LykanShield protection layer

Bad IP Filter

Reject locally learned and centrally distributed hostile IP addresses.

Read integration guide View source on GitHub →

Overview

Local speed with shared intelligence

The IP layer checks temporary local blocks as well as the downloaded LykanShield blacklist. Local records carry timestamps, are pruned by lifetime and count, and are stored with file locking to remain safe under concurrent requests.

Request lifecycle

How it works

  1. 01

    Resolve client

    The request IP is derived with explicit trusted-proxy support.

  2. 02

    Check reputation

    Local entries and sharded central blacklist data are consulted.

  3. 03

    Maintain cache

    Expired records are pruned and rule refreshes happen outside request filtering.

Implementation

Technical details

  • Supports exact trusted proxy addresses and CIDR ranges.
  • Defaults to 5,000 local entries with a 720-hour local lifetime.
  • Uses locked updates to avoid corrupting block files under concurrency.
  • Remote rule refresh is scheduled after the response or through a CLI job.

IP policy

<?php
lykan_config::$config['filter_active']['bad_ips'] = true;
lykan_config::$config['trusted_proxies'] = [
    '10.0.0.0/8',
    '192.0.2.10'
];
lykan_config::$config['local_bad_ip_lifetime_hours'] = 720;
lykan::run(__DIR__);