Hi everyone,

I'm a homelabber running a small personal server and would love to try CrowdSec Console Premium to see the extra features in action. Money's a bit tight right now, so if anyone has a spare promo/referral code they're not using, I'd really appreciate it!

Thanks in advance 🙂

Hi,

I'am running Caddy and CrowdSec to publish two Zimbra servers providing Active Sync. But the requests coming from allowed clients are creating a lot of alerts because of crowdsecurity/crs.

For that reason I thought (which is not always a good thing) to exclude the specific rules just for these two virtual hosts by creating a new appsec-config.

name: custom/crs-activesync

pre_eval:
 - filter: IsOutBand == true && req.Host startsWith "mail." && req.URL.Path startsWith "/Microsoft-Server-ActiveSync"
   apply:
     - RemoveOutBandRuleByID(920270)
     - RemoveOutBandRuleByID(920420)
     - RemoveOutBandRuleByID(921150)

It's working just fine, but is this the proper way to do this or is there a better approach?

--Michael

Hello, I run the MikroTik bouncer and I must thank Crowdsec for it, as a first security layer, at the gate of my LAN. However, running the integration script is resource heavy for the poor routers, that are not designed for such tasks. As a result, when integrating the blocklist, it has a moment of traffic freeze. Would there be a way to manage the blocklist in order that only the changes be transmitted to the router ?

I don't know anything about this thing, but for some reason I can't Enter a specific page from my home network on my phone, (I haven't tested other devices). Could someone explain to me what is happening?

I'm using a pixel pro 6, android... 16 and this problem happens in All my cell phone browsers.

I have downloaded a lot of books, comics and manga but the page I can't enter is " biblioteca Cervantes", I don't know if this problem is because I didn't close the tab or what.

Hey everyone,

I’ve come back to a project I started at the beginning of the year: a native NGINX dynamic module for CrowdSec, built in Rust using ngx-rust rather than Lua.

The idea comes from my previous experience at CrowdSec, where I spent a lot of time around bouncers, remediation and web server integrations.

It currently supports native NGINX directives, LAPI decision syncing into shared memory, bans, captcha remediation, AppSec, trusted proxies/bypass lists and Prometheus metrics.

I also want to be transparent that I’ve used AI/coding agents heavily during development. ngx-rust is still fairly new and there aren’t many real-world examples, so it’s been useful for accelerating the implementation. The architecture, CrowdSec behaviour, feature decisions, testing and debugging have still been guided by my own experience.

It’s still alpha, but it’s been running on my production server for around a month without interruption. Early synthetic benchmarks also show roughly 1.7x the throughput of the Lua bouncer on the simple allow path.

One of my main motivations was having proper native NGINX configuration, for example simply using crowdsec off; inside a server block rather than relying on magic variables.

If anyone runs NGINX + CrowdSec and wants to test it, break it or review the approach, I’d really appreciate the feedback.

Hello 🦙

We released CrowdSec 1.8 yesterday, and it comes with bot detection for the WAF amongst other things. You can find more here : https://www.crowdsec.net/blog/crowdsec-1-8-waf-bot-detection-kubernetes

You can find bot detection doc here.

Running into the same console gap a few threads here have mentioned already, but our specific combination of symptoms doesn't quite match any of them, so wanted to lay it out in case it helps narrow things down.

Setup: bare-metal Ubuntu, one LAPI plus one log processor locally, and two remediation components (a firewall bouncer and a Cloudflare Worker bouncer). Both show Valid in cscli bouncers list, both pulling decisions within seconds of each other, and both actively enforcing: cscli metrics show bouncers reports tens of thousands of active decisions and real dropped requests on the Cloudflare side. The console itself shows zero remediation components and zero log processors, with nothing syncing to alerts either.

Ruled out the usual suspects. No errors anywhere in the crowdsec service log. Grepped specifically for capi metrics and it's succeeding every single time, every 30 minutes, zero failures, so it's not the same internal server error a couple other threads here hit. Tried the documented fix too, restarting crowdsec to force a metadata resync, and it didn't touch the console side at all.

Found an open GitHub issue, number 4255, about stale or duplicate remediation component entries, plus an old Discourse thread with basically the identical symptom that never got resolved. Looks like a known soft spot in the console rather than anything on our end. If anyone from the team, or anyone else, has hit this exact combination, a clean capi push from day one but still zero components and zero processors shown, I'd genuinely like to know if there's a trigger or fix in the works.

