Crowdsec not blocking brute-force login attempts to docker containers behind NTMplus

I have NPMplus installed with Crowdsec. Everything is working fine. I can see decisions being made in the Crowdsec log based on IPs.

I have 12 services running behind NPMplus. If I visit subdomain.mydomain.com, I can see the IP appear in the Crowdsec log.

I installed the bouncer: crowdsec-firewall-bouncer-iptables

If I go to the Crowdsec terminal and type in cscli metrics, I see npmplus/nginx/acess.log being parsed. I also see the cs-firewall-bouncer listed under the Bouncer section.

However, if I try to login to any of my 12 services (all docker containers) and the logins fail, I am not being banned. I am trying from a VPN IP address to login.

The ONLY docker container that will ban failed logins is NPMplus. All my other containers that are behind NPMplus never fail. I can keep trying to login forever. All the docker containers are in network: host mode.

If I try to brute foce login to any of my other docker containers like Radarr, Sonarr, Change Detection, Jackett, etc., none of them will ban the IP address like the NPMplus docker container does. All of the docker containers are in network_mode: host.

Crowdsec is somewhat working because I see another foreign IP address in the screenshot above that is not from me that got banned.

It appears everything is working fine, EXCEPT the brute force login for my various other containers. Is there maybe something different I need to do with my other containers? Or should the NPMplus traffic and logs be enough for Crowdsec?

Attached are a couple screenshots:

decisions list. It is banning IPs.
Screenshot of my docker log for the Crowdsec container

I'm also attaching my docker-compose.yaml file for NPMplus.

I asked Zoey, the creating of NPMplus, but she thinks it's a Crowdsec issue. Here is what she said in our Github converstaion: crowdsec firewall bouncer saves its blacklist inside ipset lists

Any help would be appreciated. Thank you!

docker-compose.yaml_for_NPMplus.txt17.68KB

CrowdSec•12/8/25, 8:11 PM

Important Information

Thank you for getting in touch with your support request. To expedite a swift resolution, could you kindly provide the following information? Rest assured, we will respond promptly, and we greatly appreciate your patience. While you wait, please check the links below to see if this issue has been previously addressed. If you have managed to resolve it, please use run the command

/resolve

/resolve

or press the green resolve button below.

Log Files

If you possess any log files that you believe could be beneficial, please include them at this time. By default, CrowdSec logs to /var/log/, where you will discover a corresponding log file for each component.

Guide Followed (CrowdSec Official)

If you have diligently followed one of our guides and hit a roadblock, please share the guide with us. This will help us assess if any adjustments are necessary to assist you further.

Screenshots

Please forward any screenshots depicting errors you encounter. Your visuals will provide us with a clear view of the issues you are facing.

•

12/8/25, 8:11 PM

mman3222OP•12/8/25, 8:22 PM

Attached is the crowdsec-firewall-bouncer.log file.

Also, here is my conversation with Zoey on Github, in case any of her information she posted helps: https://github.com/ZoeyVid/NPMplus/discussions/2357

crowdsec-firewall-bouncer.log144.49KB

GitHub

NPMplus + Crowdsec. Not blocking failed login attempts · ZoeyVid N...

I'm not sure if I can get help here, but I thought I would ask. I have NPMplus installed with Crowdsec. Everything is working fine. I can see decisions being made in the Crowdsec log based on I...

mman3222OP•12/8/25, 8:40 PM

And lastly, here is my cscli metrics show output.

cscli_metrics_show.txt20.89KB

Loz•12/9/25, 9:22 AM

If I try to brute foce login to any of my other docker containers like Radarr, Sonarr, Change Detection, Jackett, etc., none of them will ban the IP address like the NPMplus docker container does. All of the docker containers are in network_mode: host.

So all of these services are proxied through npmplus? if so they are most likely doing the classic "status code 200 for invalid login" so we cannot infer a failed login just from the status code itself EG what npmplus does returns 401 when login is invalid. We do have some collections for those services but we would have to read their logs to detect this type of behaviour.

you can confirm this by opening the browser console, do an invalid login and check the status code of the request.

LLoz > If I try to brute foce login to any of my other docker containers like Radarr,...

mman3222OP•12/9/25, 2:21 PM

Correct. All my docker containers that I access via sub.domain.com are reverse proxied behind NPMplus.

You're correct. I tried to login by entering an incorrect password, and I watched the Crowdsec log. It was a 200 error.

Dang. I wish I would have asked sooner. I have spent soooo many hours on this. There is no work around? Should I try to implement Fail2ban along the side of Crowdsec?

mman3222OP•12/9/25, 2:31 PM

Interesting though. I attempted to login to my NPMplus application on a VPN, and that reports back an HTTO 200 code, and Crowdsec will ban the IP. I'm assuming it's because Crowdsec is parsing NPMplus's logs.

Mmman3222 Correct. All my docker containers that I access via sub.domain.com are reverse p...

Loz•12/9/25, 2:36 PM

fail2ban and crowdsec are similar in functionality, we already have some applications log parser in the hub, so try to see if they are already supported then simply install the collection and setup an acquisition.

Loz•12/9/25, 2:37 PM

ref: https://app.crowdsec.net/hub

Collections, AppSec Rules & Configurations | CrowdSec Hub

Manage collections, configurations, remediation components, and AppSec rules with CrowdSec Hub. Streamline security with tools and integrations for enhanced protection.

mman3222OP•12/9/25, 2:43 PM

Ahah! Bingo! The explains why only NPMplus blocks failed login attempts. I logged into my UGreen NAS, I changed directory to /opt/crowdsec/conf/acquis.d and I see an acquision .yaml file in there for NPMplus called NPMplus.yaml

mman3222OP•12/9/25, 2:54 PM

For Sonarr, I ran the install command: https://app.crowdsec.net/hub/author/schiz0phr3ne/log-parsers/sonarr-logs

However, do I need to update the description to point to where the log is located? Where does the collection install to so I can update this? It doesn't say where in the support documentation.

Collections, AppSec Rules & Configurations | CrowdSec Hub

Manage collections, configurations, remediation components, and AppSec rules with CrowdSec Hub. Streamline security with tools and integrations for enhanced protection.

Mmman3222 For Sonarr, I ran the install command: https://app.crowdsec.net/hub/author/schiz...

Loz•12/9/25, 2:55 PM

by default collections only install parsers/scenarios, so where you saw "npmplus.yaml" you need to create your own call for example and make sure crowdsec has access to the logs somehow

mman3222OP•12/9/25, 4:03 PM

But do I need to install the collection for each application if it exists like Sonarr, Radarr, etc. and THEN create an acquisition .yaml file for each application? So, in my head, I'm thinking it's a 2 step process:

Install Collection (if it exists)
Create acquisition.

If a collection doesn't exist, then I'm out of luck for that docker container.

Is that correct?

mman3222OP•12/9/25, 5:47 PM

I can't get it to work. I installed the collection, created the acquisition, restarted, but no blocks happen. I'll just close this and try to come up with another solution for brute-force login. Thank you for responding though! I appreciate it.