crowdsec nginx bouncer without IP
Hello CrowSec community,
I'm new to CrowdSec. I am running an nginx reverse proxy serving a demo web app in a docker container. My dockerized nginx container is running with ports 80 and 443. I installed crowdsec and related remediation components (bouncers) baremetal. Seems that it is working, however, I noticed after running the command
sudo cscli bouncers list
See attached image....
Multiple Notifications of the same IP Ban
I'm currently using CrowdSec on my OPNsense firewall, and overall, it's been working very well. However, I've recently noticed multiple repeated ban notifications for the same IP range (89.248.160.0/21), which is known to be malicious. This has been occurring consistently over the past few days.
To mitigate this, I increased the ban duration from 4 hours to 72 hours, hoping it would reduce the repeated activity. Unfortunately, that hasn’t made a difference—similar IPs keep appearing.
I came across some information suggesting that CrowdSec bans don't necessarily block traffic entirely and that firewall-level blocking is needed to fully stop incoming connections. Since I'm using the CrowdSec plugin directly on OPNsense, I was expecting it to integrate with the firewall to block banned IPs....
Strungling with Bouncer Middleware in Traefik 3 on kubernetes.
Hy everyone, i wondering if someone allready have trouble to deploy bouncer middleware on traefik 3 ?
- Security engine is registered
- traefik3 is deployed on kubenetes. Everything look ok but when i activate crowdsec middleware on HTTProute.
...
Collection Not Banning
I'm just getting into Crowdsec and installed on my Unraid server, with Traefik as my reverse proxy. I followed an Ibracorp tutorial for help.
Multiple collections don't seem to be parsing the logs correctly.
One example being
LePresidente/overseerr-logs....
Same IP banned twice 2 hours apart?
I've seen the same IP getting banned twice 2 hours apart, not sure how it's possible?
My default bans are for longer, so it shouldn't be possible, I do see the active decision for that IP, so I wonder if I'm missing something?
Thanks....
Docker based log parser not connecting to Opnsense running LAPI
I am working on setting up crowdsec on my second network and im running into issues getting another machine connected to the LAPI running on opnsense.
My opnsense crowdsec config can be see in the attached picture as well as the firewall rule on the LAN interface that allows the docker machine (an unraidbox) to connect to port 8080 on the router.
When running the
sudo cscli lapi register -u http://192.168.20.1:8080 command on my crowdsec docker it says its successful and saves the creds into local_api_credentials.yaml. I then stopped the docker and edit config.yaml in the docker server and disable the server api. On the Opnsense lapi i validate the machine. now whenever trying to start the crowdsec docker it will not start successfully. It gets stuck in a loop of crashing over and over. This can be found in the logs:
...