[Solved] 22.03.0: workaround for running CrowdSec bouncer

I have found crowdsec 1.4.3 for armv7 and is working good on my Linksys WRT1900ACS

image

I just replaced my binary files crowdsec and crowdsec-cli with the ones in here: crowdsec-1.4.3-r1.apk.

I could not work out the same for cs-firewall-bouncer-0.0.24-r3.apk so I stay on "crowdsec-firewall-bouncer_0.0.21-3_arm_cortex-a9_vfpv3-d16".

:slightly_smiling_face:

1 Like

I am lazy I know, but there is any plugin workaround for crowdsec?

I'm currently working on a new package for the Crowdsec-firewall-bouncer with uci configuration file and will afterwards try to set up a luci package for configuration as well.
No date yet.

2 Likes

There is a trick to installing cloudflare bouncer to OpenWRT? I can't found in the repo.

I'm making progess so this is a call for testers. :slight_smile:

What I have achieved so far: I have a crowdesc-firewall-bouncer package that is working with OpenWrt 22.03. It uses a uci config file which at the moment looks like this:

config bouncer
        option api_url 'http://cs-lapi:8080/'
        option api_key '*******************'
        option update_frequency '10s'
        option deny_action 'drop'
        option log_prefix 'crowdsec: '
        option ipv4 '1'
        option filter_input '1'
        option filter_forward '1'
        option input_chain_name 'crowdsec-chain'
        option forward_chain_name 'forward'
        option input6_chain_name 'crowdsec6-chain'
        option forward6_chain_name 'forward'
        list interface 'eth1'
        list interface 'wg1'
        option enabled '1'
        option deny_log '0'
        option ipv6 '1'

I also have a first Luci package available:

I'm currently working on a AVM Fritzbox 4040 so the target is ipq40xx/generic.

1 Like

It looks nice :clap: :clap:

I have finished work so far and an updated package works on my router. At the moment I tweak the old package which makes developing and testing much easier.
I will start to update the Makefile and then create a pull request. Let's see how this works ...

2 Likes

Thanks for your great work :clap:
Looking forwad for testing it on my wrt1900acsv2.

Sorry for my ignorance, but this will work with my rpi4?

I have opened the pull requests. Unfortunately it fails build checks with docker setup. I need to see where I can get help for this.
But when build and when/if accepted to OpenWrt it will be available for all tagets including Raspberry Pi.

1 Like

My pull request for the bouncer has been merged. The PR for the LuCi app is still open.

The bouncer package shall appear shortly. It will install the bouncer without enabling it and thus no firewall rules will be applied.

The default config file is /etc/config/crowdsec:

config bouncer
	option enabled '0'
	option ipv4 '1'
	option ipv6 '1'
	option api_url 'http://localhost:8080/'
	option api_key ''
	option update_frequency '10s'
	option deny_action 'drop'
	option deny_log '0'
	option log_prefix 'crowdsec: '
	option log_level 'info'
	option filter_input '1'
	option filter_forward '1'
	list interface 'eth1'

You need to update the api_url and api_key and depending on your setup the interface list option as well. Afterwards you can restart the Crowdsec bouncer in System -> Startup.
As soon as the LuCi app is available, the configuration and start/restart (be enabling/disabling) can be done from the UI.

3 Likes

Great job :+1: :clap:
Thank you for sharing your work.

I hope it is working ... (my first contribution with building from go sources).

I hope I get the LuCI app also approved and merged (and get both packages cherry picked to 22.03. branch as well).
Also to mention, the documentation needs to be updated for the bouncer. Maybe @gandalf can help here.

After updating the bcp38 filter and the CrowdSec bouncer I will now work on a new filter based on dnsmasq resolving (like the FritzBox has it and I like it). I need to do my annual tax declaration first so this might take some time. :wink:

1 Like

Great :+1:
This afternoon I'll start the testing to see if I can get it up and running (I am an expert in copy/paste and little else :sweat_smile:).
Thanks again and we'll be on the lookout for that filter :clap:

So, did it work?

I was thinking on give it another try when luci is available.
In this try all seem like the other bouncer in firewall menu but, because I am not using pendrive whith exroot I could not install crowdsec on the router.
I installed it on windows10 and in other router that I use as AP, but I couldn't connect bouncer with crowdsec LAPI.
I'm sure it works perfect and it is just that I don't know the way to do it right.
:+1:

This setup sounds a bit weird. If you give more datails on your setup I may help with getting it up and running.

Well, when I had memory enough on the router, I had it with crowdsec_1.3.0-3_arm_cortex-a9_vfpv3-d16.ipk and crowdsec-firewall-bouncer_0.0.21-3_arm_cortex-a9_vfpv3-d16.ipk and as I put in this post crowdsec was working/blocking ok (bouncer and crowdsec app connected ok).
Now without exroot router has only 19MB.

I also use a Nighthawk X4S as dumbAP and what I tryed it was installing crowdsec here and your bouncer on wrt1900acsv2.
Crowdsec worked good but did not recognice bouncer.

I canΒ΄t conect bouncer with crowdsec and I get same thing similar to this, with no ip when I type "cscli bouncer list" on cli.

Thanks :+1:

If you just deinstalled the old package and installed the new one, a configuration yaml shall be left behind in /etc/crowdsec. Please take a look for the values of api_url and api_key and insert those into the values in the new uci config /etc/config/crowdsec file.

config bouncer
	option enabled '0'
	option api_url 'http://localhost:8080/'
	option api_key ''

Also, ensure that the enabled flag is set to 1. :wink:

The api key is the one that is printed when you add a bouncer to the local api using cscli. This is not done automatically and needs to be done manually (on the local api instance).

To find more info on the setup of crowdsec bouncer on OpenWrt, try:

ps | grep crowdsec

It schould list at least two findings: the grep itself :wink: plus the running crodsec bouncer.

Another place to look ist the Crowdsec log file at /var/log/crowdsec-firewall-bouncer.log

btw, what's that


picture from?