a list, and a referenced list cannot be deleted;
• the frps list is checked when frpc logs in and protects the bind port;
• importing port forwarding and STUN rules from Lucky converts their safe mode into source IP access control (upload lucky_ipfilter.lkcf in the same import).

See Port Forwarding and Tunnels.

Site links (#52)

Each exact domain in the site list opens in a new tab, with a button that copies the full URL including scheme and port; when visitors come through Protocol Routing, a port mapping, frp or a CDN, the listener can be given the public access address. frpc http / https proxies, File Browser access URLs, the Cloudflare quick tunnel address and the Tailscale login link can be opened and copied the same way. Domains are saved in the form browsers send (lowercase, internationalized domains in punycode), and values that could never match, such as ones with a port or a path, are rejected.

Dynamic DNS

• Record remarks (or the task remark when empty) are written to Alibaba Cloud, Cloudflare, Tencent Cloud, DNSPod and Huawei Cloud;
• deleting records or tasks offers "Also delete from the DNS provider", supported by 14 providers. Only the record whose value matches Gately's last sync is deleted; when the value is unknown, was changed in the console, or the record set holds other values, nothing is deleted and the reason is shown;
• the module switch moves into Global settings, which also sets the default of the delete checkbox.

Other improvements

• The Docker page can upgrade the container Gately itself runs in: the new image is pulled first and, only when there is a new version, a temporary helper container recreates the container, restoring the old one if the new one fails to start; the Web Terminal's local shell points to this action when it runs inside the Gately container;
• on phones, pressing and holding the Web Terminal for about half a second enters a selection mode with the system selection handles and copy menu, and soft-wrapped lines are joined back when copied; the key bar gains a paste key that opens a paste panel over HTTP, where the last 10 texts copied or typed in this tab can be sent again; pasting several lines asks first when the remote program has not enabled bracketed paste;
• the Auth users page can clear sites that authenticate only with shared users, confirming before it turns their authentication off;
• editing a Protocol Routing rule keeps the hit counts of routes whose protocol, domains and ALPN are unchanged;
• the Network Tools speed test asks for 50 MB per request, fixing HTTP 403 from Cloudflare, adds Vultr, Hetzner and OVH test nodes, and task titles show only the target of the current tool;
• denials on a default site that closes the connection for visitors outside its list count as 444 for Web path probing (#53);
• the home screen icon on iOS no longer falls back to a letter placeholder when a safe entry path is set.

Fixes and hardening

• The Web Terminal strips control characters from pasted text, so an embedded end-of-bracketed-paste sequence cannot skip the multi-line confirmation; text read straight from the system clipboard is not added to the clipboard history, and the history is cleared on sign-out or when the session expires;
• closing a request at the moment it ends no longer affects the next request on the same connection;
• a second upgrade of Gately itself started while one is in progress is rejected; the upgrade helper container is removed together with its anonymous volume, and several Gately instances on one Docker host only handle their own helpers;
• when editing a Dynamic DNS task removes records with "Also delete from the DNS provider" checked, the configuration about to be saved is validated first and nothing is deleted at the provider if validation fails; Tencent Cloud syncing matches the host record exactly;
• fixed a data race between hot-reloading sites and requests in flight; backend addresses in logs, events and metrics leave out the user name, password and query string;
• the Connections and statistics windows stop polling after leaving the page; the ban dialog stays open when banning fails; frp subdomains reject IPv6 addresses; importing a Lucky rule in blocklist mode warns when its list is missing.

Upgrade notes

• Docker: pull the new image and recreate the container; when the Docker socket is mounted, Gately can also upgrade itself from its Docker page. OpenWrt: install the new .apk / .ipk over the old one. fnOS: install the new .fpk manually in the App Center. Other deployments can upgrade online in Settings.