BE-Client ULTRA — Inline Bridge Bot Protection
BE-Client ULTRA is a standalone daemon that runs on a dedicated machine placed between your uplink and the servers you protect. It fingerprints every source crossing the bridge (JA4) and blocks bots, scrapers and blacklisted IPs before they reach your servers, so nothing has to be installed on them.
Boteraser ULTRA Manual Install
This is a quick manual on how to install and configure the Boteraser ULTRA client, the inline appliance that protects every server behind it. ULTRA runs on ARM64 (aarch64) hardware — boards such as the NanoPi R3S LTS, or any spare machine with an ARM64 CPU — and the machine must have two network cards joined in a bridge: one facing the uplink, the other facing the servers you protect.
DISCLAIMER: This is powerful security software that runs with elevated privileges and modifies your system. It is provided "AS-IS" and "AS-AVAILABLE" without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, or non-infringement. Your use of the software is at your own risk. By downloading, installing or using this software, you agree to our Terms of Service and Privacy Policy.
Create the bridge first — the daemon refuses to start unless BRIDGE is a bridge with at least two ports:
ip link add name br0 type bridge
ip link set eth0 master br0
ip link set eth1 master br0
ip link set eth0 up
ip link set eth1 up
ip link set br0 up
eth0 faces the uplink, eth1 faces the protected servers. Make the bridge permanent in your network configuration (netplan, /etc/network/interfaces, NetworkManager) so it survives a reboot, and verify both ports are members:
ls /sys/class/net/br0/brif
Download be-client-ultra-latest.tar.gz to your preferred location (recommended: /opt):
cd /opt
wget https://github.com/sofset-dev/boteraser/raw/refs/heads/main/be-client-ultra/be-client-ultra-latest.tar.gz
Extract the archive and enter the directory:
tar -xzvf be-client-ultra-latest.tar.gz
cd boteraser-ultra
This creates /opt/boteraser-ultra containing be-client-ultra, be-ultra.conf, be-client-ultra.service, image-prep.sh and README.md. Make the binary executable:
chmod +x be-client-ultra
Edit the configuration file. Open be-ultra.conf with a text editor:
nano be-ultra.conf
or
vi be-ultra.conf
In be-ultra.conf, set at minimum:
CONSENT_ACCEPTED="yes" – required; the software will not start until this is set to "yes"
Your API KEY – you can get it at: https://user.boteraser.com/api.php
BRIDGE – the bridge that joins the two monitored interfaces (e.g. br0)
PROTECTED_NET – the networks and servers behind the bridge, comma separated; they are never blocked and never fingerprinted
BR_MODE / BR_IP – the address the machine keeps on the bridge ("static", "dhcp" or "none"). The default 192.168.0.1 is also the usual address of an ISP router, so change it when one sits upstream
WEB_ALLOW_FROM – the networks allowed into the built-in web interface (strongly recommended). Example:
CONSENT_ACCEPTED="yes"
API_KEY_ULTRA="<YOUR API KEY>"
BRIDGE="br0"
PROTECTED_NET="203.0.113.0/24, 198.51.100.10"
BR_MODE="static"
BR_IP="192.168.0.1"
BR_NETMASK="255.255.255.0"
WEB_ALLOW_FROM="192.168.0.0/24"
For email reports also set SMTP_HOST, SMTP_USER, SMTP_PASS and NOTIFY_EMAIL. Every option is documented in the comments inside be-ultra.conf.
Save and exit
Install the bundled systemd service file (it is included in the package and already contains the correct settings):
cp be-client-ultra.service /etc/systemd/system/
systemctl daemon-reload
If you extracted the files somewhere other than /opt/boteraser-ultra, edit the WorkingDirectory and ExecStart paths in /etc/systemd/system/be-client-ultra.service to match your location.
Enable and start the service (it will also start automatically on boot):
systemctl enable --now be-client-ultra
Set the password for the built-in web interface before the machine goes inline — it ships as admin / boteraser, and the bridge shares one network segment with the uplink and with the servers behind it:
/opt/boteraser-ultra/be-client-ultra --set-password
systemctl restart be-client-ultra
The interface then answers on the bridge address (WEB_PORT, 80 by default) and shows what is blocked and why, live traffic with its fingerprints, the threat lists, your local allow/deny rules and every setting in be-ultra.conf.
