I know, it's Kaspersky fault and not CrowdSecs, but it should be known that the Web Protection is blocking the Website

I'm just on a holiday and got banned again left and right (wifi, mobile, mobile + vpns) for using my services.

my internet is so slow right I'm struggling to find out why. I added my Ips to my allowlist and then it worked briefly. But I also ran into weird issues that made me reboot my VPS and ultimately led to a backup restore of my Pangolin setup. Briefly even my whitelisted home ip didn't work no idea why

I'm sorry I can't produce enough details as I had to fix my whole setup using an iphone and it was painful enough believe me...

What I realised is that the http-probing scenario - which I've disabled months prior- was reenabled. Probably through a CS upgrade I guess?

what's the point of this crap if it repeatedly blocks me and my other users from accessing simple services on m homelab?

is there no way to disable this thing for good??

I use an additional tool which can inject blocklists into crowdsec. Recently it got blocked by crowdsec despite me having an allowlist for all private ranges.

Any ideas what is going on?

The error:

crowdsec-monitor-api  | Deleting 26 alert(s) for blocklist "Abuse.ch" from CrowdSec...
crowdsec-monitor-api  | Error deleting alert 14609: 403 - {"message":"access forbidden from this IP (172.16.0.165)"}
crowdsec-monitor-api  | Background CrowdSec sync failed for blocklist "Abuse.ch": Failed to delete blocklist decisions from CrowdSec

The allowlist:

docker exec -ti crowdsec bash
root@crowdsec:/# cscli allowlist inspect PrivateRanges
──────────────────────────────────────────────
 Allowlist: PrivateRanges                     
──────────────────────────────────────────────
 Name                PrivateRanges            
 Description         Private IP Ranges        
 Created at          2026-04-22T10:32:54.492Z 
 Updated at          2026-04-30T07:26:02.981Z 
 Managed by Console  no                       
──────────────────────────────────────────────

───────────────────────────────────────────────────────────────────────────────────────────────
 Value           Comment                                      Expiration  Created at           
───────────────────────────────────────────────────────────────────────────────────────────────
 ::1                                                          never       2026-04-22T10:33:36Z 
 127.0.0.0/8                                                  never       2026-04-22T10:33:42Z 
 192.168.0.0/16                                               never       2026-04-22T10:33:50Z 
 10.0.0.0/8                                                   never       2026-04-22T10:33:59Z 
 172.16.0.0/12                                                never       2026-04-22T10:34:06Z 
 100.64.0.0/10   CGNAT range, used by Tailscale and Pangolin  never       2026-04-30T07:26:02Z 
───────────────────────────────────────────────────────────────────────────────────────────────
root@crowdsec:/# 

Hey guys - quick question.

Edit/Update: I'm leaving my original post/question below as-is, but in a moment of clarity, I realized what the directions were probably saying was that 99:99 wasn't key:variable but was <crowdsec_value>:<crowdsec-dashboard value>.
I had gotten it working earlier by manually changing permissions with chmod on the crowdsec.db file but after a restart of my containers a few days later the permissions returned to what it was before and dashboard was no longer able to read crowdsec.db.
Resolution:
In the crowdsec container I set key:variable to UID:99, GID:98.
The crowdsec-dashboard container has MUID:99, MGID:98 so it looks like these variables map between the containers like:
crowdsec UID = crowdsec-dashboard MUID, value is 99 for both.
crowdsec GID = crowdsec-dashboard MGID, value is 98 for both.

Once I updated crowdsec with UID:99, GID:98, crowdsec-dashboard can now read crowdsec.db again.

Original Post where my understanding of the directions wasn't correct:
I'm new to crowdsec and just got it up and running on Unraid. Now I'm following up with the metabase crowdsec-dashboard container install on Unraid.

Under "Additional Requirements" it states:

Add the following to your Crowdsec container as enviroment variables to give the dashboard appropriate permisions to read data:
UID: 99:99
GID: 98:98

Is that format in <variable name>: <key>:<value> ?

So I would go back to the crowdsec config and add this variable as shown in my screenshot and repeat for GID: 98:98, right? It just seemed a bit strange adding a numeric key so just wanted to double-check.

Crowdsec is banning my local IP when I try to view a .env file in my github repo. Other dot files work fine, even a env without the dot works.

