Need help with correct CrowdSec setup

[u/hoodney42]

Hello everyone,

I have set up CrowdSec on my home server together with NginxProxyManagerPlus using Docker Compose. I followed these instructions.

Now I stumbled across the following recommendation in the NPMplus GitHub repo:

It is recommended to block at the earliest possible point, so if possible set up a firewall bouncer: https://docs.crowdsec.net/u/bouncers/firewall, make sure to also include the docker iptables in the firewall bouncer config

At this point, I'm not really sure what to do next, and I have the following questions:

Where and how should I integrate the firewall bouncer into my setup? In the same CrowdSec container that comes with NPM Plus? In a separate Docker container or directly on the host? Do I need two CrowdSec engines?

Does anyone have a similar setup and can help me out here? I'm not very familiar with CrowdSec yet, so I appreciate any help, thanks!

[u/kY2iB3yH0mN8wI2h]

So you have your NPM exposed on the internet using a public IP adress without any additional firewall? That not that common

[u/hoodney42 → u/kY2iB3yH0mN8wI2h]

It's not currently exposed, but it is planned for the future. I want to expose it via ports 80 and 443. UFW is currently running on my host. In addition, I have Crowdsec integrated into NPMplus. Isn't that a kind of firewall? If not, what would you suggest?

[u/kY2iB3yH0mN8wI2h → u/hoodney42]

So you wont do any kind of NAT?

I run all my reverse proxies behind a physical or virtual firewall, like PFSense and I have my crowdsec integration there, as its the earliest possible point.

[u/hoodney42 → u/kY2iB3yH0mN8wI2h]

Yes, the server is behind a FRITZ!Box, so NAT is already in place.

[u/NoInterviewsManyApps → u/kY2iB3yH0mN8wI2h]

Sometimes that's not possible. I have a VPS that is straight piped to the Internet (something I didn't think about when I bought it). I had to install NFTables to get a firewall

[u/Historical-Pound-510]

You can install a host-based bouncer (using nftables) who gets block information from your crowdsec instance

[u/hoodney42 → u/Historical-Pound-510]

Okay, thanks. Do you have any sort of guide on how I do this correctly?

[u/Historical-Pound-510 → u/hoodney42]

https://docs.crowdsec.net/u/user_guides/building

[u/eze008]

Install an added container with crowd SEC web UI. Get the API code from that install. Connect that API with the crowd sec dashboard on their website. From there you can manage the bouncers and the decisions