SikkerGuard

SikkerGuard is a Docker container that pulls known malicious IPs from the SikkerAPI blacklist and blocks them at the kernel level using iptables and ipset. It runs alongside your existing services, requires zero configuration beyond an API key, and cleans up after itself on shutdown.

What it does

• •Pulls the SikkerAPI threat blacklist and loads it into an ipset for O(1) packet matching
• •Blocks malicious IPs at the kernel level before they reach your applications
• •Reports blocked connections back to SikkerAPI, improving threat data for everyone
• •Logs blocked connections in real-time with protocol detection
• •Auto-whitelists your gateway, DNS servers, and LAN to prevent lockouts
• •Runs a connectivity self-test after every rule update and rolls back on failure
• •Cleans up all firewall rules on shutdown — your iptables go back to stock

Think of it as a managed firewall blocklist that updates itself. If you currently maintain blocklists with Fail2Ban, CSF, or manual iptables rules, SikkerGuard replaces the manual work with automated threat intelligence.

You need a free SikkerAPI key and a Linux server with Docker. Setup takes under 60 seconds.

1. Get an API key

Create a free account and generate an API key from the dashboard. Free keys include full blacklist access with up to 5,000 IPs per pull. See pricing for higher limits.

2. Create your .env file

Store your API key in a .env file. Add it to your .gitignore to keep credentials out of version control.

3. Create docker-compose.yml

SikkerGuard needs NET_ADMIN to manage firewall rules and SYSLOG to read the kernel log for real-time block monitoring. network_mode: host gives it access to the host's network stack.

4. Run it

That's it. SikkerGuard will pull the blacklist, apply firewall rules, and start logging blocked connections. Monitor progress with docker compose logs -f.

All configuration is via environment variables. Add them to your .env file or directly in your docker-compose.yml. The only required setting is your API key.

Port mapping

SikkerGuard maps destination ports to protocol names for logging and reporting. Defaults cover all common services (SSH, HTTP, MySQL, PostgreSQL, Redis, SMTP, and more). Add custom mappings with SIKKER_PORT_MAP — your entries are merged with the defaults.

SikkerGuard is designed to be safe to run on production servers. Every rule update goes through multiple safety checks before touching your firewall.

Auto-whitelist

On startup, SikkerGuard detects your gateway, DNS servers, host IPs, and LAN subnets. These are permanently whitelisted and can never be blocked, even if they appear on the blacklist. The SikkerAPI endpoint is also whitelisted to ensure the container can always pull updates.

Sanity checks

Empty blacklists are rejected (indicates an API error, not “no threats”). Sudden list growth beyond 2x the previous size is also rejected. RFC1918 addresses are stripped from the blacklist automatically.

Connectivity self-test

After every rule update, SikkerGuard verifies it can still reach the gateway, resolve DNS, and contact the API. If any test fails, the firewall rules are rolled back immediately.

Atomic updates

Blacklist changes use ipset's atomic swap operation. There is no window where rules are partially applied. The old blocklist stays active until the new one is fully loaded and validated.

Clean shutdown

On docker compose down or SIGTERM, all iptables rules and ipset sets are removed. Your firewall goes back to exactly how it was before SikkerGuard started.

SikkerGuard exposes a health endpoint for monitoring and container orchestration. The server binds to 127.0.0.1 by default, so it is only accessible from the host itself.

The health check integrates with Docker's built-in HEALTHCHECK directive. Container orchestrators like Docker Compose, Kubernetes, and Portainer will automatically detect when SikkerGuard is healthy.

Blocked connection data is also reported back to your SikkerAPI dashboard, where you can see which IPs were blocked, how often, and on which protocols.

Requirements

• •Linux host with Docker and Docker Compose
• •iptables and ipset (available on all standard Linux distributions)
• •A free SikkerAPI key

When to use SikkerGuard vs. other tools

SikkerGuard is ideal when you want automatic, maintenance-free IP blocking powered by real-time threat intelligence. It complements existing tools:

• •vs. Fail2Ban — Fail2Ban reacts to attacks after they happen. SikkerGuard blocks known attackers before they connect. Use both for defense in depth.
• •vs. manual iptables/ipset — SikkerGuard automates the entire lifecycle: pulling lists, applying rules, testing connectivity, and cleaning up.
• •vs. the sikker CLI + cron — SikkerGuard handles safety checks, atomic swaps, rollback, reporting, and cleanup that a cron script wouldn't.