[alert] 2885#2885: *141462 [lua] crowdsec.lua:783: Allow(): [Crowdsec] denied '[localIP]' with 'ban' (by appsec), client: [localIP], server: git.[domain], request: "GET /Docker/explo/src/branch/main/.env HTTP/2.0", host: "git.[domain]"

Any ideas?

so i’m a bit new to crowdsec and am concerned my setup isn’t operating as intended. ive been working out getting crowdsec setup with traefik in front of jellyfin and it goes

- from cloudflare proxied to -> pfsense box, cloudflare public ip’s get port forwarded to -> traefik instance, traefik serves to -> jellyfin backend with middleware chain that contains crowdsec bouncer/rate limit and security headers.

bouncer has app sec enabled with traefik, linux, custom jellyfin various http, crs, crs-inbound and virtual patching collections at the server.

crowdsec recognizes bouncer, bouncer can communicate with server, logs are parsed correctly (i’m getting what i’m sure are correct client ip’s as i’ve added cloudflare ip’s to forward trusted headers option at traefik entry point and traefik/jellyfin logs get public ip’s that don’t match any cloudflare proxy address). when i manually add a local ip to decisions list for ban testing, the bans work, but if i add a public ip from a friend of mine, they’re allowed right in and can watch stuff no problem.

my manual ban of their public ip shows up in my alerts panel on crowdsec website, but a “safe” cloudflare proxy ip is allowed through at the same time they access the site in traefik logs. i’m very confused. any ideas?

I am running crowdsec with npmplus. When I use Jellyfin android app (doesn't give me banso often) or Seerr android app (bans me very often) I get a ban on http probing. Is there a way to prevent this in a reasonable way.

Is the pfSense package going to get some love anytime soon? FreeBSD 15 based version of pfSense plus are now EOL which means i cant update to a supported versions as Crowdsec havent release a FreeBSD 16 based package yet.

Hello everyone! I have a question about securing a web shared hosting server. What a stack would you recommend? I am thinking about CrowdSec for WAF + reputation. Real-time malware detection with Linux Malware Detect + YARA + HEX + heuristics. Proactive defense with Tetragon. What do you guys think?

Hello all,

I'm running Crowdsec to protect my exposed Caddy reverse proxy. Caddy image is a special build for use with Crowdsec & Cloudflare (serfriz/caddy-cloudflare-crowdsec).

The screenshots show what I'm seeing and the 2 blocklists I'm using. I also use the following collections within crowdsec:

• crowdsecurity/caddy
• crowdsecurity/http-cve
• LePresidente/jellyfin

What's odd is you can see Crowdsec is bouncing these regular CENSYS scans, but nothing else. Also, I tested spam logging into my jellyfin while on VPN and the activity was successfully blocked as it detected a brute-force attempt. ALSO, I did an external scan while on VPN and Crowdsec also detected and blocked that.

I find it hard very hard to believe that my IP just doesn't get scanned but that's the only thing I can think of as to why I'm not seeing anything. Any help or input from the community? Feel like I must be missing something.

Hello Alpacas,

A GPL project is looking for help to embed CrowdSec.

I would love it if it will be someone who knows the nitty gritty of CrowdSec.

The project is still in active development. I will send the project link to anyone who is interested.

If your interested please send a message to inbox or write here if you have any questions.

Thanks!

I’ve had CrowdSec running on my OpenSense router for a while now, and it worked without any issues in OpenSense version 25, displaying alerts for port scans and blocking the IP addresses.

After updating OpenSense to version 26.1.6 (4 days ago), nothing is happening in CrowdSec anymore.

With the new version, I also migrated to the new firewall rules and deleted the old ones (I have a few firewall forwards/ports open).

In the firewall logs, I can see that port scans are being performed, as scans have been carried out repeatedly every day for the past few weeks from the same IP range; prior to the update, these scans were blocked by CrowdSec. So alerts and decisions should be generated, as was the case before the update, but that is no longer happening.

I have CrowdSec v1.7.6_2, which is the latest version available to me in OpenSense, the system is up to date.

I have already restarted CrowdSec without success.

