Thanks...
I will try to enhance with users feedbacks...
Already all the processes you have to do manually was because of some, now fixed, bugs in the firewall package.
Please, keep in mind that all the jobs is done, at free time, when, so, I have some.
It is also the case of the most of the OpenWrt developers, and, I also have to wait for them, when I share my works on CrowdSec.
firewall fix PR for master merged !
firewall initd fix for 21.02 (PR opened):
will resolve issue:
PRs for lua-cs-bouncer and crowdsec-nginx-bouncer:
...stay tuned !
Hi, that means no more fiddling with the setup of Crowdsec and I have to just install Crowdsec and bouncer and the rest works automatically??? Or is it not the case as of now?
As I understand cs-nginx-bouncer is also included in the package or should I install it manually???
Oh, my mistake. I saw just now the package. There once again a72 package is missing for Rpi4. Can you please compile for a72 architecture also? Or tell me which version I should use for my Rpi4 Openwrt.
One more question, post Crowdsec installation, which collections or parsers in addition to Crowdsec should I install??
If you need and wand to use only the banip feature of the firewall, just do:
heart component:
opkg install crowdsec
This package will register to the official API and you'll get feed with the community, free, CrowdSec managed IPs list.
ipbans firewalling:
opkg install crowdsec-firewall-bouncer
The community IPs BANs list will be used and managed by OpenWrt System firewall software...
if you need to protect an nginx instance on OpenWrt itself:
opkg install crowdsec-nginx-bouncer
You will then get this specific nginx component for protecting OpenWrt NGINX software.
The component will be available on the official upstream pacakges, when it will be compiled by the buildbots, after developers get review of my PR and they validated it, to be merged in the code...
Each steps require time, to each actor !
If you want more by yourself, give a try to a build of the package.
None / depends of your needs !
If you want more, you may look at the code itself, and then compare at the bouncers list, and also share your results in the wiki, or here...
upstream topic: https://discourse.crowdsec.net/t/crowdsec-openwrt-21-02-1-iptables-ipset-package-problems/533/5
issue: https://github.com/openwrt/packages/issues/17804
PR: https://github.com/openwrt/packages/pull/17805
Hi, i just want to thank you for your wonderful work on this addon. It's working perfectly. Even then i should change the name backend to iptables... Is it must or it works by leaving it default?
Thanks!
I still had to share some tutorials, the software is really cool and can afford a great enhancement in network security...
Stay tune!
I you have install iptables and ipset without installing also nftables, then all will be automatically detected and the backend will be sets to iptables at services startup.
If you have only nftables, same, but with nftables.
If you have installed both nftables and iptables, then nftables will be selected in priority.
The backend cannot be sets manually on OpenWrt, but I can made a general config if needed, disabling the auto-detect of backend, and using a manual forced backend.
A tweak is also possible with removing the backend tag in the /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml , removing the tag ${BACKEND} which is searched and used in the auto-detect script...
I have start to wrote some notes in the Wiki...
About the upcoming feature of notifications alerts and quick howto with collections from the hub, to protect dockers instance of NextCloud and NginxProxyManager...
https://openwrt.org/docs/guide-user/services/crowdsec#external_tools a new script will be available for external tools contributing to simplify users experience with CrowdSec!
Hi erduokki:- i am getting a strange error when i try to list decisions list. This is the error i am getting
root@rpi4-e45f01048a /45# cscli decisions list
FATA[07-02-2022 12:14:48 PM] Unable to list decisions : performing request: Get "http://127.0.0.1:8080/v1/alerts?has_active_decision=true&include_capi=false&limit=100": could not get jwt token: Post "http://127.0.0.1:8080/v1/watchers/login": dial tcp 127.0.0.1:8080: connect: connection refused
what does it really mean ? how do i solve this error ?
You have the default port which is already used !
You have to modify port from 8080 to something else... (I personally use 9999)...
Then you must reconfigure the config.yaml and local_api.yaml
This all was partially automated in the latest PR...
