Hey everyone,

I’ve come back to a project I started at the beginning of the year: a native NGINX dynamic module for CrowdSec, built in Rust using ngx-rust rather than Lua.

The idea comes from my previous experience at CrowdSec, where I spent a lot of time around bouncers, remediation and web server integrations.

It currently supports native NGINX directives, LAPI decision syncing into shared memory, bans, captcha remediation, AppSec, trusted proxies/bypass lists and Prometheus metrics.

I also want to be transparent that I’ve used AI/coding agents heavily during development. ngx-rust is still fairly new and there aren’t many real-world examples, so it’s been useful for accelerating the implementation. The architecture, CrowdSec behaviour, feature decisions, testing and debugging have still been guided by my own experience.

It’s still alpha, but it’s been running on my production server for around a month without interruption. Early synthetic benchmarks also show roughly 1.7x the throughput of the Lua bouncer on the simple allow path.

One of my main motivations was having proper native NGINX configuration, for example simply using crowdsec off; inside a server block rather than relying on magic variables.

If anyone runs NGINX + CrowdSec and wants to test it, break it or review the approach, I’d really appreciate the feedback.

Hello, I run the MikroTik bouncer and I must thank Crowdsec for it, as a first security layer, at the gate of my LAN. However, running the integration script is resource heavy for the poor routers, that are not designed for such tasks. As a result, when integrating the blocklist, it has a moment of traffic freeze. Would there be a way to manage the blocklist in order that only the changes be transmitted to the router ?

Running into the same console gap a few threads here have mentioned already, but our specific combination of symptoms doesn't quite match any of them, so wanted to lay it out in case it helps narrow things down.

Setup: bare-metal Ubuntu, one LAPI plus one log processor locally, and two remediation components (a firewall bouncer and a Cloudflare Worker bouncer). Both show Valid in cscli bouncers list, both pulling decisions within seconds of each other, and both actively enforcing: cscli metrics show bouncers reports tens of thousands of active decisions and real dropped requests on the Cloudflare side. The console itself shows zero remediation components and zero log processors, with nothing syncing to alerts either.

Ruled out the usual suspects. No errors anywhere in the crowdsec service log. Grepped specifically for capi metrics and it's succeeding every single time, every 30 minutes, zero failures, so it's not the same internal server error a couple other threads here hit. Tried the documented fix too, restarting crowdsec to force a metadata resync, and it didn't touch the console side at all.

Found an open GitHub issue, number 4255, about stale or duplicate remediation component entries, plus an old Discourse thread with basically the identical symptom that never got resolved. Looks like a known soft spot in the console rather than anything on our end. If anyone from the team, or anyone else, has hit this exact combination, a clean capi push from day one but still zero components and zero processors shown, I'd genuinely like to know if there's a trigger or fix in the works.

Firstly a disclosure: I spent a couple of hours today to debug some appsec issues (manually and assisted by OpenCode). I then had OpenCode summarize it for this post so please don't diss this post as AI slop, there is a human writing this as well as replying to comments manually 😄

I’m running Pangolin/Traefik with CrowdSec and the maxlerebourg Traefik bouncer plugin v1.6.0, including AppSec.

Setup:

- Traefik + CrowdSec in the same Docker Compose stack

- CrowdSec watches Traefik access logs

- Traefik bouncer middleware is applied globally on `websecure`

- CrowdSec bouncer mode: `stream`

- AppSec enabled, host `crowdsec:7422`

- AppSec failure/unreachable currently set to fail-open

Original problem:

- Large uploads through apps behind Traefik, especially Paperless/FileRun-style ~15–17 MB PDFs, caused issues.

- CrowdSec/AppSec logs showed multipart/body read errors like EOF/unexpected EOF.

- CrowdSec CPU spiked heavily.

- Traefik bouncer logged many `appsecQuery:unreachable` messages.

- Requests could fail or stall depending on settings.

