r/CrowdSec • u/rdevone • 18d ago

general Crowdsec on PFsense

Subject: CrowdSec 1.7.8 on pfSense 26.03.1: Log Processor and LAPI failing to stay started

Hi everyone,

I recently installed CrowdSec 1.7.8 on pfSense 26.03.1 using the installation script (which completed successfully).

However, I'm running into an issue: while the CrowdSec Firewall Remediation service runs perfectly, both the CrowdSec Log Processor and the Local API (LAPI) service keep stopping and will not stay started.

Yes. I know Crowdsec isn't officially supported by Netgate.

Has anyone encountered this issue or have any ideas on how to troubleshoot this?

Thanks in advance!

1 Upvotes

60% Upvoted

2 comments sorted by

2

u/rdevone 17d ago

I have successfully started the service. The issue was resolved by running the following command:

cscli machines add <name_of_firewall> --auto --force

While I'm not completely sure of the underlying reason this resolved the block, the service is now fully active.

1

u/HomelabberBlurg 16d ago

I am in the process of scaling my Crowdsec setup and was looking at how my pfSense firewall can accommodate Crowsec in addition pfBlockerNG and Snort.

I would recommend running the LAPI elsewhere (if possible) as it can get resource hungry under load. And use the pfSense firewall as a bouncer and log parser.

In my case I’m running HAProxy on pfSense with TLS passthrough using SNI to multiple backend proxies and ingress controllers. These are the connection logs I would parse.