CLI Utilities

Manage SecLayer directly from the command line using the seclayer binary.

Overview

The seclayer CLI allows administrators to manage firewall rules, allow or block IPs, inspect active connections, control the Login Failure Daemon (LFD), configure DDoS protection, run diagnostics and reports, manage blocklists and country blocking, sync bans across a cluster, and execute self-updates directly from SSH.

root@server:~# seclayer --help

Firewall Control Commands

Command Flag	Description	Example
`-s`, `--start`	Start the firewall service & apply rules	`seclayer -s`
`-f`, `--stop`	Stop the firewall service & flush rules	`seclayer -f`
`-r`, `--restart`	Restart the firewall service	`seclayer -r`
`-l`, `--status`	List active firewall rules and backend status	`seclayer -l`
`-c`, `--check <ip>`	Check if an IP is allowed, denied, temp-banned, or ignored	`seclayer -c 198.51.100.45`

Allow & Deny IP Management

Command Flag	Description	Example
`-a`, `--add <ip> [comment]`	Permanently allow an IP or CIDR range	`seclayer -a 192.0.2.10 "Office IP"`
`-ar`, `--allowrm <ip>`	Remove an IP from the allow list	`seclayer -ar 192.0.2.10`
`-d`, `--deny <ip> [comment]`	Permanently block an IP or CIDR range	`seclayer -d 203.0.113.50 "Attacker IP"`
`-dr`, `--denyrm <ip>`	Remove an IP from the block list	`seclayer -dr 203.0.113.50`
`-df`, `--denyf`	Remove all currently banned IPs, permanent and temporary	`seclayer -df`

Temporary Bans & Allows (TTL)

Command Flag	Description	Example
`-td`, `--tempdeny <ip> <secs> [-p port] [-d in\|out\|inout] [comment]`	Temporarily ban an IP for a number of seconds. Without `-p` all ports are blocked; `-d` sets the direction (default `inout`)	`seclayer -td 198.51.100.88 3600 "Brute force"`
`-td <ip> <secs> -p <port>`	Temporarily ban an IP on one port only, for example SSH or FTP, leaving its other traffic untouched	`seclayer -td 198.51.100.88 3600 -p 22 "SSH brute force"`
`-td <ip> <secs> -p <port> -d in`	Port-specific ban for incoming traffic only (`in`, `out` or `inout`)	`seclayer -td 198.51.100.88 7200 -p 21 -d in "FTP abuse"`
`-tr`, `--temprm <ip> [-p port]`	Remove a temporary ban early. With `-p` only that port's ban is removed; without it, all of the IP's temporary bans are removed	`seclayer -tr 198.51.100.88 -p 22`
`-ta`, `--tempallow <ip> <secs> [comment]`	Temporarily allow an IP for a specified duration (in seconds)	`seclayer -ta 192.0.2.25 1800 "Admin access"`
`-tar`, `--tempallowrm <ip>`	Remove a temporary allow entry early	`seclayer -tar 192.0.2.25`
`-t`, `--temp`	List all active temporary entries (bans & allows with remaining TTL)	`seclayer -t`
`-tf`, `--tempf`	Flush all temporary bans immediately	`seclayer -tf`

LFD (Login Failure Daemon) Control

Command Flag	Description	Example
`--lfd --start`	Start the LFD daemon service	`seclayer --lfd --start`
`--lfd --stop`	Stop the LFD daemon service	`seclayer --lfd --stop`
`--lfd --restart`	Restart the LFD daemon service	`seclayer --lfd --restart`
`--lfd --status`	Display LFD running status and PID	`seclayer --lfd --status`

DDoS Protection & Bandwidth Throttling

Command Flag	Description	Example
`--ddos-status`	Show DDoS protection state and thresholds	`seclayer --ddos-status`
`--ddos-connections`	List active connection counts per remote IP	`seclayer --ddos-connections`
`--ddos-check`	Trigger an on-demand connection flood audit	`seclayer --ddos-check`
`--ddos-enable` / `--ddos-disable`	Toggle DDoS protection module	`seclayer --ddos-enable`
`--ddos-bw-throttle <ip> <rate>`	Throttle bandwidth for an IP using `tc` (e.g. 1mbit)	`seclayer --ddos-bw-throttle 198.51.100.9 1mbit`
`--ddos-bw-remove <ip>`	Remove bandwidth throttle for an IP	`seclayer --ddos-bw-remove 198.51.100.9`
`--ddos-bw-list`	List bandwidth-throttled IPs with their rate and interface	`seclayer --ddos-bw-list`

System, License & Updates

Command Flag	Description	Example
`--license`	Display license details, plan, and expiry date	`seclayer --license`
`--refresh-license`	Force a remote license activation check	`seclayer --refresh-license`
`--check-update`	Check if a new SecLayer software release is available	`seclayer --check-update`
`--update [--force]`	Apply software updates automatically	`seclayer --update`
`--csfmigrate`	Migrate CSF lists, ignore files and settings, then stop and disable CSF's services (CSF is not uninstalled). See Migrating from CSF	`seclayer --csfmigrate`
`--security-check`	Show the Security Check checklist (same as the admin panel's Security Check page)	`seclayer --security-check`
`--update-pubkeys`	Fetch a fresh update-signing public key. Use only if updates fail signature verification because the key expired	`seclayer --update-pubkeys`
`--update-keys`	Fetch fresh API response-signing keys (also refreshed daily by cron)	`seclayer --update-keys`
`--fix-permissions`	Re-apply correct ownership and permissions to the SecLayer binaries (runs automatically after every update)	`seclayer --fix-permissions`
`-v`, `--version`	Show the installed SecLayer version	`seclayer -v`
`-h`, `--help`	Show the full list of commands	`seclayer -h`

