Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OpenWrt 22.03.0: crowdsec-firewall-bouncer problem #201

Closed
ne20002 opened this issue Sep 9, 2022 · 1 comment
Closed

OpenWrt 22.03.0: crowdsec-firewall-bouncer problem #201

ne20002 opened this issue Sep 9, 2022 · 1 comment

Comments

@ne20002
Copy link

ne20002 commented Sep 9, 2022

a) The crowdsec-firewall-bouncer package is missing.

b) After installing the package from 21.02.3 branch, the bouncer is available, but seems to be broken / not working with the OpenWrt implementation.

As OpenWrt 23.03.0 is now based on nftables I tried to set up the CrowdSec bouncer accordingly.

Regardless of using configuration setting set-only true or false, the CrowdSec bouncer always creates new table and chain.
The chain is always hooked into input chain. I need it to be in forward chain (running on a router, not a server).
Even when I define the table and chain manually as described on documentation, the CrowdSec bouncer always overwrites this and defines the table and chain hooking into input chain.
This is my crowdsec-firewall-bouncer.yaml:

root@OpenWrt:/tmp/etc/crowdsec/bouncers# cat crowdsec-firewall-bouncer.yaml 
mode: nftables
pid_dir: /var/run/
update_frequency: 10s
daemonize: true
log_mode: file
log_dir: /var/log/
log_level: info
api_url: http://cs-lapi:8014/
api_key: xxxxxxxxxxxxxxxxxxxxx
disable_ipv6: false
deny_action: DROP
deny_log: true
supported_decisions_types:
  - ban
#to change log prefix
#deny_log_prefix: "crowdsec: "
#to change the blacklists name
#blacklists_ipv4: crowdsec-blacklists
#blacklists_ipv6: crowdsec6-blacklists
#if present, insert rule in those chains
#iptables_chains:
#  - INPUT
#  - FORWARD
#  - DOCKER-USER
## nftables
nftables:
  ipv4:
    enabled: true
    set-only: true
    table: crowdsec
    chain: crowdsec-chain
  ipv6:
    enabled: true
    set-only: true
    table: crowdsec6
    chain: crowdsec6-chain
@ne20002
Copy link
Author

ne20002 commented Feb 6, 2023

The bouncer is now avaliable in new version in OpenWrt snapshot (crowdsec-firewall-bouncer 0.0.25-1).

@ne20002 ne20002 closed this as completed Feb 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant