It is pretty good I use it on many machines. You install it on your machine with a reverse proxy, it then analyses the traffic logs for malicious activity or for known bad IPs and then creates iptable block rules. The web interface is the cloud interface that it connects to, because as the name implies, it works by using log data from all members to block bad actors efficiently
Comment on OpnSense + Crowdsec = comfort
A_norny_mousse@piefed.zip 6 days ago
Tell us more about how crowdsec works (for you)!
(Didn’t even know it had a web ui)
LeTak@feddit.org 6 days ago
- A_norny_mousse@piefed.zip 6 days ago
Why with a reverse proxy? I don’t see this mentioned as the default installation method. https://doc.crowdsec.net/u/user_guides/building/
AzuraTheSpellkissed@lemmy.blahaj.zone 6 days ago
You can use crowdsec without a reverse proxy and just block offending IPs using a firewall. However, you can optionally configure a reverse proxy to enforce decisions made by crowdsec, e.g. by serving error pages or by serving captchas. See Remediation Components (formally “Bouncers”)
LeTak@feddit.org 6 days ago
Yes. I check the logs from my web pages with it.
- A_norny_mousse@piefed.zip 6 days ago
Oh yeah I remember that! neveer felt the need for it.
chagall@lemmy.world 6 days ago
Sure. So OpnSense is the real gem here. Or really any solid firewall/edge device CrowdSec is an optional (free) add-on module in OpnSense. It’s immediately operational at a minimal level without any registration. However, if you choose to register within the CrowdSec UI then you can load up more lists and tie it to your instance.
I also load up Hagezi’s Threat Intelligence Blocklists into my OpnSense firewall rules, which get updated (by him) on a rolling 12 hour basis. I also have OpnSense query Github every 12 hours to pull the updates.