Diagnostics & Reports

Command Flag	Description	Example
`-g`, `--grep <ip>`	Search every live firewall rule and ipset for an IP	`seclayer -g 203.0.113.42`
`-i`, `--iplookup <ip>`	Look up the network and ASN of an IP (RIPEstat)	`seclayer -i 203.0.113.42`
`--trace <ip> [secs]`	Temporarily log all traffic for an IP and show it (default 10 seconds)	`seclayer --trace 203.0.113.42 30`
`-p`, `--ports`	List real listening TCP and UDP ports with their processes	`seclayer -p`
`-m`, `--mail`	Email a one-off server check report to `LF_ALERT_TO`	`seclayer -m`
`--logrun`	Send a Log Scanner report now (when `LOGSCANNER_INTERVAL` is set to manual)	`seclayer --logrun`
`--rbl`	Check this server's own public IPs against the configured DNS blacklists and print the report	`seclayer --rbl`
`--rbl <email>`	Run the same RBL report and email it to an address	`seclayer --rbl [email protected]`
`--rbl <ip>`	Check any single IPv4 address and show each zone as `LISTED` or `Clean`	`seclayer --rbl 203.0.113.42`

Server Statistics

Uses the ST_* settings in the Statistics section of seclayer.conf.

Command Flag	Description	Example
`--stats-collect`	Run one statistics collection pass now (normally automatic)	`seclayer --stats-collect`
`--stats-show <category> [days]`	Show collected history for `system`, `diskw`, `mysql` or `apache` (default 7 days), or `iptables` for the firewall drop-log report	`seclayer --stats-show system 30`

Blocklists, Country Blocking & Cloudflare

Command Flag	Description	Example
`--blocklists-refresh [--force]`	Download configured IP blocklists that are due (or all of them with `--force`)	`seclayer --blocklists-refresh`
`--blocklists-status`	Show the freshness and size of each configured blocklist	`seclayer --blocklists-status`
`--cc-refresh [--force]`	Download zone data for countries in `CC_DENY`/`CC_ALLOW`; restarts the firewall if anything changed	`seclayer --cc-refresh`
`--cc-status`	Show cached zone freshness per configured country	`seclayer --cc-status`
`--cf-status`	Show whether the Cloudflare API integration is configured and how many zones are visible	`seclayer --cf-status`

Cluster Ban Sync

Configured with CLUSTER_SENDTO, CLUSTER_RECVFROM and CLUSTER_KEY in the lfd Clustering section of seclayer.conf.

Command Flag	Description	Example
`-cd`, `--cluster-deny <ip> [comment]`	Deny an IP here and on every cluster peer	`seclayer -cd 203.0.113.42 "Brute force"`
`-ctd`, `--cluster-tempdeny <ip> <secs> [comment]`	Temporarily deny an IP here and on every peer	`seclayer -ctd 203.0.113.42 3600`
`-ca`, `--cluster-allow <ip> [comment]`	Allow an IP here and on every peer	`seclayer -ca 192.0.2.25 "Office"`
`-cta`, `--cluster-tempallow <ip> <secs> [comment]`	Temporarily allow an IP here and on every peer	`seclayer -cta 192.0.2.25 1800`
`-ci`, `--cluster-ignore <ip>`	Add an IP to the ignore list here and on every peer	`seclayer -ci 192.0.2.25`
`-cir`, `--cluster-ignore-rm <ip>`	Remove an IP from the ignore list here and on every peer	`seclayer -cir 192.0.2.25`
`-cr`, `--cluster-remove <ip>`	Remove an IP from whichever list it is on (temp ban, deny or allow), everywhere	`seclayer -cr 203.0.113.42`
`-car`, `--cluster-allow-rm <ip>`	Remove an IP from the allow list only, everywhere	`seclayer -car 192.0.2.25`
`-cp`, `--cluster-ping`	Ping every peer and report which ones replied	`seclayer -cp`
`-cg`, `--cluster-grep <ip>`	Ask every peer to search its live firewall rules for an IP	`seclayer -cg 203.0.113.42`
`-cc`, `--cluster-config <name> <value>`	Push one `seclayer.conf` setting to peers that use this server as `CLUSTER_MASTER` (needs `CLUSTER_CONFIG=1`)	`seclayer -cc LF_TRIGGER 5`
`-cf`, `--cluster-file <key>`	Push one shared list file (ignore, dyndns, blocklists, sips, redirect, ...) to peers that use this server as master	`seclayer -cf ignore`
`-crs`, `--cluster-restart`	Ask peers that use this server as master to reload their firewall	`seclayer -crs`