Manage SecLayer directly from the command line using the seclayer binary.
Overview
The seclayer CLI allows administrators to manage firewall rules, allow or block IPs, inspect active connections, control the Login Failure Daemon (LFD), configure DDoS protection, and execute self-updates directly from SSH.
root@server:~# seclayer --help
Firewall Control Commands
Command Flag
Description
Example
-s, --start
Start the firewall service & apply rules
seclayer -s
-f, --stop
Stop the firewall service & flush rules
seclayer -f
-r, --restart
Restart the firewall service
seclayer -r
-l, --status
List active firewall rules and backend status
seclayer -l
-c, --check <ip>
Check if an IP is allowed, denied, temp-banned, or ignored
seclayer -c 198.51.100.45
Allow & Deny IP Management
Command Flag
Description
Example
-a, --add <ip> [comment]
Permanently allow an IP or CIDR range
seclayer -a 192.0.2.10 "Office IP"
-ar, --allowrm <ip>
Remove an IP from the allow list
seclayer -ar 192.0.2.10
-d, --deny <ip> [comment]
Permanently block an IP or CIDR range
seclayer -d 203.0.113.50 "Attacker IP"
-dr, --denyrm <ip>
Remove an IP from the block list
seclayer -dr 203.0.113.50
Temporary Bans & Allows (TTL)
Command Flag
Description
Example
-td, --tempdeny <ip> <secs> [comment]
Temporarily ban an IP for a specified duration (in seconds)
seclayer -td 198.51.100.88 3600 "Brute force"
-tr, --temprm <ip>
Remove a temporary ban early
seclayer -tr 198.51.100.88
-ta, --tempallow <ip> <secs> [comment]
Temporarily allow an IP for a specified duration (in seconds)
seclayer -ta 192.0.2.25 1800 "Admin access"
-tar, --tempallowrm <ip>
Remove a temporary allow entry early
seclayer -tar 192.0.2.25
-t, --temp
List all active temporary entries (bans & allows with remaining TTL)
seclayer -t
-tf, --tempf
Flush all temporary bans immediately
seclayer -tf
LFD (Login Failure Daemon) Control
Command Flag
Description
Example
--lfd --start
Start the LFD daemon service
seclayer --lfd --start
--lfd --stop
Stop the LFD daemon service
seclayer --lfd --stop
--lfd --restart
Restart the LFD daemon service
seclayer --lfd --restart
--lfd --status
Display LFD running status and PID
seclayer --lfd --status
DDoS Protection & Bandwidth Throttling
Command Flag
Description
Example
--ddos-status
Show DDoS protection state and thresholds
seclayer --ddos-status
--ddos-connections
List active connection counts per remote IP
seclayer --ddos-connections
--ddos-check
Trigger an on-demand connection flood audit
seclayer --ddos-check
--ddos-enable / --ddos-disable
Toggle DDoS protection module
seclayer --ddos-enable
--ddos-bw-throttle <ip> <rate>
Throttle bandwidth for an IP using tc (e.g. 1mbit)
seclayer --ddos-bw-throttle 198.51.100.9 1mbit
--ddos-bw-remove <ip>
Remove bandwidth throttle for an IP
seclayer --ddos-bw-remove 198.51.100.9
System, License & Updates
Command Flag
Description
Example
--license
Display license details, plan, and expiry date
seclayer --license
--refresh-license
Force a remote license activation check
seclayer --refresh-license
--check-update
Check if a new SecLayer software release is available
seclayer --check-update
--update [--force]
Apply software updates automatically
seclayer --update
--csfmigrate
Migrate CSF lists, ignore files and settings, then stop and disable CSF's services (CSF is not uninstalled). See Migrating from CSF
seclayer --csfmigrate
--security-check
Show the Security Check checklist (same as the admin panel's Security Check page)