Crowdsec blocked IP of work laptop: firewallservices/pf-scan-multi_ports | CrowdSec | Page 1

mighty star Oct 31, 2024, 7:14 PM

#

After troubleshooting strange connectivity issues that my laptop was having, I've finally discovered that crowdsec had blocked my ethernet and wifi card of my work laptop.

It is using Zscaler Private Access. The reason listed is firewallservices/pf-scan-multi_ports and I see 16 different ports listed.

How can I whitelist my device so that Zscaler is able to connect? I am running crowdsec on OPNsense. Upon stopping crowsec, my laptop is able to connect again.

chilly kilnBOT Oct 31, 2024, 7:14 PM

#

Important Information

This post has been marked as resolved. If this is a mistake please press the red button below or type /unresolve

mighty star Oct 31, 2024, 7:15 PM

#

mighty star Oct 31, 2024, 8:10 PM

#

For opnsense, where are the whitelist files located?
I cannot access /etc/crowdsec/parsers/s02-enrich/ in opnsense shell.

https://docs.crowdsec.net/u/getting_started/post_installation/whitelists/

Whitelists | CrowdSec

Whitelists are a way to tell CrowdSec to ignore certain events or IP addresses. This can be useful if you have a static IP address that you know is safe, or if you have a service that could generates a lot of false triggers by loading alot of thumbnails, images or fonts.

hollow smelt Oct 31, 2024, 9:47 PM

#

mighty star For opnsense, where are the whitelist files located? I cannot access /etc/crowds...

OPNsense is freebsd so it /usr/local/etc/crowdsec

chilly kilnBOT Nov 7, 2024, 7:46 PM

#

chilly kiln

Resolving Crowdsec blocked IP of work laptop: firewallservices/pf-scan-multi_ports

#Crowdsec blocked IP of work laptop: firewallservices/pf-scan-multi_ports