Built-in Gateway Pages
Built-in pages need no mapping. Append a built-in path to any subdomain that resolves and forwards to the fn-knock gateway:
https://nas.example.com/__select__
https://nas.example.com/__wol__The path must match exactly: /__select__/ and /__wol__/ are not built-in pages. The subdomain must reach the gateway, and its certificate, CDN, reverse proxy, or tunnel must correctly handle the domain and Host.
Application selection: /__select__
System Settings → Gateway → Mapping selection page is enabled by default. When disabled, /__select__ and requests that would otherwise open the selection page follow the unmatched-route policy: an error page or a connection abort, without listing mappings. This switch is independent of the portal switch and does not change mappings or their access permissions. After changing this switch, click Save settings on the gateway page.
With the mapping selection page enabled, open https://any-gateway-subdomain/__select__ to show the application selection page. Visitors sign in first when needed; after sign-in, only services available to the current credential are shown.
With a custom service scope, select the built-in selection page under Authentication Configuration → Permissions. Opening it does not grant access to unauthorized services.
Wake-on-LAN: /__wol__
Open https://any-gateway-subdomain/__wol__ to view enabled devices and send a wake request.
All of the following are required:
- Enable WOL under
System Settings → Features → Wake-on-LAN. - Enable
Show Wake-on-LAN shortcutunderSystem Settings → Gateway → Portal. - Sign in; custom scopes must also select the built-in Wake-on-LAN page.
When the shortcut is disabled, /__wol__ returns Not Found and is not forwarded upstream.
Sign-in fallback: /__auth__/…
/__auth__ is not automatically used by every subdomain.
| Situation | Sign-in address |
|---|---|
| Application subdomain is under the configured root domain and can share its Cookie | Shared authentication Host, such as auth.example.com |
| Application subdomain is outside the root-domain Cookie scope and cannot share the session | Its own /__auth__/login |
For a root domain of example.com and an authentication Host of auth.example.com, nas.example.com uses shared sign-in; nas.other-example.net signs in separately at:
https://nas.other-example.net/__auth__/loginThat session belongs only to the current subdomain and cannot be shared with services under example.com. /__auth__/… also contains authentication endpoints such as logout and OIDC callbacks; do not use it as a public API.