Check the service status and view logs:
systemctl status be-client-ultra
journalctl -u be-client-ultra -f
The startup log prints the bridge and its ports, the address it assigned, the br_netfilter sysctls it set and the protected networks it loaded — fix anything it warns about before relying on the machine for protection.
✅ That’s it! BE-Client ULTRA now runs continuously as a background daemon on the bridge, fingerprinting every source that crosses it and dropping bots, scrapers and blacklisted IPs before they reach the servers you protect.
DISCLAIMER: This is powerful security software that runs with elevated privileges and modifies your system. It is provided "AS-IS" and "AS-AVAILABLE" without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, or non-infringement. Your use of the software is at your own risk. By downloading, installing or using this software, you agree to our Terms of Service and Privacy Policy.
Create the bridge first — the daemon refuses to start unless BRIDGE is a bridge with at least two ports:
ip link add name br0 type bridge
ip link set eth0 master br0
ip link set eth1 master br0
ip link set eth0 up
ip link set eth1 up
ip link set br0 up
eth0 faces the uplink, eth1 faces the protected servers. Make the bridge permanent in your network configuration (netplan, /etc/network/interfaces, NetworkManager) so it survives a reboot, and verify both ports are members:
ls /sys/class/net/br0/brif
Download be-client-ultra-latest.tar.gz to your preferred location (recommended: /opt):
cd /opt
wget https://github.com/
Extract the archive and enter the directory:
tar -xzvf be-client-ultra-latest.tar.gz
cd boteraser-ultra
This creates /opt/boteraser-ultra containing be-client-ultra, be-ultra.conf, be-client-ultra.service, image-prep.sh and README.md. Make the binary executable:
chmod +x be-client-ultra
Edit the configuration file. Open be-ultra.conf with a text editor:
nano be-ultra.conf
or
vi be-ultra.conf
In be-ultra.conf, set at minimum:
CONSENT_ACCEPTED="yes" – required; the software will not start until this is set to "yes"
Your API KEY – you can get it at: https://user.boteraser.com/api.php
BRIDGE – the bridge that joins the two monitored interfaces (e.g. br0)
PROTECTED_NET – the networks and servers behind the bridge, comma separated; they are never blocked and never fingerprinted
BR_MODE / BR_IP – the address the machine keeps on the bridge ("static", "dhcp" or "none"). The default 192.168.0.1 is also the usual address of an ISP router, so change it when one sits upstream
WEB_ALLOW_FROM – the networks allowed into the built-in web interface (strongly recommended). Example:
CONSENT_ACCEPTED="yes"
API_KEY_ULTRA="<YOUR API KEY>"
BRIDGE="br0"
PROTECTED_NET="203.0.113.0/24, 198.51.100.10"
BR_MODE="static"
BR_IP="192.168.0.1"
BR_NETMASK="255.255.255.0"
WEB_ALLOW_FROM="192.168.0.0/24"
For email reports also set SMTP_HOST, SMTP_USER, SMTP_PASS and NOTIFY_EMAIL. Every option is documented in the comments inside be-ultra.conf.
Save and exit
Install the bundled systemd service file (it is included in the package and already contains the correct settings):
cp be-client-ultra.service /etc/
systemctl daemon-reload
If you extracted the files somewhere other than /opt/boteraser-ultra, edit the WorkingDirectory and ExecStart paths in /etc/systemd/system/be-client-ultra.service to match your location.
Enable and start the service (it will also start automatically on boot):
systemctl enable --now be-client-ultra
Set the password for the built-in web interface before the machine goes inline — it ships as admin / boteraser, and the bridge shares one network segment with the uplink and with the servers behind it:
/opt/boteraser-ultra/be-client-ultra --set-password
systemctl restart be-client-ultra
The interface then answers on the bridge address (WEB_PORT, 80 by default) and shows what is blocked and why, live traffic with its fingerprints, the threat lists, your local allow/deny rules and every setting in be-ultra.conf.
Check the service status and view logs:
systemctl status be-client-ultra
journalctl -u be-client-ultra -f
The startup log prints the bridge and its ports, the address it assigned, the br_netfilter sysctls it set and the protected networks it loaded — fix anything it warns about before relying on the machine for protection.
✅ That’s it! BE-Client ULTRA now runs continuously as a background daemon on the bridge, fingerprinting every source that crosses it and dropping bots, scrapers and blacklisted IPs before they reach the servers you protect.
