Description
To reach a NAS from outside you set up a DDNS script, then port forwarding, then an Nginx reverse proxy, then another tool to renew the certificates, with Tailscale and frp as separate services on top, and when one of them dies you go through logs one by one. Gately folds all of that into a single binary with one web console.
The most useful part is that port forwarding can route by SNI: several services share port 443 and are passed through to different backends by domain name, and with the built-in web service handling reverse proxy and HTTPS, one process can replace the usual haproxy plus nginx pair. In the author's same-machine comparison it pushes noticeably more throughput on the same configuration, at roughly 110 MB of resident memory.
It is fully open source, makes no connections to project-run servers by default and reports no device information. Every outbound address is visible, editable and can be switched off. Configuration is plain JSON you can keep in git for auditing and rollback, and if you are coming from Lucky you can import the old config instead of starting over.
Dynamic DNS: Alibaba Cloud, Cloudflare, Tencent Cloud, DNSPod, Huawei Cloud and a dozen more providers, plus custom callbacks, for both IPv4 and IPv6.
STUN traversal: Punch through on networks without a public IP and trigger a webhook or script when the address changes.
Port forwarding with SNI routing: TCP/UDP forwarding with multi-target failover and PROXY protocol, letting several services share one port.
SSL certificates: Automatic ACME issuance and renewal, DNS-01 for wildcards and HTTP-01 when you have no DNS provider; after renewal it can push certificates to other hosts or restart the Docker containers that use them.
Web services and WAF: Per-domain reverse proxy, redirects or static sites with HTTP/3, load balancing, health checks and rate limiting, plus a built-in Coraza and OWASP CRS firewall.
Tailscale, frp and Cloudflare Tunnel: Manages tailscaled, frpc/frps and cloudflared tunnels, with changes applied immediately.
Intrusion prevention: Fail2ban-style jails read logs, Docker logs and WAF blocks, and sync bans to the system nftables firewall.
Docker and web terminal: Create containers, read logs, run Compose and upgrade images in one click, plus SSH and Telnet web terminals with an SFTP file manager.
Deployment: Docker images, a native fnOS app and OpenWrt packages, along with Windows, macOS and Linux binaries; fnOS administrators can sign in with their fnOS session.
Config and monitoring: Config history with diff and rollback, Prometheus metrics with a Grafana dashboard, a CLI and an MCP interface.
The most useful part is that port forwarding can route by SNI: several services share port 443 and are passed through to different backends by domain name, and with the built-in web service handling reverse proxy and HTTPS, one process can replace the usual haproxy plus nginx pair. In the author's same-machine comparison it pushes noticeably more throughput on the same configuration, at roughly 110 MB of resident memory.
It is fully open source, makes no connections to project-run servers by default and reports no device information. Every outbound address is visible, editable and can be switched off. Configuration is plain JSON you can keep in git for auditing and rollback, and if you are coming from Lucky you can import the old config instead of starting over.
Features
Dynamic DNS: Alibaba Cloud, Cloudflare, Tencent Cloud, DNSPod, Huawei Cloud and a dozen more providers, plus custom callbacks, for both IPv4 and IPv6.
STUN traversal: Punch through on networks without a public IP and trigger a webhook or script when the address changes.
Port forwarding with SNI routing: TCP/UDP forwarding with multi-target failover and PROXY protocol, letting several services share one port.
SSL certificates: Automatic ACME issuance and renewal, DNS-01 for wildcards and HTTP-01 when you have no DNS provider; after renewal it can push certificates to other hosts or restart the Docker containers that use them.
Web services and WAF: Per-domain reverse proxy, redirects or static sites with HTTP/3, load balancing, health checks and rate limiting, plus a built-in Coraza and OWASP CRS firewall.
Tailscale, frp and Cloudflare Tunnel: Manages tailscaled, frpc/frps and cloudflared tunnels, with changes applied immediately.
Intrusion prevention: Fail2ban-style jails read logs, Docker logs and WAF blocks, and sync bans to the system nftables firewall.
Docker and web terminal: Create containers, read logs, run Compose and upgrade images in one click, plus SSH and Telnet web terminals with an SFTP file manager.
Deployment: Docker images, a native fnOS app and OpenWrt packages, along with Windows, macOS and Linux binaries; fnOS administrators can sign in with their fnOS session.
Config and monitoring: Config history with diff and rollback, Prometheus metrics with a Grafana dashboard, a CLI and an MCP interface.