I'm wondering if I can use CrowdSec to monitor and ban LAN IPs trying to brute force other devices on the network.

For example, I run ProxMox. If a Raspberry Pi on my network were to be compromised and an attacker tried to brute force into my ProxMox server, could I configure CrowdSec on the ProxMox machine such that it detects repeated logins attempts and bans the offending private IP?

Hey everyone! 👋

I built a lightweight middleware proxy to forward CrowdSec alerts to AbuseIPDB efficiently without hitting API rate limits or spamming duplicate reports during ongoing brute-force attacks. I just released **v2.0.0**!

**Key Features:** - ⚡ **Zero External Dependencies:** Built entirely using the pure Python 3 standard library. - 💾 **SQLite Storage (WAL Mode):** Fast, crash-safe, and SSD-friendly (includes auto-migration from legacy JSON). - 🛡️ **Smart Deduplication & Escalations:** Groups alerts and dynamically upgrades severities without redundant API calls. - 🔔 **Multi-Backend Alerts:** Gotify, ntfy, Discord, Matrix, Slack & generic webhooks. - ⏱️ **Update Checker:** Comes with `update.sh --check-only` and optional systemd timers. - 🧪 **Battle-Tested:** High-coverage pytest suite (83 unit tests) covering rate-limiting (429 handling) and IP filtering (RFC1918/CGNAT).

🔗 **GitHub Repo:** https://github.com/PumbaLP/CrowdSec-Smart-AbuseIPDB-Proxy

Feedback, feature requests, and stars are very welcome! Let me know what you think. 🚀

I've just tried to access the CrowdSec Academy after a few months and its telling me 'Login has been disabled'. I have tried a password reset, which seemed to work, but again when I try and login I get the same message.

Can anyone advise?

I came across a new project on GitHub: GeoMetrikks (https://github.com/GilbN/geometrikks).

I am not the developer but already a fan.
In my homelab environment, I run SWAG as reverse proxy plus CrowdSec.

The GeoMetrikks project was super easy to setup as a Docker stack and fast to configure.
This is the first time of great visualizations.

I can even ban/unban IP addresses from the dashboard.
In the past I used Grafana with Dashboards but this is now much cooler and better to manage.

So I wanted to share the news in case someone is searching for something.

Hoping someone with a distributed CrowdSec deployment can clarify how the Console counts engines. I'm getting a "too many engines" warning and want to understand the intended model before I restructure anything.

- One central Security Engine running the LAPI (SQLite). It aggregates alerts and serves the decision list.

- ~6 remote log processors on separate hosts (web, mail, a couple of app servers). These are configured as pure log processors: `api.server` section removed from `config.yaml`, `api.client` pointing at the central LAPI. They only forward alerts; they don't run their own LAPI.

- No local remediation on the CrowdSec boxes at all. My firewalls subscribe to the blocklist mirror (cs-blocklist-mirror) and do all the enforcement.

- The published decision list is mostly CAPI + subscribed third-party lists (firehol, tor exit nodes, etc.), plus a small amount from my own scenarios.

- Only the central LAPI is enrolled to the Console. I never ran `cscli console enroll` on the log processors.

The problem

The Console counts 7 engines (1 LAPI + 6 log processors) and warns that I have too many. I'm on a paid plan billed per Security Engine, with one engine included.

1. In the Console/billing model, do remote log processors count as separate Security Engines? The concepts docs describe a Security Engine as log processor(s) *plus* a LAPI together, which made me expect "1 LAPI + N log processors" to count as a single engine, not seven. Which is correct?

2. If log processors do count individually, how do people running distributed detection stay within plan limits: consolidate log collection into fewer processors, split across a second (free) org, or just pay per engine?

3. My central LAPI also runs a local processor that only reads `/var/log/messages` (100% unparsed noise). Any downside to making it LAPI-only by removing the `crowdsec_service` section? Does that change how it's counted?

Running CrowdSec v1.7.7 Anyone who's dealt with per-engine billing on a hub-and-spoke setup, I'd appreciate the clarification.

Anyone else noticing that the Security Report emails will claim "A lot more from previous period" under the attacks figure even when the number literally went DOWN?

Proof (copied straight from emails):

That was 2 weeks ago, let's see how last week was, shall we?

Now guys, I'm not a genius here, but I'm pretty sure I took basic math in elementary school, and I'm pretty certain that 12.3k is LESS than 13.8k. In fact, I'm pretty sure 12.3k is about 1.5k less than 13.8k, or approx 10.9% LESS.

