94
OpnSense + Crowdsec = comfort
(lemmy.nz)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 15 Sep 2026
94 points (95.2% liked)
Selfhosted
62162 readers
695 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
Tell us more about how crowdsec works (for you)!
(Didn't even know it had a web ui)
Sure. So OpnSense is the real gem here. Or really any solid firewall/edge device CrowdSec is an optional (free) add-on module in OpnSense. It's immediately operational at a minimal level without any registration. However, if you choose to register within the CrowdSec UI then you can load up more lists and tie it to your instance.
I also load up Hagezi's Threat Intelligence Blocklists into my OpnSense firewall rules, which get updated (by him) on a rolling 12 hour basis. I also have OpnSense query Github every 12 hours to pull the updates.
It is pretty good I use it on many machines. You install it on your machine with a reverse proxy, it then analyses the traffic logs for malicious activity or for known bad IPs and then creates iptable block rules. The web interface is the cloud interface that it connects to, because as the name implies, it works by using log data from all members to block bad actors efficiently
Why with a reverse proxy? I don't see this mentioned as the default installation method. https://doc.crowdsec.net/u/user_guides/building/
You can use crowdsec without a reverse proxy and just block offending IPs using a firewall. However, you can optionally configure a reverse proxy to enforce decisions made by crowdsec, e.g. by serving error pages or by serving captchas. See Remediation Components (formally "Bouncers")
Yes. I check the logs from my web pages with it.
Oh yeah I remember that! Never felt the need for it.