Installation Guide

Get SecLayer running on your server with the universal installer.

Quick Install

Run the following command as root:

The installer auto-detects your OS, control panel, and running services. It configures everything with sensible defaults — no manual input required. If CSF is detected, the installer offers to migrate your existing lists and configuration to SecLayer and disable CSF's services (CSF itself is not uninstalled). See Migrating from CSF.

Automatic Firewall Detection

SecLayer automatically detects your server's packet filter backend during installation:

• nftables (Primary) — SecLayer checks for nftables first. If available, it uses native inet seclayer rules for unified IPv4 and IPv6 protection.
• iptables (Fallback) — If nftables is not installed, SecLayer automatically falls back to standard iptables and ip6tables.
• Safety Guarantee — If neither firewall engine is found, the installer halts with an error prompt instructing you to install nftables so your server is never left unprotected.

What the Installer Does

1. Detects your OS distribution and version
2. Identifies your control panel (if any)
3. Scans for listening services and open ports
4. Generates nftables/iptables rules based on discovered services
5. Installs and starts the LFD daemon
6. Configures DDoS protection defaults
7. Sets up email alert templates
8. Enables the service to start automatically on boot

Post-Installation Steps

1. Open the Security Check page (or run seclayer --security-check) and complete any remaining steps
2. Verify the installation: seclayer -l (lists current firewall rules)
3. Check LFD status: seclayer --lfd-status
4. Review configuration at /etc/seclayer/seclayer.conf
5. Configure alert email recipients in the config file
6. Set custom thresholds as needed

Manual Installation

If the universal installer does not work, download the package, extract it to /usr/local/seclayer/, and configure the init script for your init system.