CLI Utilities
Manage SecLayer directly from the command line using the seclayer binary.
Overview
The seclayer CLI allows administrators to manage firewall rules, allow or block IPs, inspect active connections, control the Login Failure Daemon (LFD), configure DDoS protection, and execute self-updates directly from SSH.
root@server:~# seclayer --help
Firewall Control Commands
| Command Flag |
Description |
Example |
-s, --start |
Start the firewall service & apply rules |
seclayer -s |
-f, --stop |
Stop the firewall service & flush rules |
seclayer -f |
-r, --restart |
Restart the firewall service |
seclayer -r |
-l, --status |
List active firewall rules and backend status |
seclayer -l |
-c, --check <ip> |
Check if an IP is allowed, denied, temp-banned, or ignored |
seclayer -c 198.51.100.45 |
Allow & Deny IP Management
| Command Flag |
Description |
Example |
-a, --add <ip> [comment] |
Permanently allow an IP or CIDR range |
seclayer -a 192.0.2.10 "Office IP" |
-ar, --allowrm <ip> |
Remove an IP from the allow list |
seclayer -ar 192.0.2.10 |
-d, --deny <ip> [comment] |
Permanently block an IP or CIDR range |
seclayer -d 203.0.113.50 "Attacker IP" |
-dr, --denyrm <ip> |
Remove an IP from the block list |
seclayer -dr 203.0.113.50 |
Temporary Bans & Allows (TTL)
| Command Flag |
Description |
Example |
-td, --tempdeny <ip> <secs> [comment] |
Temporarily ban an IP for a specified duration (in seconds) |
seclayer -td 198.51.100.88 3600 "Brute force" |
-tr, --temprm <ip> |
Remove a temporary ban early |
seclayer -tr 198.51.100.88 |
-ta, --tempallow <ip> <secs> [comment] |
Temporarily allow an IP for a specified duration (in seconds) |
seclayer -ta 192.0.2.25 1800 "Admin access" |
-tar, --tempallowrm <ip> |
Remove a temporary allow entry early |
seclayer -tar 192.0.2.25 |
-t, --temp |
List all active temporary entries (bans & allows with remaining TTL) |
seclayer -t |
-tf, --tempf |
Flush all temporary bans immediately |
seclayer -tf |
LFD (Login Failure Daemon) Control
| Command Flag |
Description |
Example |
--lfd --start |
Start the LFD daemon service |
seclayer --lfd --start |
--lfd --stop |
Stop the LFD daemon service |
seclayer --lfd --stop |
--lfd --restart |
Restart the LFD daemon service |
seclayer --lfd --restart |
--lfd --status |
Display LFD running status and PID |
seclayer --lfd --status |
DDoS Protection & Bandwidth Throttling
| Command Flag |
Description |
Example |
--ddos-status |
Show DDoS protection state and thresholds |
seclayer --ddos-status |
--ddos-connections |
List active connection counts per remote IP |
seclayer --ddos-connections |
--ddos-check |
Trigger an on-demand connection flood audit |
seclayer --ddos-check |
--ddos-enable / --ddos-disable |
Toggle DDoS protection module |
seclayer --ddos-enable |
--ddos-bw-throttle <ip> <rate> |
Throttle bandwidth for an IP using tc (e.g. 1mbit) |
seclayer --ddos-bw-throttle 198.51.100.9 1mbit |
--ddos-bw-remove <ip> |
Remove bandwidth throttle for an IP |
seclayer --ddos-bw-remove 198.51.100.9 |
System, License & Updates
| Command Flag |
Description |
Example |
--license |
Display license details, plan, and expiry date |
seclayer --license |
--refresh-license |
Force a remote license activation check |
seclayer --refresh-license |
--check-update |
Check if a new SecLayer software release is available |
seclayer --check-update |
--update [--force] |
Apply software updates automatically |
seclayer --update |
--csfmigrate |
Import CSF config/rules and safely disable CSF |
seclayer --csfmigrate |