nuDefend documentation

nuDefend is a lightweight agent that protects any Linux server — on any cloud or on-premise — by blocking known-malicious IP addresses and domains, inbound and outbound. It is privacy-first: the agent only downloads a cryptographically signed threat list, and nothing about your traffic ever leaves the machine.

Requirements

A Linux server (x86-64 or ARM64) with systemd.
Root access to run the one-line installer.
Outbound HTTPS to fetch the signed blocklist.
Your license key (from your welcome email or the AWS setup page).

Install in one line

This is the fastest way, and it works on any Linux server anywhere. Open an SSH session to the server you want to protect and run the command below once. Replace <YOUR_LICENSE_KEY> with the license key from your welcome email or your AWS setup page.

curl -sSL https://get.nudefend.com | sudo bash -s <YOUR_LICENSE_KEY>

Not sure what each part means? Here is the same command, explained:

curl -sSL https://get.nudefend.com

Downloads the official installer script over a secure (HTTPS) connection. -sSL means “download quietly, but still show me errors, and follow redirects”.

| sudo bash

Runs that script with administrator (root) rights, which is required to set up the firewall. sudo may ask for your server password.

-s <YOUR_LICENSE_KEY>

Passes your personal license key to the installer so the server is registered to your subscription. Keep this key private — it is like a password.

Step-by-step: what the installer does

1
Connect to your server
From your computer, open a terminal and connect over SSH, e.g. ssh user@your-server-ip. On AWS this is usually ssh ec2-user@… or ssh ubuntu@… with your key file.
2
Run the one-line installer
Paste the command above. It downloads the agent, installs it to /usr/local/bin/nudefend, and registers a background service (systemd) so it starts automatically on every reboot.
3
Protection turns on immediately
The agent downloads the signed threat list and applies it to the firewall right away. Malicious IPs and domains are blocked from that moment on — inbound and outbound.
4
It keeps itself up to date
Every 30 minutes the agent fetches the latest signed list automatically. You never have to update it by hand.
5
Check it is working
Run sudo nudefend status. You should see your license as active, a blocklist version, and a count of blocked packets.

Setting up through AWS Marketplace

If you subscribed through AWS Marketplace, after checkout you are sent to your setup page. The first time, you fill in a short form. Here is exactly what each field means:

Full name

Your name (or your company’s name). We use it only to address you in your welcome email and on invoices.

Where we send your welcome email, your license key and billing receipts. Use an address you check — it is your record of the license key.

After you submit, the page shows everything you need:

Install command

Your ready-to-paste one-line installer, with your license key already filled in. Copy it and run it on each server. This is all most customers need.

Install on my EC2 instances (1-click)

Optional. Opens a CloudFormation stack that installs nuDefend on your tagged EC2 instances automatically via AWS Systems Manager — entirely inside your own AWS account. We get no access to your servers.

Enable SSM (prerequisite)

Only shown if your account still needs the AWS Systems Manager role the 1-click installer relies on. It is a one-time setup and it too runs inside your account.

License key

Your unique key. It also appears in your email. You can reuse it on every server up to the number of servers your plan allows.

Your protected servers

A live list of the servers already running the agent — their IP, agent version and when they last checked in — each with an “Open dashboard” button. Empty until your first server reports in.

You can return to this page anytime from the AWS Console → AWS Marketplace → Manage subscriptions → nuDefend → “Set up product”. It always shows your current license and servers — you never lose access.

The dashboard

Each server runs its own private dashboard, served locally over HTTPS on port 8666 and protected by a 256-bit token. It is read-only and never sends data anywhere. Print its URL on the server with:

sudo nudefend dashboard url

Accessing the dashboard securely

For security, keep port 8666 closed to the internet. The dashboard is meant to be reached only from the server itself. To open it from your own computer, create an encrypted SSH tunnel — run ssh -L 8666:localhost:8666 user@your-server, then open https://localhost:8666 in your browser. The traffic stays inside SSH and the access token is never exposed to the network.