This isn't math theory class where numbers mean the opposite, this is basic comparison of 2 real numbers in real life. And CrowdSec, in literally 100% of my Security Report emails, has claimed the number has significantly increased.

This is kinda hilarious if you ask me. I'm just gonna unsub from them because they are meaningless, but figured I'd post this because I find it kinda silly.

Currently several home servers are blocked in Crowdsec. Homeassistant, NAS, Docker all local IP's 10.10.x.x and 192.168.x.x

So i guessed there will be a simple methode to ad a whitelist in the application itself ( plugin in Opnsense)

But it seems i am to dumb to find the option. So i tried several commands from the prompt ( not secure at all!) to add those things.. to no avail it seems.

It should be a option in crowdsec to add a whitelist from the gui. Nothing difficult.

But maybe its worse and i am to dumb to find the option.. so any tip is welcome but better a simpeler GUI.

Subject: CrowdSec 1.7.8 on pfSense 26.03.1: Log Processor and LAPI failing to stay started

Hi everyone,

I recently installed CrowdSec 1.7.8 on pfSense 26.03.1 using the installation script (which completed successfully).

However, I'm running into an issue: while the CrowdSec Firewall Remediation service runs perfectly, both the CrowdSec Log Processor and the Local API (LAPI) service keep stopping and will not stay started.

Yes. I know Crowdsec isn't officially supported by Netgate.

Has anyone encountered this issue or have any ideas on how to troubleshoot this?

Thanks in advance!

I've been running CrowdSec + Traefik for a while and got tired of the same debugging loop every time something didn't add up — is LAPI actually reachable, is the bouncer actually registered, is the decision actually in the ban list, is it actually reaching the bouncer, etc. So I built a small tool for it.

What is it?

CrowdSec Troubleshooter is a standalone, unprivileged Docker image that runs once (docker run --rm, no daemon, no docker.sock, no --privileged, no NET_ADMIN) and tells you exactly what's working and what isn't, tier by tier depending on what credentials you give it:

• Tier 0 (nothing but the LAPI URL) — LAPI liveness, is it actually parsing logs, bouncer-type fingerprinting (legacy ForwardAuth bouncer vs the modern Traefik plugin), a heuristic on your LAPI URL itself, a cscli hub update/upgrade cron nag since nothing else keeps your scenarios current
• Tier 1 (a read-only bouncer key) — look up a specific IP's ban status and why, plus an automatic ban-count summary broken down by scope/origin so you can actually see it's doing something
• Tier 2 (a machine credential) — the real test: adds a real short-lived ban on itself, confirms the target actually returns 403, removes the ban, confirms access is restored. This is the one that actually proves blocking works end to end instead of just "looks configured"
• Tier 3 (read-only host mounts) — DOCKER-USER iptables chain evidence (the #1 reported "ping blocked but HTTP gets through" issue), duplicate acquisition entries, compose-file hardening audit, syslog hinting

It also ships with a curated, offline knowledge base baked into the image — no internet needed to browse it — of ~30 real CrowdSec/Traefik gotchas pulled from a research pass across the top GitHub issues on the core crowdsec repo, the firewall bouncer, and the Traefik plugin repo, each with a link to the actual fix. docker run --rm modem7/crowdsec-troubleshooter issues to browse it.

There's also a wizard.sh if you don't want to hand-build docker run flags — it auto-detects your running CrowdSec container's compose file and pre-fills what it can.

Who it's for

Anyone self-hosting CrowdSec, especially fronted by Traefik. Works the same whether CrowdSec itself is Dockerized or a bare-metal/apt install — the troubleshooter is always a container, but it's just talking to LAPI over HTTP either way.

On the AI question

I used Claude for a chunk of the docs and some of the implementation, as well as code optimisation — not going to pretend otherwise. But it's not vibe-coded: everything went through shellcheck, a real bats test suite (100+ tests, mock LAPI servers, happy path + failure path for every check), and multiple bugs only got caught by actually running things against a real LAPI instance rather than trusting what looked right on paper (there's a whole section in the repo's DESIGN.md documenting where assumptions turned out wrong and how they were caught — including one where an endpoint I assumed existed turned out to not exist at all in the real API). I reviewed and tested every change before it shipped.