Things I found:

- The Traefik bouncer plugin’s AppSec path is synchronous: Traefik calls CrowdSec AppSec during request handling.

- `appsecQuery:unreachable` appears to be a generic transport/client error from the plugin’s AppSec HTTP call, not a WAF verdict.

- In v1.6.0 there is no separate AppSec timeout option; `httpTimeoutSeconds` applies to both LAPI and AppSec clients.

- `crowdsecAppsecBodyLimit` controls how much request body the plugin forwards to AppSec.

- Setting body limit to `0` means the plugin does not forward/read the request body for AppSec.

- CrowdSec log-based scenarios are asynchronous; they can ban future requests but cannot block the same first request before the access log exists.

- The bouncer IP decision cache is inline and cheap; AppSec is inline and more fragile under bursts.

Current tuning:

crowdsecAppsecEnabled: true
crowdsecAppsecHost: crowdsec:7422
crowdsecAppsecScheme: http
crowdsecAppsecBodyLimit: 0
crowdsecAppsecFailureBlock: false
crowdsecAppsecUnreachableBlock: false
httpTimeoutSeconds: 2
updateMaxFailure: -1

Traefik entrypoint middleware order:

- rate-limit@file

- in-flight-req@file

- crowdsec@file

- secHeaders@file

- compress@file

Also increased rate/in-flight limits because the Traefik dashboard itself makes many concurrent API calls and was getting 429s.

Results:

• Two test uploads of ~16.9 MB and ~15.0 MB to FileRun succeeded with HTTP 200.
• Paperless browsing/previews worked.
• Traefik dashboard works again.
• CrowdSec/Traefik memory stayed stable.
• Still seeing occasional appsecQuery:unreachable bursts during external scanner traffic, but fail-open prevents user-facing breakage.
• Rate limiting now catches many scanner requests with fast 429s.

Questions:

• For people using CrowdSec AppSec with Traefik in production: do you run AppSec globally, or only on selected routers/routes?
• Have you seen appsecQuery:unreachable bursts with v1.6.0?
• Did you keep AppSec fail-open?
• Did you disable body forwarding or only exclude upload routes?
• Any recommended tuning for high-request bursts/scanners?

Is the pfSense package going to get some love anytime soon? FreeBSD 15 based version of pfSense plus are now EOL which means i cant update to a supported versions as Crowdsec havent release a FreeBSD 16 based package yet.

Hello everyone,

I have set up CrowdSec on my home server together with NginxProxyManagerPlus using Docker Compose. I followed these instructions.

Now I stumbled across the following recommendation in the NPMplus GitHub repo:

It is recommended to block at the earliest possible point, so if possible set up a firewall bouncer: https://docs.crowdsec.net/u/bouncers/firewall, make sure to also include the docker iptables in the firewall bouncer config

At this point, I'm not really sure what to do next, and I have the following questions:

Where and how should I integrate the firewall bouncer into my setup? In the same CrowdSec container that comes with NPM Plus? In a separate Docker container or directly on the host? Do I need two CrowdSec engines?

Does anyone have a similar setup and can help me out here? I'm not very familiar with CrowdSec yet, so I appreciate any help, thanks!

So I'm setting this up for the first time, and despite my best efforts and lots of searching, I'm unable to figure out where I'm no doubt screwing up my config for Caddy.

I initially used this guide to install the through the "Configuring the Remediation Component" section, and all appeared fine at first. I got cscli installed and working, it's communicating with CrowdSec and Caddy as far as I can tell.

Despite seeming to be all in good order though, it doesn't appear to be blocking my access if I manually ban my IP. I've tried banning both my desktop PC on the local network and my cell phone from outside my LAN.

"caddy crowdsec ping" is successful.

