crowdsec nginx bouncer without IP
Hello CrowSec community,
I'm new to CrowdSec. I am running an nginx reverse proxy serving a demo web app in a docker container. My dockerized nginx container is running with ports 80 and 443. I installed crowdsec and related remediation components (bouncers) baremetal. Seems that it is working, however, I noticed after running the command
sudo cscli bouncers list
See attached image....
Multiple Notifications of the same IP Ban
I'm currently using CrowdSec on my OPNsense firewall, and overall, it's been working very well. However, I've recently noticed multiple repeated ban notifications for the same IP range (89.248.160.0/21), which is known to be malicious. This has been occurring consistently over the past few days.
To mitigate this, I increased the ban duration from 4 hours to 72 hours, hoping it would reduce the repeated activity. Unfortunately, that hasn’t made a difference—similar IPs keep appearing.
I came across some information suggesting that CrowdSec bans don't necessarily block traffic entirely and that firewall-level blocking is needed to fully stop incoming connections. Since I'm using the CrowdSec plugin directly on OPNsense, I was expecting it to integrate with the firewall to block banned IPs....
Strungling with Bouncer Middleware in Traefik 3 on kubernetes.
Hy everyone, i wondering if someone allready have trouble to deploy bouncer middleware on traefik 3 ?
- Security engine is registered
- traefik3 is deployed on kubenetes. Everything look ok but when i activate crowdsec middleware on HTTProute.
...
Collection Not Banning
I'm just getting into Crowdsec and installed on my Unraid server, with Traefik as my reverse proxy. I followed an Ibracorp tutorial for help.
Multiple collections don't seem to be parsing the logs correctly.
One example being
LePresidente/overseerr-logs....
Same IP banned twice 2 hours apart?
I've seen the same IP getting banned twice 2 hours apart, not sure how it's possible?
My default bans are for longer, so it shouldn't be possible, I do see the active decision for that IP, so I wonder if I'm missing something?
Thanks....
