Crowdsec on docker and the bouncer on pfsense. | CrowdSec | Page 1

hollow crypt Nov 10, 2024, 7:32 PM

#

How can I use crowdsec within docker and the bouncer on pfsense to protect my whole network? I want to run the security engine in docker and the bouncer must run on pfsense so that my whole network can be protected. I am very new to crowdsec so any help is much appreciated.

lofty garnetBOT Nov 10, 2024, 7:32 PM

#

Important Information

This post has been marked as resolved. If this is a mistake please press the red button below or type /unresolve

plush dew Nov 11, 2024, 7:58 AM

#

hollow crypt How can I use crowdsec within docker and the bouncer on pfsense to protect my wh...

Where you defined crowdsec you can either put a reverse proxy infront on the host and expose port 8080 like that OR simply in your docker/compose you can expose the ports:

services:
  crowdsec:
     ports:
       - 8080:8080

this will expose 8080 to the external LAN, then simply you can configure the pfsense to use an external LAPI via the GUI.

hollow crypt Nov 11, 2024, 10:25 AM

#

Awesome thank you for the feedback. So then I just use the docker ip:8080 and the user name and password that is in that file?

#

There is a long string next to the password looks like it is encrypted, can I just use that as the password?

plush dew Nov 11, 2024, 1:21 PM

#

hollow crypt There is a long string next to the password looks like it is encrypted, can I ju...

From the pfsense gui, I believe you can send a registration request, if not you can docker compose exec crowdsec cscli machines add pfsense -f- --auto to generate new credentials

hollow crypt Nov 11, 2024, 1:59 PM

#

And must I use that creds in pfsemse when it ask for a username amd password

plush dew Nov 11, 2024, 2:12 PM

#

hollow crypt And must I use that creds in pfsemse when it ask for a username amd password

Yes exactly

hollow crypt Nov 11, 2024, 2:14 PM

#

Thank you for the info much appreciate. Now I understand a little bit more. And on pfsense I only need to tick the remediantion option I don;t need to use the log and all other option because that gets handle by the security engine

plush dew Nov 11, 2024, 2:15 PM

#

I don;t need to use the log and all other option because that gets handle by the security engine
Depends if you are sending your pfsense logs to the other engine, you can keep it ticked and any forwarded events will just simply be sent to the other engine like port scans etc etc if the pfsense is your main router.

hollow crypt Nov 11, 2024, 7:21 PM

#

Yes pfsense is my main router that I use. Thats why I want pfsense to be the bouncer so it can be block there before it enter the network

lofty garnetBOT Dec 13, 2024, 9:02 AM

#

lofty garnet

Resolving Crowdsec on docker and the bouncer on pfsense.

#Crowdsec on docker and the bouncer on pfsense.