Install SikkerGuard

Get your API key

Sign up and copy your API key from the dashboard. Keys start with sk_. The free plan includes blocklist access.

$ mkdir sikkerguard && cd sikkerguard

Create docker-compose.yml

SikkerGuard runs as a single Docker container. It needs network_mode: host to manage your server's iptables directly, and NET_ADMIN + SYSLOG capabilities to create firewall rules and read kernel logs. The Docker socket mount enables one-click updates from the dashboard.

services:
  sikkerguard:
    image: sikkerapi/guard:latest
    network_mode: host
    cap_add:
      - NET_ADMIN
      - SYSLOG
    devices:
      - /dev/kmsg:/dev/kmsg
    volumes:
      - ./data:/var/lib/sikkerguard
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped

That's the only file you need. Your API key and all configuration are entered through the web dashboard — no config files to manage.

Start the container

Pull the image and start SikkerGuard in the background. The dashboard will be available at http://your-server:7064.

$ sudo docker compose up -d
[+] Running 1/1
 ✔ Container sikkerguard  Started                              0.8s

$ sudo docker compose logs -f sikkerguard
sikkerguard  | SikkerGuard v1.0.0
sikkerguard  | Dashboard: http://0.0.0.0:7064
sikkerguard  | Setup required — open dashboard to configure

Complete setup in the dashboard

Open http://your-server:7064 in your browser. The setup page asks for a dashboard admin account and your SikkerAPI key. The key is validated against SikkerAPI in real time.

Enable the guard

After setup, you'll land on the dashboard. Click the toggle to enable SikkerGuard. It will immediately pull the threat blocklist from SikkerAPI and apply it to your iptables firewall. Blocked connections appear in the live firewall log.

Threat sources

The Sources page lets you manage where SikkerGuard gets its threat data. SikkerAPI is built-in. You can optionally add your own AbuseIPDB API key, enable blocklist.de feeds, or maintain a custom blacklist.

Adding AbuseIPDB

Bring your own AbuseIPDB API key. Set a minimum confidence threshold and limit. Click Save & Fetch to pull IPs immediately.

Enabling blocklist.de

Select which attack feeds to subscribe to. No API key needed. Each feed covers the last 48 hours of reports from thousands of servers.

Custom blacklist

Add individual IPs, paste a list, or upload a file. Entries are merged with all other sources and deduplicated.

Settings

The Settings page lets you tune SikkerGuard's behavior. All settings have sensible defaults — you only need to change what matters for your setup.

Threat scoring

Control how aggressive the blocking is. A higher score means fewer blocks but higher confidence. Default is 50.

Scheduling

Control how often SikkerGuard refreshes the blocklist and how often it reports blocked connections back to SikkerAPI. Contributor reporting is optional.

Whitelist

Add IPs or CIDR ranges that should never be blocked. SikkerGuard also auto-detects and protects your SSH session, gateway, DNS servers, and all RFC1918 private ranges.

Confirm it's working

Check that SikkerGuard is running and has loaded the blocklist.

# Check container status
$ sudo docker compose ps
NAME           STATUS         PORTS
sikkerguard    Up 2 minutes   

# Verify ipset is loaded
$ sudo ipset list sikkerguard -t
Name: sikkerguard
Type: hash:ip
Number of entries: 48219

# Check iptables rule
$ sudo iptables -L INPUT -n | grep sikkerguard
DROP  all  --  0.0.0.0/0  0.0.0.0/0  match-set sikkerguard src

# Health check
$ curl -s http://localhost:8080/healthz
OK

Frequently asked questions