A screenshot of an email from Crowdsec saying they blocked 137k bots last week
you are viewing a single comment's thread
view the rest of the comments
[–] 17 points 18 hours ago (6 children)

Tell us more about how crowdsec works (for you)!

(Didn't even know it had a web ui)

  • source
  • hideshow 6 child comments
  • [–] [S] 4 points 12 hours ago

    Sure. So OpnSense is the real gem here. Or really any solid firewall/edge device CrowdSec is an optional (free) add-on module in OpnSense. It's immediately operational at a minimal level without any registration. However, if you choose to register within the CrowdSec UI then you can load up more lists and tie it to your instance.

    I also load up Hagezi's Threat Intelligence Blocklists into my OpnSense firewall rules, which get updated (by him) on a rolling 12 hour basis. I also have OpnSense query Github every 12 hours to pull the updates.

  • source
  • parent
  • [–] 3 points 15 hours ago (4 children)

    It is pretty good I use it on many machines. You install it on your machine with a reverse proxy, it then analyses the traffic logs for malicious activity or for known bad IPs and then creates iptable block rules. The web interface is the cloud interface that it connects to, because as the name implies, it works by using log data from all members to block bad actors efficiently

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 15 hours ago (3 children)

    Why with a reverse proxy? I don't see this mentioned as the default installation method. https://doc.crowdsec.net/u/user_guides/building/

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 14 hours ago (2 children)

    You can use crowdsec without a reverse proxy and just block offending IPs using a firewall. However, you can optionally configure a reverse proxy to enforce decisions made by crowdsec, e.g. by serving error pages or by serving captchas. See Remediation Components (formally "Bouncers")

  • source
  • parent
  • hideshow 2 child comments