Block attacking IPs on Linux — before they get comfortable
EzyShield watches your logs, detects attackers and scrapers, and bans them with escalating strikes — locally via nftables and at the edge via Cloudflare. A fast rule engine runs fully offline; AI only steps in to judge the ambiguous traffic.
curl -sfL https://get.ezyshield.com | sudo sh
Dry-run by default — watch what it would block before you arm it. One command, no account, your server, your keys.
From log line to ban in milliseconds
A deterministic pipeline. AI is an optional step, never a dependency.
Watch
Tails your access and auth logs — nginx, sshd, and more — in real time.
Decide
The rule engine instantly matches known attacks. Anything ambiguous goes to an LLM — Anthropic (Claude), an OpenAI-compatible endpoint, or a local Ollama model.
Enforce
Once armed, bans land in nftables and propagate to the edge via Cloudflare. Until then, dry-run shows exactly what would be blocked.
Built for people who run their own servers
Eight capabilities working together. Each one optional, every one configurable.
Rule Engine
Deterministic pattern matching runs in microseconds — fully offline, no network or API key required.
AI Verdict
Ambiguous traffic is routed to the provider you choose — Anthropic (Claude), any OpenAI-compatible endpoint, or a local Ollama model. AI steps in only when the rules say so.
Escalating Strikes
A configurable strike ladder — short hold, full-day ban, permanent lockout. First offenders get a warning, not a lifetime block.
Edge Blocking
Bans propagate to Cloudflare IP Lists so attackers are stopped before they ever reach your server.
GeoIP Enrichment
Every event gets tagged with country, ASN, and reputation data — making logs and alerts immediately actionable.
Multi-source Logs
Watches SSH, Nginx, Apache, Caddy, and Traefik logs from a single daemon — via log files, journald, or Docker containers.
Notifications
Strike events are pushed to Telegram, Slack, or Discord in real time — no need to watch a screen.
Privilege Separation
The watcher runs unprivileged; only the enforcer needs elevated rights. Compromising one component doesn't compromise all.
Plugs into what you already run
Mix and match. Every integration is optional and swappable.
- Cloudflare
- nftables
- Telegram
- Slack
- Discord
- Webhooks
- OpenAI
- Anthropic
- Ollama local
- SSH / auth.log
- Nginx
- Apache
- Caddy
- Traefik
- Docker
- journald
Running in three steps
One install command, one setup wizard. Drop it on the box and go.
Install
Download and install EzyShield with a single command. No dependencies to chase down.
curl -sfL https://get.ezyshield.com | sudo sh
Configure
The setup wizard detects your environment, writes the config files, installs the systemd service, and starts EzyShield in dry-run.
sudo ezyshield init
Watch
EzyShield is already running in dry-run — watch live what it would block. When you trust what you see, set armed: true in policy.yaml to enforce.
ezyshield watch
Frequently asked questions
Common questions from sysadmins who've been there.
The enforcer that writes to nftables needs elevated privileges to add and remove firewall rules. The watcher — the part that reads logs and calls the LLM — runs fully unprivileged. Privilege separation means a compromised watcher cannot touch your firewall.
Yes. The rule engine is deterministic and fully offline — it blocks known attack patterns without any network access or API key. AI is an optional step that only activates for traffic the rules can't classify, and only when you've configured an LLM provider.
SSH auth logs (journald or /var/log/auth.log) plus Nginx, Apache, Caddy, and Traefik logs — read from log files, journald, or Docker containers. You choose which sources to tail in config.yaml.
Yes. EzyShield pushes bans to Cloudflare IP Lists via the Cloudflare API, blocking attackers at the edge before traffic ever reaches your server. Need a different edge provider? Open an issue on GitHub — integrations are driven by real demand.
Yes. EzyShield is open source under AGPL-3.0 and free to self-host — your server, your keys, no account required. Install it and test in dry-run (the default) before you arm it.
Yes. EzyShield has a built-in allowlist that always wins over strike and ban decisions. Add your own IP, your office range, or any trusted CIDR in policy.yaml. Anti-lockout protection is built in — you cannot accidentally ban yourself.