A external script now will be usable to reconfigure from /etc/config/crowdsec.
oh ok, can you guide me on how to change the port ?
Next release will add this parameters in cat /etc/config/crowdsec file.
config crowdsec 'crowdsec'
option data_dir '/srv/crowdsec/data'
option db_path '/srv/crowdsec/data/crowdsec.db'
option lapi_host '127.0.0.1'
option lapi_port '9999'
option configdir '/etc/crowdsec'
Add them manually and then...
use the script from the PR...
https://raw.githubusercontent.com/openwrt/packages/492699eb8a02e6b15980f1d6bab0d050939018fc/net/crowdsec/files/crowdsec.script
You can try to download it on the OpenWrt target with:
Create the necessary directory for the script;
mkdir -p /usr/lib/crowdsec/scripts
downlaod it and save it in the folder;
wget https://raw.githubusercontent.com/openwrt/packages/492699eb8a02e6b15980f1d6bab0d050939018fc/net/crowdsec/files/crowdsec.script -O /usr/lib/crowdsec/scripts/cs_script.sh
Then you can use it directly (look at the end of the wiki page, already documented partially...) with;
. /usr/lib/crowdsec/scripts/cs_script.sh
a full synchronisation of your modifications from /etc/config/crowdsec can be done; with;
cs_prepare # to check the necessary directories…
cs_init # to prepare the config file with modified settings…
cs_register # to check the LAPI and CAPI registering status and register the local host…
cs_hub # to update hub, install collections from hub, and upgrade from hub…
Then check, as usual, with cscli command line tool and also log files in /var/log/crowdsec*.log
This all will be better handled with more command in next release of the script ! 
Hi, thanks for your detailed explanation. This is my Output for the cs_hub.
root@rpi4-e45f01048a /42# cs_hub
INFO[07-02-2022 02:39:02 PM] Wrote new 277818 bytes index to /etc/crowdsec/hub/.index.json
WARN[07-02-2022 02:39:02 PM] crowdsecurity/syslog-logs : overwrite
WARN[07-02-2022 02:39:02 PM] crowdsecurity/geoip-enrich : overwrite
WARN[07-02-2022 02:39:02 PM] crowdsecurity/dateparse-enrich : overwrite
WARN[07-02-2022 02:39:02 PM] crowdsecurity/sshd-logs : overwrite
WARN[07-02-2022 02:39:02 PM] crowdsecurity/ssh-bf : overwrite
WARN[07-02-2022 02:39:02 PM] crowdsecurity/ssh-slow-bf : overwrite
WARN[07-02-2022 02:39:02 PM] crowdsecurity/sshd : overwrite
WARN[07-02-2022 02:39:02 PM] crowdsecurity/sshd : overwrite
WARN[07-02-2022 02:39:02 PM] crowdsecurity/linux : overwrite
INFO[07-02-2022 02:39:02 PM] /etc/crowdsec/collections/sshd.yaml already exists.
INFO[07-02-2022 02:39:02 PM] /etc/crowdsec/collections/linux.yaml already exists.
INFO[07-02-2022 02:39:02 PM] Enabled crowdsecurity/linux
INFO[07-02-2022 02:39:02 PM] Run 'sudo systemctl reload crowdsec' for the new configuration to be effective.
INFO[07-02-2022 02:39:02 PM] crowdsecurity/iptables-logs : OK
INFO[07-02-2022 02:39:02 PM] Enabled parsers : crowdsecurity/iptables-logs
INFO[07-02-2022 02:39:02 PM] crowdsecurity/iptables-scan-multi_ports : OK
INFO[07-02-2022 02:39:02 PM] Enabled scenarios : crowdsecurity/iptables-scan-multi_ports
INFO[07-02-2022 02:39:02 PM] crowdsecurity/iptables : OK
INFO[07-02-2022 02:39:02 PM] Enabled collections : crowdsecurity/iptables
INFO[07-02-2022 02:39:02 PM] Enabled crowdsecurity/iptables
INFO[07-02-2022 02:39:02 PM] Run 'sudo systemctl reload crowdsec' for the new configuration to be effective.
