From reading logs to writing firewall rules, fully automated — every feature ran on a production server hosting 22 live sites before it shipped.
Covers vulnerability scanning, sensitive-path probing (/.env, /wp-login.php…), 4xx error bursts, brute-force attempts and abnormal request patterns. Every verdict keeps the triggering log lines, so you can always verify why an IP was blocked.
Rules ship with every release and work out of the box. Every threshold and pattern list is editable on the host's own console.
Whether it can block something depends on whether it understands the log that program writes. These are the sources it actually reads:
| Source | What it reads | What that catches |
|---|---|---|
| Apache 2 | access log (combined) | Scanning, sensitive paths, injection signatures, vhost sweeps |
| Apache 2 | error log (AH01630 and similar) | Repeated server-level access denials |
| nginx | access / error log | The same — point the config at nginx's log directory |
| SSH (sshd) | /var/log/auth.log, /var/log/secure | SSH password brute force |
| FTP (ftpd) | the same auth log | FTP login brute force, for PAM-based FTP servers |
| Synology DSM | Web Station / reverse-proxy access logs | The web-layer attacks DSM's own auto-block cannot see |
The same rule applies to Apache and nginx alike — rules match behaviour, not a particular server. Reading the SSH auth log needs root; if it cannot, the console says so rather than skipping quietly.
Pure Go talking netlink directly to nftables — no ipset, iptables or any external tool required. Older kernels fall back to ipset compatibility mode automatically. Tested down to kernel 4.4.
On a NAS the blocks go into DSM's own firewall (DEFAULT_INPUT) — no iptables or ipset to install.
Blocks expire and remove themselves — no graveyard of thousands of stale rules. A whitelist takes your own addresses and ranges; local NIC addresses and private ranges are added to the baseline automatically.
GeoIP pins every attack source to a country and city; the dashboard shows block counts, event trends and firewall backend status in real time. Everything exports to CSV.
Alerts are entirely free — being able to tell you about a block is a protection tool's basic duty. There are three channels: email, syslog (collected by whatever you already run — rsyslog, syslog-ng, journald), and the console's notification log, which records every attempt, successful or not, so "did that alert actually go out?" is a question you can answer. Batching and daily digests are free too.
With multiple servers, clients run a lightweight agent (local console can be fully disabled), bind to your account by confirming once in the browser, and report to a central dashboard:
Status, events and the attack map for every server on one page — version and 24-hour event count per host at a glance.
Hit "Bind to my account" in the agent console, sign in on the Hub confirmation page that opens — bound. Headless hosts use the device-code flow (svrguard pair -device). Reinstalling the same machine never needs another subscription.
An IP caught attacking one server is pre-emptively blocked across your whole fleet — one hit, everyone immune.
DSM's built-in auto-block counts failed logins. It stops someone guessing your DSM password, but it never sees the web-layer attacks — probes for /.env, attempts on /wp-login.php, sweeps across the sites behind your reverse proxy. To DSM those are ordinary HTTP connections.
SvrGuard reads the Web Station / reverse-proxy access logs, judges them with the same 15 rules, and writes the source address into DSM's own firewall (rules go in DEFAULT_INPUT — no iptables or ipset to install). The photos and files on a NAS are worth more than a throwaway cloud box, and it is the one that sits exposed all day.
Package Center → Manual Install. Builds for x86_64, armv7 and arm64. Removing the package keeps your database and settings.
Updates come through a dedicated channel with an Ed25519 signature, and the channel always keeps the previous build — with no rollback target to fall back on, the agent declines to update rather than strand you on a bad version.
Your NAS binds to the same account as everything else, on one page. Binding needs no subscription.
CPU, memory and disk usage plus TLS certificate expiry, with threshold alerts — server trouble reaches you through the same channel as attack events, no separate monitoring stack needed. Collection runs with or without a subscription, so the moment you subscribe you see the history rather than a blank page. What Pro buys is being told when a threshold is crossed, and the 24-hour / 7-day history curves in this machine's own console. The samples stay on the machine; nothing is uploaded.
