Sure. So OpnSense is the real gem here. Or really any solid firewall/edge device CrowdSec is an optional (free) add-on module in OpnSense. It’s immediately operational at a minimal level without any registration. However, if you choose to register within the CrowdSec UI then you can load up more lists and tie it to your instance.
I also load up Hagezi’s Threat Intelligence Blocklists into my OpnSense firewall rules, which get updated (by him) on a rolling 12 hour basis. I also have OpnSense query Github every 12 hours to pull the updates.
It is pretty good
I use it on many machines.
You install it on your machine with a reverse proxy, it then analyses the traffic logs for malicious activity or for known bad IPs and then creates iptable block rules.
The web interface is the cloud interface that it connects to, because as the name implies, it works by using log data from all members to block bad actors efficiently
You can use crowdsec without a reverse proxy and just block offending IPs using a firewall. However, you can optionally configure a reverse proxy to enforce decisions made by crowdsec, e.g. by serving error pages or by serving captchas. See Remediation Components (formally “Bouncers”)
Tell us more about how crowdsec works (for you)!
(Didn’t even know it had a web ui)
Sure. So OpnSense is the real gem here. Or really any solid firewall/edge device CrowdSec is an optional (free) add-on module in OpnSense. It’s immediately operational at a minimal level without any registration. However, if you choose to register within the CrowdSec UI then you can load up more lists and tie it to your instance.
I also load up Hagezi’s Threat Intelligence Blocklists into my OpnSense firewall rules, which get updated (by him) on a rolling 12 hour basis. I also have OpnSense query Github every 12 hours to pull the updates.
It is pretty good I use it on many machines. You install it on your machine with a reverse proxy, it then analyses the traffic logs for malicious activity or for known bad IPs and then creates iptable block rules. The web interface is the cloud interface that it connects to, because as the name implies, it works by using log data from all members to block bad actors efficiently
Why with a reverse proxy? I don’t see this mentioned as the default installation method. https://doc.crowdsec.net/u/user_guides/building/
You can use crowdsec without a reverse proxy and just block offending IPs using a firewall. However, you can optionally configure a reverse proxy to enforce decisions made by crowdsec, e.g. by serving error pages or by serving captchas. See Remediation Components (formally “Bouncers”)
Yes. I check the logs from my web pages with it.
Oh yeah I remember that! Never felt the need for it.