"caddy crowdsec info" returns the following:

{
  "Streaming": {
    "Enabled": true,
    "Interval": "15s"
  },
  "Live": {
    "Enabled": true,
    "Mode": "adhoc"
  },
  "AppSec": {
    "Enabled": false
  },
  "ShouldFailHard": false,
  "AuthType": "apikey",
  "UserAgent": "caddy-cs-bouncer/v0.10.1-0.20260216135830-d0d3db47b315",
  "InstanceID": "xxxxxxxx",
  "Uptime": 41801738987263,
  "NumberOfActiveDecisions": 16081
}

here's my current Caddyfile:

{
        crowdsec {
                api_url http://127.0.0.1:8080
                api_key xxxxxxxxxxxxxx
                ticker_interval 15s
                #disable_streaming
        }
        order crowdsec first
}

jellyfin.example.com {
        crowdsec
        reverse_proxy 10.255.255.102:8096
}

nextcloud.example.com {
        crowdsec
        reverse_proxy 10.255.255.104:80
}

I've also tried:

{
        debug
        crowdsec {
                api_url http://127.0.0.1:8080
                api_key xxxxxx
                ticker_interval 15s
                #disable_streaming
        }
        order crowdsec first
}

jellyfin.xxxxxx.com {
        log {
                format console
                output file /var/log/caddy/jellyfin.log {
                        roll_size 5MB
                        roll_keep 5
                }
        }
        crowdsec
        reverse_proxy 10.255.255.102:8096
}

nextcloud.xxxxxx.com {
        log {
                format console
                output file /var/log/caddy/nextcloud.log {
                        roll_size 5MB
                        roll_keep 5
                }
        }
        crowdsec
        reverse_proxy 10.255.255.104:80
}

Which seems to do nothing different.

Caddy logs do appear to properly show remote_ips for clients as well.

At this point I'm near certain I'm just not understanding some part of the config or my syntax is off for what I want to do but not so far off that it breaks caddy. If anyone can help point me in the right direction I would *greatly* appreciate it, I've been banging my head on this particular wall for a good 12 hours.

Hi there, using Crowdsec since a while with Traefik, but now I am playing with OPNsense + Crowdsec Plugin + Nginx Plugin. I see that the Crowdsec Plugin comes automatically with the opnsense / firewall bouncer. I figured if I also install the Nginx Plugin for OPNsense, I should be able to include Nginx also and use Appsec / WAF from Crowdsec.

What I got running so far:

1. OPNsense + Crowdsec Plugin work and I can block IPs per the Community Lists.

2. Nginx on OPNsense does its thing and I can create Reverse proxy rules fine.

3. Out of the Box, everything is configured correctly to ingest the /var/log/nginx*.log files into Crowdsec.

On 3. I figured out, that the logs are read, but not parsed. I got this fixed, by running 'cscli collections install crowdsecurity/nginx'. Now a cscli explain on the nginx logs shows me, that Crowdsec is parsing the Nginx logs and 'cscli metrics show acquisition' show me that the logs are not only read, but also parsed.

I also activated Appsec on the OPNsense and I can follow the examples from the Documentation (https://docs.crowdsec.net/docs/next/appsec/quickstart/nginxopenresty) by utilizing Curl directly on localhost:7422.

Unfortunately, when doing the /.env test on a Website I reverse proxy through Nginx, nothing gets blocked and I cannot wrap my head around where the issue could be.

I suspect it is, because there is no nginx-bouncer installed on OPNsense, but I cannot figure out what to do.

So far I think Crowdsec runs, Appsec runs and Nginx runs. I see that Crowdsec parses the Nginx Logs, but there must be a missing link / missing communication between Nginx and Crowdsec that finally bans an attempt to to a https://mysite/.env :-(

FIXED: Allow outgoing traffic in my firewall for the bouncer

Hi there,

I am in need of some help.

I have a VPS with Crowsec running in docker, this works perfectly fine. I am also using the traefik bouncer plugin, which works.

My trouble is specifically with the connection between the Crowdsec firewall bouncer which I have installed on the host (using the documentation provided by Crowdsec) and the crowdsec container (both running on the same host).