WARN[07-02-2022 02:39:03 PM] crowdsecurity/whitelists : overwrite
INFO[07-02-2022 02:39:03 PM] Enabled crowdsecurity/whitelists
INFO[07-02-2022 02:39:03 PM] Run 'sudo systemctl reload crowdsec' for the new configuration to be effective.
INFO[07-02-2022 02:39:03 PM] Upgrading collections
INFO[07-02-2022 02:39:03 PM] crowdsecurity/base-http-scenarios : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/sshd : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/linux : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/iptables : up-to-date
INFO[07-02-2022 02:39:03 PM] All collections are already up-to-date
INFO[07-02-2022 02:39:03 PM] Upgrading parsers
INFO[07-02-2022 02:39:03 PM] crowdsecurity/dateparse-enrich : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/sshd-logs : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/syslog-logs : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/geoip-enrich : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/whitelists : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/http-logs : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/iptables-logs : up-to-date
INFO[07-02-2022 02:39:03 PM] All parsers are already up-to-date
INFO[07-02-2022 02:39:03 PM] Upgrading scenarios
INFO[07-02-2022 02:39:03 PM] crowdsecurity/iptables-scan-multi_ports : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/ssh-slow-bf : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/http-generic-bf : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/http-probing : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/ssh-bf : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/http-sensitive-files : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/http-xss-probing : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/http-backdoors-attempts : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/http-open-proxy : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/http-sqli-probing : up-to-date
INFO[07-02-2022 02:39:03 PM] ltsich/http-w00tw00t : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/http-bad-user-agent : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/http-path-traversal-probing : up-to-date
INFO[07-02-2022 02:39:03 PM] crowdsecurity/http-crawl-non_statics : up-to-date
INFO[07-02-2022 02:39:03 PM] All scenarios are already up-to-date
INFO[07-02-2022 02:39:03 PM] Upgrading postoverflows
INFO[07-02-2022 02:39:03 PM] No postoverflows installed, nothing to upgrade
root@rpi4-e45f01048a /43#
Is it looking healthy ? i mean have i setup the Crowdsec properly? if i have to use nftables, should i uninstall iptables ?
Have you done the others commands ?
Is the log ok also ?
Remember to restart the service with
service crowdsec restart
after such modifications, and when asked by the feedbacks.
If you want to use nftables, just install it !
It will be detected and used in priority by the crowdsec-firewall-bouncer.
Just look at the output when restarting the firewall bouncer service;
service crowdsec-firewall-bouncer restart
I will add a more explicit output, with something like : using the ... backend! in a later PR... may be... 
yes i did restart the firewall bouncer and also crowdsec. It says no post overflows installed. Is it normal ? And i have iptables and nftables both installed and it took nftables as default.
But how do i check whether nftables is working ???
Already answered on the wiki!
I am not using nftables, so I do not remember (but wrote it on the wiki already)
overflows are another protection...
use cscli decisions list to see what is used from the central IP share by crowdsec servers !
this is the error i am getting
root@rpi4-e45f01048a /43# cscli decisions list
FATA[07-02-2022 03:21:07 PM] Unable to list decisions : performing request: Get "http://127.0.0.1:9999/v1/alerts?has_active_decision=true&include_capi=false&limit=100": could not get jwt token: Post "http://127.0.0.1:9999/v1/watchers/login": dial tcp 127.0.0.1:9999: connect: connection refused
after restarting the Crowdsec service, i have no active decision !!!
Hi, i used your latest script and i have error output when i type cscli metrics
root@rpi4-e45f01048a /44# cscli metrics
FATA[07-02-2022 05:14:08 PM] failed to fetch prometheus metrics : executing GET request for URL "http://127.0.0.1:6060/metrics" failed: Get "http://127.0.0.1:6060/metrics": dial tcp 127.0.0.1:6060: connect: connection refused
what is wrong with my setup ?