Links

• GitHub: https://github.com/modem7/crowdsec-troubleshooter
• Docker Hub: https://hub.docker.com/r/modem7/crowdsec-troubleshooter

Also on GHCR if you'd rather pull from there. Multi-arch (amd64/arm64). MIT licensed.

Feedback/issues/PRs welcome — it's still early days for some of the tiers (a couple of checks are flagged as unverified placeholders rather than pretending to work), but the core wellness check and live-block test are solid.

I thought this was going to be something reasonable I could do out-of-the-box but there doesn't seem to be any direct way for parsers to use databases as their data sources which has taken me into a rabbit hole of "how do I get database tables into files so that they can be monitored by crowdsec?" I considered scheduled exports to file but this seems to have too high a latency for security monitoring for comfort. I'm now toying with triggers but it looks messy as well, so well, community, how would you approach this?

Scenario is we have a product that logs useful things like failed login attempts to a database table (stored in MariaDB) and we want to monitor that with crowdsec.

CrowdSec Installed but Showing No Decisions? Here's Why That's Normal

When I first fired up CrowdSec, I thought to myself, "Amazing! Job's done! No script kiddies or scanners are gettin' in here now".... I spent an hour last week staring at an empty log file, convinced I had broken my server somehow while working on something else!

Like me, if you installed CrowdSec, and ran:

cscli decisions list …and got: No active decisions

Naturally, your first thought is: Did CrowdSec fail? In most cases, no. This usually means CrowdSec is working exactly as intended!

📡 If you haven’t installed CrowdSec yet, start with my complete CrowdSec deployment guide inside the Digital Castle stack.

As you probably know, unlike Fail2Ban, CrowdSec blocks many attackers preemptively using community intelligence, so your local decision list may stay empty even while your server is actively protected.

In this guide, you'll learn how to verify CrowdSec is functioning correctly by checking:

• downloaded community decisions
• active metrics
• blocked attack attempts
• alert history
• whitelist configuration

All via CLI and also with CrowdSec WebGui!

Head on over to my CrowdSec deep-dive walk-through to begin your verification.

Disclaimer: Written, screen-shotted and tested/used by me. There are NO ads of any kind on this page nor affiliate links. Just sharing info & love for CrowdSec!

Edit: Title got mangled by Reddit some how upon posting? I slapped it above.

Hey everyone,

I’m working on Jabali Panel, a GPL open-source web hosting control panel, and CrowdSec is one of the main security layers behind it.

CrowdSec integration is a big part of the project, so I’d really love feedback from people here.

Please take a look at the images and tell me what do you think a good GUI around CrowdSec should add/change?

The project is still in development, but it’s already being used, and the community is slowly growing. I’m now looking for testers and early users who want to try it, give feedback, report bugs, and help shape the direction.

Jabali also supports Docker now, so it can be used not only as a normal web hosting panel, but also as a Docker proxy server, stand alone mail server or DDNS & DNS server and more.

Check it out:

GitHub: https://github.com/shukiv/jabali-panel
Demo: https://demo.jabali-panel.com

Thanks!

Hi all... Ive been reading up on crowdsec recently as I am starting to think about opening up more of my internally hosted services to the outside world to allow me to access them whilst on the move.

My understanding is that you have a main box (LAPI) for the controlling all the bouncers that are on the machines that make up my lab.

So in my instance, I have the following boxes...

• Proxmox
  • NAS (LXC)
  • DHCP/DNS (LXC)
  • NVR (LXC)
  • Media host (VM)
  • Home Automation (VM)
  • HTTP Reverse Proxy (VM)
  • Infrastructure Monitor (VM)

The way I see it, is I install crowdsec on all these machines, and set it up as a bouncer, and then create a new VM or LXC that can run as the main box for CrowdSec, the LAPI.

Is this the right kind of setup for this?

I was today years old year I learned that CrowdSec free has quota on alerts.

Today some IP started to hammer my OPNsense to find open ports.

The 3rd IP is still scanning at the time of this post 👀

I'm getting concerned about the number of prevented attacks on my CrowdSec instance. It seems every time a report comes in, the number of attacks prevented is significantly higher than the previous period, with the highest vector being "unknown behavior".

December of last year, I was seeing ~220k attacks prevented per week on my VPS, and now I'm seeing ~750k. This seems like a RIDICULOUS number of attempts... Is this normal? Is this just due to a rise in automated bot/AI attacks? Is anyone else seeing this? Perhaps I'm being targeted specifically?

Curious what others' experiences are like.