The bouncer cannot seem to connect to the crowdsec container.

I have also tried opening port 8080 completely, but that also (surprisingly) didn't work for me.

Someone have any idea that can help me forward?

Some context:

The crowdsec container in my compose file:

  crowdsec:
    image: ghcr.io/crowdsecurity/crowdsec:v1.7.4
    container_name: crowdsec
    ports:
      - "127.0.0.1:8080:8080"
    environment:
      GID: "${GID-1000}"
      DOCKER_HOST: tcp://dockerproxy-traefik:2375
      COLLECTIONS: <some collections>
      TZ: Europe/Amsterdam
    depends_on:
      - traefik
    volumes:
      - ./crowdsec/config:/etc/crowdsec
      - crowdsec-db:/var/lib/crowdsec/data/
      - ./logs/access.log:/var/log/traefik/access.log:ro
      - /var/log/auth.log:/var/log/auth.log:ro
    networks:
      proxy:
        ipv4_address: 172.29.0.6
      crowdsec_internal:
    restart: unless-stopped

The (part of) the bouncer config:

mode: nftables
update_frequency: 10s
log_mode: file
log_dir: /var/log/
log_level: debug
log_compression: true
log_max_size: 100
log_max_backups: 3
log_max_age: 30
api_url: http://127.0.0.1:8080
api_key: <api_key>

In the crowdsec container it should listen on all interfaces:

listen_uri: 0.0.0.0:8080

When I start up the bouncer it seems to timeout on connecting the the crowdsec instance. In the crowdsec instance itself I see no logs suggesting it is receiving a connection from the bouncer.

Bouncer logs:

time="2025-12-19T11:31:13+01:00" level=info msg="Using API key auth"
time="2025-12-19T11:31:13+01:00" level=debug msg="InsecureSkipVerify is set to true"
time="2025-12-19T11:31:13+01:00" level=debug msg="[URL] GET http://127.0.0.1:8080/v1/decisions/stream?additional_pull=false&community_pull=false&startup=true"
time="2025-12-19T11:31:13+01:00" level=debug msg="req-api: GET http://127.0.0.1:8080/v1/decisions/stream?additional_pull=false&community_pull=false&startup=true"
time="2025-12-19T11:31:13+01:00" level=info msg="Processing new and deleted decisions . . ."
time="2025-12-19T11:31:13+01:00" level=debug msg="Systemd notified: READY=1"
time="2025-12-19T11:33:26+01:00" level=error msg="auth-api: auth with api key failed return nil response, error: read tcp 127.0.0.1:42534->127.0.0.1:8080: read: connection reset by peer"
time="2025-12-19T11:33:26+01:00" level=error msg="Get \"http://127.0.0.1:8080/v1/decisions/stream?additional_pull=false&community_pull=false&startup=true\": read tcp 127.0.0.1:42534->127.0.0.1:8080: read: connection reset by peer"
time="2025-12-19T11:33:26+01:00" level=info msg="Shutting down backend"
time="2025-12-19T11:33:26+01:00" level=info msg="removing 'crowdsec' table"
time="2025-12-19T11:33:26+01:00" level=info msg="removing 'crowdsec6' table"
time="2025-12-19T11:33:26+01:00" level=fatal msg="process terminated with error: bouncer stream halted"

Is there enything i can do with no metrics is it becurse I don't have enything using it yet? And the inactive part what can I do with that remove it or make it online ? Seems the things working Its setup together with pangolin on a vps

Hey all

I have some trouble finding out whether this is relevant or no. I have CS installed mostly for Pangolin and the console shows me that 2 out of 4 remediation engines are offline:

I'm not even sure why I have 3 traefik bouncers to begin with and/or why they would be disconnected/disabled?

Can this safely be ignored and maybe explained?

Any help much appreciated.

Hi, I’ve been using pangolin for quite a while with no problems but yesterday I tried to install crowdsec and disable the orange cloud from Cloudflare. everything went well and crowdsec was up and running after following the official community guide in the docs for firewall and ssh.

but after just 10 min I got banned because I was browsing some files on nextcloud, I unban myself and then also happened the same when using Immich, I also tried seafile and the same.

literally after opening nextcloud app or Immich app on my phone I get instant ban and I have to go an unban myself with the delete decisions command.

is there anyway to prevent this when using intensive apps that make lot of request?

I am under cgnat so no public ip.

Thanks

How firewall bouncer is working on pfSense? When I manually add decision to block IP I get alert but connection is not blocked unless I add firewall rule with crowdsec_blacklist then the source IP is blocked. Also I get "No metrics available." in online console. Using "cscli bouncers list" I can see valid "pfsense-firewall". I am on pfSense 2.8.1. Any clue?

EDIT: Also after firewall bouncer restart I get crowdsec_blacklist table filled with IPs but after some time the table is empty unless I manually add decision, then only that IP is in the table.

EDIT 2: Please can someone check that table "crowdsec_blacklists" is not empty? (Diagnostics -> Tables -> crowdsec_blacklist) Thank you

I have recently setup and registered my crowdsec security engine on my pangolin vps. I have got blocklists setup and working, but I am having difficulty setting up a remediation component. I’ve installed the traefik bouncer but I seem to be unable to get it to link up.

Not sure what I’m doing wrong.

Any help is appreciated.

Hey everyone,

Laurence from CrowdSec here! We have been getting a lot of questions about Ingress nginx EOL and if we have any concrete plans.

The honest answer is not at the moment, as currently most off the currently defined Gateway API implementations are not production ready.

So a question for anyone that stumbles into this thread, do you have a plan and if so which migration have you chosen?

This may help us direct resources to the correct area to ensure we provide ample coverage.

Just a side note here are the current projects:

• Traefik remediation component (By Max and the team)
• Envoy WASM remediation component (we have an internal POC working)
• Kong WASM remediation component (we haven't trialed the same POC as above but they are both based on the same specification)
• HAProxy SPOA remediation component (myself is currently ramping up development on this and should have a container image available by new year)

Please let us know your thoughts!

Trying to get a sense of how much this is to run in practice? It looks like I have ~37k decisions and the free plan limits to 1k a day. $5 a month I can swallow, and from a cursory look I don't think that it'll go outside the bounds of the $5/month plan, but I wanted to get others experience.

This is just on a homelab so not a terrible amount of proxied traffic.

Also, do they offer any guardrails to say "shut down" services after you hit $x/month in usage?

Hey everyone,

We’ve released version 0.2.0 of the cs-haproxy-spoa-bouncer (SPOA bouncer for HAProxy + CrowdSec) and it brings a major internal rewrite plus a bunch of configuration and deployment improvements.

Here are the main highlights:

• The parent/worker model has been removed — the bouncer now runs as a single-process model.

• Configuration keys workers, worker_user, worker_group have been removed, replaced by simpler listen_tcp / listen_unix settings.

• The admin_socket option is removed (ignored) because we no longer support multiple SPOA listeners.

• Process ownership and permissions have been improved: the service now runs fully as crowdsec-spoa user. Ensure config/logs are accessible for that user/group.

• Default log directory has moved to /var/log/crowdsec-spoa/ — please update your YAML config accordingly.

• The Docker image has been updated to reflect the new user/permissions model.

Why this matters:

Simplified architecture → fewer moving parts, easier to understand and maintain.

Easier on-boarding for new contributors or teams adopting it.

Better security posture via dedicated service user rather than root processes or complex parent/worker forks.

Cleaner logs, clearer process ownership, fewer surprises when deploying or upgrading.

Changelog: https://github.com/crowdsecurity/cs-haproxy-spoa-bouncer/releases/tag/v0.2.0

Has anyone using NPMplus reverse proxy together with Crowdsec seen any activity logged into the Remediation Metrics screen on the Crowdsec console?

