Eliminating Internet Background Noise at the Kernel Level

The internet is a noisy place. Every public server faces constant bombardment from automated scanners, brute-force attackers, and malicious bots. Traditional firewall configurations often struggle to keep up with the volume of threats, leaving servers vulnerable or drowning in log files. SysWarden is an enterprise-grade firewall orchestrator designed to eliminate this noise at the kernel level, dropping 99% of malicious traffic before it ever reaches your applications.

What is SysWarden?

SysWarden is an open-source firewall orchestrator built for Linux servers that dynamically integrates multiple layers of threat intelligence into a single, automated solution. By combining Data-Shield IPv4 Blocklists, GeoIP filtering, Spamhaus ASN blocking, and Fail2ban intrusion prevention, it creates a formidable shield that operates with near-zero memory footprint.

Developed by Laurent Minne (aka Duggy Tuxy), SysWarden supports a wide range of Linux distributions including Debian, Ubuntu, CentOS, Fedora, AlmaLinux, Rocky Linux, and Alpine Linux. It automatically detects and configures the optimal firewall backend on your system—whether that’s Nftables, Firewalld, or IPSet.

What Does SysWarden Protect?

SysWarden provides comprehensive protection for various infrastructure types by dropping malicious traffic at the firewall level before it reaches your applications.

• Public VPS & Bare Metal Defends SSH ports and core services against relentless brute-force campaigns and mass-scanning. Deploys a stealth WireGuard VPN to make management invisible.
• Websites & CMS Instantly filters out bad bots and vulnerability scanners targeting Nginx or Apache. Blocks threats at the edge to preserve CPU and RAM for real visitors.
• Public APIs & SaaS Protects endpoints from aggressive data scrapers, automated abuse, and Layer 7 DDoS probes, ensuring SLAs stay intact.
• Dockerized Infrastructure Automatically injects hermetic firewall rules directly into the DOCKER-USER chain, shielding containers without breaking internal bridge networking.
• Databases (MySQL, MongoDB, PostgreSQL) Shields data stores from credential stuffing, unauthorized access, and ransomware gangs using massive static IP sets and dynamic Fail2ban intrusion prevention.

Key Features

SysWarden packs enterprise-grade security features into a lightweight, automated package.

• Strict SSH Cloaking (Zero Trust) Enforces SSH access exclusively via WireGuard VPN (wg0) and Loopback. Public SSH access is completely blocked by default.
• Serverless Telemetry Dashboard Lightweight real-time Web UI served via native Python daemon. View L3/L7 drops instantly at http://10.66.66.1:9999 (VPN) or via SSH tunnel.
• Universal OS Support & Auto-Detection Seamlessly adapts to Debian, Ubuntu, CentOS, Fedora, AlmaLinux, Rocky Linux, and Alpine (OpenRC).
• Intelligent Backend Routing Automatically configures Nftables Flat Syntax, Firewalld Rich Rules, or IPSet depending on the host OS.
• Hermetic Docker Isolation Injects specialized rules into the DOCKER-USER chain without breaking internal networking.
• Stealth WireGuard VPN Deploys a native management VPN to hide your SSH and management ports from the public internet.

Architecture & How It Works

SysWarden uses a multi-layered approach to network security that separates static and dynamic defense mechanisms.

Layer 1: Kernel-Space Shield (Preemptive Defense)

The first layer uses Nftables, Firewalld, or IPSet to drop over 100,000+ known malicious IPs at the kernel level before any user-space processing occurs. This includes Data-Shield blocklists, GeoIP country blocks, and Spamhaus ASN routing data. By handling this in Kernel-Space, CPU and RAM usage remains minimal.

Layer 2: User-Space Applications (Permitted Traffic)

Traffic that passes the initial filter reaches your legitimate services. Rsyslog isolates firewall and authentication logs into separate files, preventing log injection attacks and keeping your logs clean.

Layer 3: Active Response (Dynamic Defense)

Fail2ban monitors isolated log files for behavioral threats and brute-force patterns. A Python daemon asynchronously reports confirmed attackers to AbuseIPDB, contributing to global community defense. Optional Wazuh XDR integration provides SIEM connectivity for enterprise environments.

Installation & Usage

Getting started with SysWarden takes just a few minutes. First, prepare your system:

# Ubuntu / Debian
apt update && apt install wget -y

# RHEL / AlmaLinux / Fedora
dnf update && dnf install wget -y

Then download and run the installer:

cd /usr/local/bin/
wget https://github.com/duggytuxy/syswarden/releases/download/v1.12/install-syswarden.sh
chmod +x install-syswarden.sh
./install-syswarden.sh

Management Commands

Once installed, SysWarden provides intuitive CLI commands:

• ./install-syswarden.sh update — Force immediate refresh of blocklists
• ./install-syswarden.sh alerts — Launch live attack dashboard in terminal
• ./install-syswarden.sh whitelist — Add trusted IP to bypass blocklists
• ./install-syswarden.sh blocklist — Permanently ban a specific IP
• ./install-syswarden.sh protect-docker — Inject rules into DOCKER-USER chain
• ./install-syswarden.sh wireguard-client — Generate new WG client profile and QR code

Day-2 Operations (syswarden-mng)

The management CLI allows real-time IP operations:

• syswarden-mng check <IP> — Full XDR diagnostic across files, kernel, and Fail2ban
• syswarden-mng block <IP> — Hot-add IP to kernel drop set
• syswarden-mng unblock <IP> — Remove IP from all blocklists and jails
• syswarden-mng whitelist <IP> — Grant VIP access bypassing all restrictions

Continuous Compliance: syswarden-audit.sh

SysWarden includes a standalone Purple Team compliance script that verifies all security controls remain active post-installation. It audits OS hardening, kernel shield status, Zero Trust Fail2ban configuration, and provides a deterministic compliance scoring engine.

./syswarden-audit.sh

Why Choose SysWarden?

In a landscape filled with complex security solutions, SysWarden stands out for several reasons. It dramatically reduces log fatigue and SIEM costs by dropping scanners at the network edge. It conserves CPU and RAM by dropping illegitimate packets natively in Kernel-Space. Most importantly, it shifts your infrastructure from reactive to proactive, blocking IPs that have attacked other servers minutes ago.

With community-driven threat intelligence from Data-Shield and AbuseIPDB integration, SysWarden represents a collective defense approach—protecting your servers while contributing to global security.

Visit SysWarden Website View on GitHub