Hey all, i’ve decided I should probably setup something else to help block nefarious IP addresses. I’ve been looking into CrowdSec and Fail2Ban but i’m not really sure the best one to use.
My setup is OpnSense -> Nginx Proxy Manager -> Servers. I think I need to setup CrowdSec/Fail2Ban on the Nginx Proxy Manager to filter the access logs, then ideally it would setup the blocks on OpnSense - but i’m not sure that can be done?
Any experience in a setup like this? I’ve found a few guides but some of them seem fairly outdated.
Edit: thanks everybody for the great info. General consensus seems to be with crowdsec so I’ll go down that path and see how it goes.
You must log in or register to comment.
Fail2ban unless you need the features that crowdsec provides. They are different tools with different purposes and different features.
CrowSec, it’s not one that you mentioned but once they locate the source of the malicious traffic, they send out a murder of trained attack birds to resolve the issue.
Nah, that one conflicts with my IPoAC networks unfortunately :(
RFC 1149 compatibility is expected in an upcoming release, keep an eye out.
I’ve been using crowdsec … but I’ve yet to see anyone banned but myself so far. Is everyone else having to write tons of whitelist parsers? I could whitelist my IP but I feel like that’s sidestepping the issue and doesn’t address friends/family also getting banned, coffeeshops, etc.
Feels like I’m missing something as so far it’s been quite a pain to configure
Where did you have it setup? Is your proxy configured to forward the real IP?
From the guy that has been accused of going overboard on security measures, I use both. It just depends on your setup tho. On a low resource server, I would pick crowdsec as it covers more ground than F2B. Running two log parsers does use more resources. ~ my 2 cents
I had fail2ban running for several years before switching to CrowdSec late last year. They both work in a similar fashion and watch your logfiles for break in attempts. With the small difference that CrowdSec also lets you use blocklists from the “crowd” to block malicious actors before they even get to try their luck on your machine(s).
I’m using CrowdSec with Traefik and nftables. But there are some bouncer plugins for nginx and OpnSense, too.
I just followed their example configurations for Docker, Docker Compose and then started tinkering with the config until everything worked as desired.
Thanks those links were helpful to get me on the right path. I like that there is a plugin for Opnsense directly and has that central LAPI, because I’d need something similar if I was to use f2b.
I have traefik running with all config done via the docker compose files and I just couldn’t figure out how to get the bouncer middleware to work without causing problems. Doesn’t help that most examples seem to be based on the static yaml based config so I’m trying to convert jt. Would appreciate anyone who might know of a resource that explains with docker compose environment tags.
I also have middle ware for things like authentik which complicates things.
In addition to the explanation you got from the other user: once you’ve set up the bouncer middleware in the configs (don’t know if there even exists a good way to do that outside of the configs files), you simply assign the middleware in the compose file as usual.
In the Traefik static configuration (usually
traefik.yml), add this to load the CrowdSec plugin:experimental: plugins: crowdsec-bouncer-traefik-plugin: moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" version: "v1.4.2"(The name for the plugin is defined here as
crowdsec-bouncer-traefik-plugin.)Then, in your dynamic configuration, add this (I’ve used a separate file
dynamic_conf/050-plugin-crowdsec-bouncer.yml):http: middlewares: crowdsec-bouncer: plugin: crowdsec-bouncer-traefik-plugin: CrowdsecLapiKey: "...YOUR CROWDSEC LAPI KEY HERE..." Enabled: true(The name for this new middleware defined here is
crowdsec-bouncer. It uses thecrowdsec-bouncer-traefik-plugindefined in the previous step. Make sure these names match.)You can get the LAPI key by registering a new bouncer in CrowdSec.
And, finally, make sure all incoming traffic routes through the bouncer plugin. You can do this individually, or in general via the static config:
entryPoints: websecure: address: :443 http: middlewares: - crowdsec-bouncer@file - secure-headers@fileThe middlewares are processed top to bottom.
Any change to the static configuration requires a restart of Traefik to become active.
Crowdsec with a central LAPI server. You should install it on the servers themselves to monitor the application logs directly. Then every bouncer(firewall, router, edge device) connected to the LAPI will all block the same IPs. I got sick of repeat offenders and upped the ban time to 1 year in hours.
Awesome that makes a lot of sense, cheers. So I’ll install the Crowdsec agent on the Nginx Proxy Manager, and potentially also on the servers.
I’ve recently enabled banning whole subnets if more than 3 malicious actors from that subnet are on the blocklist. This is great for all those DigitalOcean droplets and other cheap hosters used by those people…
I’ve been thinking about going this route. What size subnet are you banning? /24?
Only thing stopping me is I selfhost email and don’t want to ban say a whole subnet from Microsoft/Azure and end up blocking the outgoing servers for O365. I’m sure I can dig around and look at the prefixes to see which are used for which of their services just haven’t had the time yet.
I let CrowdSec determine that. I’m seeing
/13,/12and even/10in my decisions list. All seem to be Amazon AWS ranges.Wow, those are big networks. Obviously I suppose in case of AWS it doesn’t matter as no human visitor (except maybe some VPN connection?) will visit from there.
As someone who bans /32 IPs only, is the main advantage resource consumption?
Im a lazy mofo. I use fail2ban since SWAG has one built in.
I’m currently going through a similar situation at the moment (OPNSense firewall, Traefik reverse proxy). For my solution, I’m going to be trial running the Crowdsec bouncer as a Traefik middleware, but that shouldn’t discourage you from using Fail2Ban.
Fail2Ban: you set policies (or use presets) to tempban IPs that match certain heuristic or basic checks.
Crowdsec Bouncer: does fail2ban checks if allowed. Sends anonymous bad behavior reports to their servers and will also ban/captcha check IPs that are found in the aggregate list of current bad actors. Claims to be able to perform more advanced behavior checks and blacklists locally.
If you can help it, I don’t necessarily recommend having OPNSense apply the firewall rules via API access from your server. It is technically a vulnerability vector unless you can only allow for creating a certain subset of deny rules. The solution you choose probably shouldn’t be allowed to create allow rules on WAN for instance. In most cases, let the reverse proxy perform the traffic filtering if possible.
I did have that same thought actually, with opening up opnsense to be modified. But I also like the idea of it getting blocked before it even gets into my network, instead if letting it in initially and then blocking afterwards - that’s kinda the whole job of a firewall after all ha ha
Crowdsec if you have many instances that need to report to each other.
If you just have a single instance and care to configure f2b for those services, then it’s fine. I would suggest incorporating the use of public blocklists though.
Why not just put everything behind a VPN and stop worrying?
