CrowdSec vs Fail2Ban - What to use?

RFC 1149 compatibility is expected in an upcoming release, keep an eye out.

In the Traefik static configuration (usually traefik.yml), add this to load the CrowdSec plugin:

    
experimental:
  plugins:
    crowdsec-bouncer-traefik-plugin:
      moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
      version: "v1.4.2"

  

(The name for the plugin is defined here as crowdsec-bouncer-traefik-plugin.)

Then, in your dynamic configuration, add this (I've used a separate file dynamic_conf/050-plugin-crowdsec-bouncer.yml):

    
http:
  middlewares:
    crowdsec-bouncer:
      plugin:
        crowdsec-bouncer-traefik-plugin:
          CrowdsecLapiKey: "...YOUR CROWDSEC LAPI KEY HERE..."
          Enabled: true

  

(The name for this new middleware defined here is crowdsec-bouncer. It uses the crowdsec-bouncer-traefik-plugin defined in the previous step. Make sure these names match.)

You can get the LAPI key by registering a new bouncer in CrowdSec.

And, finally, make sure all incoming traffic routes through the bouncer plugin. You can do this individually, or in general via the static config:

    
entryPoints:

  websecure:
    address: :443
    http:
      middlewares:
        - crowdsec-bouncer@file
        - secure-headers@file

  

The middlewares are processed top to bottom.

Any change to the static configuration requires a restart of Traefik to become active.

In addition to the explanation you got from the other user: once you've set up the bouncer middleware in the configs (don't know if there even exists a good way to do that outside of the configs files), you simply assign the middleware in the compose file as usual.

Fail2ban is a Free/Open-Source program to parse logs and take action based on the content of these logs. The most common use case is to detect authentication failures in logs and issue a firewall level ban based on that. It uses regex filters to parse the logs and policies called jails to determine which action to take (wait for more failures, run command xyz...). It's old, basic, customizable, does its job.

crowdsec is a commercial service [1] with a free offering, and some Free/Open-Source components. The architecture is quite different [2], it connects to Crowdec's (the company) servers to crowd-source detections, their service establishes a "threat score" for each IP based on detections they receive, and in exchange they provide [3] some of these threat feeds/blocklists back to their users. A separate crowdsec-bouncer process takes action based on your configuration.

If you want to build your own private shared/global blocklist based on crowdsec detections, you'll need to setup a crowdsec API server and configure all your crowdsec instances to use it. If you want to do this with fail2ban you'll need to setup your own sync mechanism (there are multiple options, I use a cron job+script that pulls IPs from all fail2ban instances using fail2ban-client status, builds an ipset, and pushes it to all my servers). If you need crowdsourced blocklists, there are multiple free options ([4] can be used directly by ipset).

Both can be used for roughly the same purpose, but are very different in how they work and the commercial model (or lack of) behind the scenes.

It's set up on the same box as my caddy install. I believe it's getting passed the real IP because that's what gets banned, and what I type in to unban it.

It just sees normal operations as http probing. Like if some other service goes down, my GetHomepage will then 404 and that's seen as probing. It bans surprisingly quick. Even after just one or two events (normal for someone just visiting the homepage) it'll just kick em right out

I've been having to inspect every alert and hand write whitelist parsers to whitelist 404s or whatever it may be for that app. Slowly accumulating a workable collection.. but seems like I'm missing something as no one else seems to complain about this in threads like these

Another example is my brother got banned for normal audiobookshelf usage. He just thought the server was buggy. It was just blocking him without us really noticing or thinking much of it at the time. Not great

It doesn't.