Do not open port 8666 to the public internet. Exposing it puts the access token in proxy logs, browser history and referrer headers, and widens your attack surface. If you genuinely need direct remote access without a tunnel, restrict the firewall / security-group rule for port 8666 to your own IP address only — never 0.0.0.0/0.

Reading the dashboard

The top of the page shows five numbers. Here is what each one means:

Attacks blocked (period)

How many incoming malicious connections were blocked during the time range you selected (24 hours, 7 / 30 / 90 days). This is the headline number — attacks that never reached your services.

Total blocked inbound

The all-time total of incoming attacks blocked on this server since the agent was installed.

Outbound blocked (period)

Outgoing connections to malicious addresses that were stopped. If this is above zero it can be an early warning that something on the server tried to “call home” — the card turns red to draw your attention.

Malicious IPs blocked

The number of known-bad IP addresses currently loaded in the firewall. This list refreshes automatically every 30 minutes.

Malicious domains blocked

The number of dangerous domains currently blackholed on this server (malware, phishing, command-and-control and lookalike sites).

Below the numbers you will find:

What nuDefend blocks

A plain-language summary of the two protection layers and the kinds of threats each one stops.

Blocked per day

A bar chart of blocked attempts per day across the selected range, so you can spot spikes at a glance.

Top attacking IPs

A table of the addresses that hit your server most. Columns: IP address — the source of the attack; Blocked attempts — how many times it was stopped; Why blocked — a readable reason (e.g. “SSH break-in attempt”, “port scan”); Last seen (UTC) — when it last tried.

Time range selector & ⬇ CSV

Switch the whole page between 24 hours and 90 days, or download the full event list as a CSV file for your own records or reports.

The dashboard refreshes itself every 60 seconds. Every number you see is computed on the server — nothing is ever sent to us.

Command reference

nudefend statusShow license status, blocklist version and how many packets were blocked.

nudefend updateFetch and apply the latest signed blocklist now (also runs automatically every 30 min).

nudefend dashboard urlPrint the local dashboard URL with its access token.

nudefend dashboard statusShow whether the local dashboard is enabled.

nudefend reportPrint a summary of what has been blocked on this server.

nudefend versionPrint the installed agent version.

nudefend uninstallCleanly remove the agent, its firewall rules and domain blocks.

How protection works

Two independent layers run on every protected server:

Network layer — malicious IPs. Traffic to and from known-bad addresses is dropped at the kernel firewall (botnet C2, active scanners, brute-force sources and malware infrastructure), before it reaches your services.
DNS layer — malicious domains. Dangerous domains (malware, phishing, scams, command-and-control) are blackholed system-wide, so no application on the server can resolve or reach them.

The blocklist is a single cryptographically signed file. The agent verifies its signature before applying it and refuses tampered or expired lists.

Privacy

nuDefend never uploads your logs, traffic or metadata. The only outbound request the agent makes is downloading the signed blocklist — a one-way street. All reports live on your server and nowhere else.

Billing & cancellation

Pricing is per protected server, per month. If a subscription lapses, nuDefend fails open — it stops blocking rather than locking you out — and can cleanly uninstall itself. There is no lock-in.

Troubleshooting

The installer says “permission denied”

You need administrator rights. Make sure the command includes sudo, or run it as the root user.

“status” shows the license as inactive

Check that you pasted the correct license key and that the server can reach the internet over HTTPS. Then run sudo nudefend update.

I can’t open the dashboard in my browser

Port 8666 is intentionally local-only. Open an SSH tunnel first: ssh -L 8666:localhost:8666 user@your-server, then browse to https://localhost:8666. Your browser may warn about the local certificate — that is expected for a self-hosted dashboard.

A legitimate address was blocked

This is rare. Contact support with the IP or domain and we will review it against the threat list.

I want to remove nuDefend

Run sudo nudefend uninstall. It removes the agent, its firewall rules and domain blocks cleanly, with nothing left behind.

Support

Need help? Contact us.