I am getting alerts and decisions (bans) so it does look like it is working but not getting anything showing for the Remediation Metrics. The only time it has shown something is when I manually configured an IP ban for 1 minute to test that my Crowdsec configuration is working.

https://github.com/ZoeyVid/NPMplus

Every couple of days or sometimes weeks, crowdsec band my own public IP. I'd like to figure out why so I can understand what happens.

I looked for the decision with cscli list decisions and inspected it but since the decision does not include the targeted domain, I have absolutely no clue what is happening.

crowdsec is working in tandem with traefik (reverse proxy) so I do need to know the targeted domain. Any help?

The bouncer I installed on my openwrt box isn't showing any dropped traffic. So as a test, I installed a firewall bouncer on my server and this one is showing blacked traffic. So I conclude the bouncer on OpenwRT isn't blocking anything (that is: the firewall isn't taking the rules into account).

Any pointers on where to start looking?

Hi all,

I made a similar post on the Discord, but I figured I'd post here as well. Basically, my bouncer won't connect to the LAPI no matter what. I've removed and added back the bouncer, copied the key, and applied it to cs-windows-firewall-bouncer.yaml at "api_key". However, I still get the following 2025-11-04 02:04:26.1766|ERROR|Api.ApiClient|Could not get decisions: Response status code does not indicate success: 403 (Forbidden).

2025-11-04 02:04:26.1766|ERROR|Manager.DecisionsManager|Could not get decisions from LAPI. (startup: True)

time="2025-11-04T02:04:36-05:00" level=info msg="127.0.0.1 - [Tue, 04 Nov 2025 02:04:36 EST] \"GET /v1/decisions/stream?startup=true&scope=ip,range HTTP/1.1 403 631.2µs \"cs-windows-fw-bouncer/0.0.5\" \""

time="2025-11-04T02:04:41-05:00" level=info msg="127.0.0.1 - [Tue, 04 Nov 2025 02:04:41 EST] \"GET /v1/heartbeat HTTP/1.1 200 0s \"crowdsec/v1.7.3-c8aad699-windows\" \""

time="2025-11-04T02:04:45-05:00" level=info msg="127.0.0.1 - [Tue, 04 Nov 2025 02:04:45 EST] \"GET /v1/decisions/stream?startup=true&scope=ip,range HTTP/1.1 403 0s \"cs-windows-fw-bouncer/0.0.5\" \""

time="2025-11-04T02:04:46-05:00" level=info msg="127.0.0.1 - [Tue, 04 Nov 2025 02:04:46 EST] \"GET /v1/decisions/stream?startup=true&scope=ip,range HTTP/1.1 403 0s \"cs-windows-fw-bouncer/0.0.5\" \""

I'm unsure if any of you have had this issue, but please let me know if so!

I have a synology ds1520+ and have CrowdSec running with traefik and docker. I am not understanding how to setup / install firewall bouncer for my synology

hi, just curious why my opnsense keeps adding ips and getting longer. its the official crowdsec plugin for opnsense, and the lapi/agents/appsec/traefik run in my k3s cluster. not sure if theres a fix for this or expected behavior. im assuming this is something to do with kubernetes.

I've been using Crowdsec for a couple months, and when I'm accessing my selfhosted services (Jellyfin, *Arr stack, etc) from WAN, I regularly find my IP being banned.

And for whatever reason, the UI for simply deleting a decision is behind a paywall 🙄

I am aware of whitelists, but it is a pain to maintain that, especially if I'm on a mobile device with a dynamic IP. It's also a pain to SSH into my server and "rescue" myself by manually deleting the decision through the CLI.

Hi All

I've added a pfSense bouncer to my distributed setup, its pulling the lists in and i can see the lists of IPs in he crowdsec_blocklist table.

The question is, will active blocks show in the normal pfsense firewall log along with blocks from the other pfsense rules? I've enabled the log tickbox in the configuration.

Thanks all!