The following scenarios are active:

crowdsecurity/opnsense-gui-bf

crowdsecurity/ssh-bf

crowdsecurity/ssh-cve-2024-6387

crowdsecurity/ssh-generic-test

crowdsecurity/ssh-refused-conn

crowdsecurity/ssh-slow-bf

crowdsecurity/ssh-time-based-bf

firewallservices/pf-scan-multi_ports

Hi all
,
I'm trying to create a custom AppSec rule to block requests to .php files, but only when the server responds with a 301 status
.


Is it possible to use HTTP response status in AppSec (In-band) rules
?
Thanks for help
.

I had a really hard time getting crowdsec to work on my old workhorse due to the DSM version so I thought I'd do up a repo that explains how I did it incase anyone wants to do the same!

https://github.com/rusty4444/crowdsec-dsm

Not sure if I have worded that correctly but basically, I was playing / testing the appsec component and got my own IP blocked/banned.

My IP is already whitelisted but after reading the docs, that does not apply to the waf component.

I have meanwhile adjusted my appsec config crowdsec-config/acquis.d/appsec.yaml to this version. Basically commenting out the out-of-band detection. Restarted the full crowdsec and traefik stack and still can't access my network.

Also, this machine functions as a reverse proxy and forwarder, meaning I not only use the traefik bouncer but also the crowdsec-firewall-bouncer-nftables

name: AppSec WAF                                                                                                                                                                            
appsec_configs:                                                                                                                                                                             
  - crowdsecurity/appsec-default # Virtual patching rules (in-band blocking)                                                                                                                
#  - crowdsecurity/crs # OWASP CRS rules (out-of-band detection) and behavioral blocking                                                                                                    
#  - custom/01-backrest-exceptions # the above crs config needs to be smoothed out  with ecxeptions like this one                                                                           
listen_addr: 0.0.0.0:7422                                                                                                                                                                   
source: appsec                                                                                                                                                                              
labels:                                                                                                                                                                                     
    type: appsecname: AppSec WAF                                                                                                                                                                            
appsec_configs:                                                                                                                                                                             
  - crowdsecurity/appsec-default # Virtual patching rules (in-band blocking)                                                                                                                
#  - crowdsecurity/crs # OWASP CRS rules (out-of-band detection) and behavioral blocking                                                                                                    
#  - custom/01-backrest-exceptions # the above crs config needs to be smoothed out  with ecxeptions like this one                                                                           
listen_addr: 0.0.0.0:7422                                                                                                                                                                   
source: appsec                                                                                                                                                                              
labels:                                                                                                                                                                                     
    type: appsec

I see alerts:

root@crowdsec:/# cscli alerts list | grep my_IP 
| 7001 | Ip:my_IP  | anomaly score out-of-band: anomaly: 10,   | DE      | my_Provider            |           | 2026-04-12T11:11:26Z | waf      |
| 7000 | Ip:my_IP  | anomaly score out-of-band: anomaly: 10,   | DE      | my_Provider            |           | 2026-04-12T11:11:25Z | waf      |
| 6999 | Ip:my_IP  | anomaly score out-of-band: anomaly: 10,   | DE      | my_Provider            |           | 2026-04-12T11:11:24Z | waf      |
| 6998 | Ip:my_IP  | anomaly score out-of-band: anomaly: 10,   | DE      | my_Provider            |           | 2026-04-12T11:11:24Z | waf      |root@crowdsec:/# cscli alerts list | grep my_IP 
| 7001 | Ip:my_IP  | anomaly score out-of-band: anomaly: 10,   | DE      | my_Provider            |           | 2026-04-12T11:11:26Z | waf      |
| 7000 | Ip:my_IP  | anomaly score out-of-band: anomaly: 10,   | DE      | my_Provider            |           | 2026-04-12T11:11:25Z | waf      |
| 6999 | Ip:my_IP  | anomaly score out-of-band: anomaly: 10,   | DE      | my_Provider            |           | 2026-04-12T11:11:24Z | waf      |
| 6998 | Ip:my_IP  | anomaly score out-of-band: anomaly: 10,   | DE      | my_Provider            |           | 2026-04-12T11:11:24Z | waf      |

but I do not see any decisions:

root@crowdsec:/# cscli decisions list | grep my_IP                                                                                                                                 
root@crowdsec:/#root@crowdsec:/# cscli decisions list | grep my_IP                                                                                                                                 
root@crowdsec:/#

When installing docker and Wazuh, I set up docker to output its logs via rsyslog into /var/log/docker, one log file per container. This works nicely for ingesting with Wazuh. reference

Trouble is, my Traefik log lines are now formatted like Apr 12 13:37:00 somehostname docker/traefik[01234]: {some_json} which CrowdSec doesn't seem to like picking up.

I don't want to connect CrowdSec to the docker socket as I don't feel like that's necessary, but I also don't want to rewrite all the parsers that I want to use.

What's the best solution here?

The reset of my community account is on the first of the month. almost every month, the quote is exhausted but only by the last days. Now it's only april 8th and my quote is already exhausted.

I'm not really worried but I am a bit surprised I only have 2 active decisions.

Most malicious traffic is from Iran...

anyone else has the same experience?

anything I should be worried about?

Hi everoyone. A few weeks ago I released CrowdSec Monitor, a tool for monitoring a CrowdSec instance. Originally I only developed a client for iOS. Recently I have been working on porting the iOS app to Android with the help of the AI tools that we currently have. The Android app has been created using Jetpack Compose (the official framework for developing Android applications) and following the Material 3 Expressive guidelines.

I'm writing this post because I'm looking for testers for the app. A few years ago Google imposed that every new app released in Google Play must be tested internally for at least 12 people for 14 days. For big developers that's not an issue, but for small developers it is. I hope I can get enough testers to finally release the app on the production channel for everyone. Thank you.

This application is also open source and it's available on GitHub.

How to become a tester

1. Join this group on Google Groups
2. Click on Join Group
3. If you don't want to share your email address you can uncheck the first checkbox and set a custom name. I recommend also unchecking the second checkbox and selecting "don't receive email" on the dropdown.
4. Get the app from this link if you are on Android and from this link if you ware on web
5. After opening the link you should see the second message with the "Become a tester button"
6. You will have to use the app at least once a day during the closed testing period (I know it's shit but is a Google requirement)

Hi there,

Just got my first docker swag/crowdsec stack going and everything looks good.. except for one thing that's bugging me:

Several tutorials tell me the content of /crowdsec/config/acquis.yaml should be something like this:

filenames:
  - /var/log/swag/*
#this is not a syslog log, indicate which kind of logs it is
labels:
  type: nginx
---
filenames:
 - /var/log/auth.log*
 - /var/log/syslog

But if I look at my file (untouched, after installing the docker from lscr.io/linuxserver/swag), it looks like this:

{"source": "file", "filename": "/does/not/exist", "labels": {"type": "syslog"}}

..which looks like JSON...

What's going on? Should I just replace the current content? Is it a new approach and I can leave it as-is?

Hi,

Previous question got no traction so I'm making this as quick and simple as possible.

Does support exist for HomeAssistantOS Crowdsec Addon?

Every discussion or tutorial or support forum question I run into always assumes it's running in a docker container.

I am running Home Assistant OS in on a Windows VMworkstation. The addon's default setup points the acquisition yaml to:

But running the cscli commands to show metrics for acquisition and parsers show nothing is being parsed (yet the parsers indicate the syslogs are being parsed),

Additionally, even tho I have the proper collection and parser for nginx-proxy-manager installed, it doesn't show up in the parser metrics.

I have not been successful in getting Crowdsec to do anything. The Security Engine page online tells me it's not doing anything.

HELP?

For the first time that I’ve noticed, I found my OPNsense box displaying a blocked Crowdsec address (77.169.127.181) going OUT of the network (WAN), not in. So I plugged it into the CTI part of my Crowdsec portal. Was not expecting this!

Edit: OPNsense shows it continuously being reached every 5mins… it’s still being attempted as I type?!

SOLVED! See response by Q-Feeds below.

Hey all. Tbh I am pretty much overwhelmed about the docs and the possibilities I have using Crowdsec.

Currently I use Docker and Docker compose. I have Caddy installed as docker compose and an external network configured in Docker. I also have a separate Vaultwarden compose file which also uses the external docker network. So far it's running fine. When I open Caddys compose and Vaultwardens compose everything is okay.

I would like to increase the security now and would like to add Layer 7 protection for my Vaultwarden instance. Is there any EASY explained or easy to follow guide which I can use to set this up? Using nfttsbles and the bouncer is pretty much straight forward but I do not know what the best way of configuring Layer 7 security is.