# Latest

**URL:** https://discourse.crowdsec.net/latest.md?page=1

[Latest](https://discourse.crowdsec.net/latest.md) · [Categories](https://discourse.crowdsec.net/categories.md)

**Page:** 2

---

## [AppSec on VPS which do TLS passthrough to local machine behind CGNAT](https://discourse.crowdsec.net/t/appsec-on-vps-which-do-tls-passthrough-to-local-machine-behind-cgnat/2779)

<div class="topic-metadata">

**Author:** [@thingandstuff889](https://discourse.crowdsec.net/u/thingandstuff889)\
**Replies:** 4\
**Last updated:** [March 5, 2026, 10:20am UTC](https://discourse.crowdsec.net/t/appsec-on-vps-which-do-tls-passthrough-to-local-machine-behind-cgnat/2779 "2026-03-05T10:20:08Z")

</div>

Hi, First off thanks for making this wonderful piece of software. I have a specific setup like this: Client ⇒ VPS (Caddy L4 TLS passthrough) ⇒ (Wireguard) ⇒ Local machine (another Caddy do TLS termination) Currently I…

---

## [Appsec not working?](https://discourse.crowdsec.net/t/appsec-not-working/2778)

<div class="topic-metadata">

**Author:** [@urbaman](https://discourse.crowdsec.net/u/urbaman)\
**Replies:** 2\
**Last updated:** [March 3, 2026, 11:46am UTC](https://discourse.crowdsec.net/t/appsec-not-working/2778 "2026-03-03T11:46:00Z")

</div>

Hi, I’m trying to see if Appsec is working or not (cannot see any alerts triggered by appsec). sudo cscli appsec-configs list ────────────────────────────────────────────────────────────────────────────────────────────…

---

## [I am constantly being banned from my server](https://discourse.crowdsec.net/t/i-am-constantly-being-banned-from-my-server/1318)

<div class="topic-metadata">

**Author:** [@notban](https://discourse.crowdsec.net/u/notban)\
**Replies:** 4\
**Last updated:** [February 28, 2026, 11:31am UTC](https://discourse.crowdsec.net/t/i-am-constantly-being-banned-from-my-server/1318 "2026-02-28T11:31:49Z")

</div>

CrowdSec runs in the stack (Docker). Although I added my IP to the exception, I get banned regularly - at least 1x a day. It always depends on how often I use other Docker services like Seafile and how often I access m…

---

## [\[SQLITE\_CANTOPEN\] Unable to open the database file (unable to open database file)](https://discourse.crowdsec.net/t/sqlite-cantopen-unable-to-open-the-database-file-unable-to-open-database-file/1393)

<div class="topic-metadata">

**Author:** [@Dmitry](https://discourse.crowdsec.net/u/Dmitry)\
**Replies:** 6\
**Last updated:** [February 28, 2026, 7:14am UTC](https://discourse.crowdsec.net/t/sqlite-cantopen-unable-to-open-the-database-file-unable-to-open-database-file/1393 "2026-02-28T07:14:17Z")

</div>

Hello. I installed the dashboard and the installation was successful. However, I get this message: “\[SQLITE\_CANTOPEN\] Unable to open the database file (unable to open database file)” when I try to view the data. Cro…

---

## [Crowdsec and multiple public IPs](https://discourse.crowdsec.net/t/crowdsec-and-multiple-public-ips/2774)

<div class="topic-metadata">

**Author:** [@Sumi](https://discourse.crowdsec.net/u/Sumi)\
**Replies:** 0\
**Last updated:** [February 25, 2026, 10:39am UTC](https://discourse.crowdsec.net/t/crowdsec-and-multiple-public-ips/2774 "2026-02-25T10:39:54Z")

</div>

Hi everyone, I wanted to ask about something. I have an OPNsense firewall running, and Crowdsec is working well on it. I can see activity under Alerts and Decisions. However, I also have Postfix and RSPAMD running on …

---

## [Custom scenario labels (Behavior/MITRE/CVE) not appearing in CrowdSec Console](https://discourse.crowdsec.net/t/custom-scenario-labels-behavior-mitre-cve-not-appearing-in-crowdsec-console/2772)

<div class="topic-metadata">

**Author:** [@Lukes](https://discourse.crowdsec.net/u/Lukes)\
**Replies:** 1\
**Last updated:** [February 23, 2026, 11:12am UTC](https://discourse.crowdsec.net/t/custom-scenario-labels-behavior-mitre-cve-not-appearing-in-crowdsec-console/2772 "2026-02-23T11:12:24Z")

</div>

Hello, Is it possible to pass Behavior, MITRE technique, and CVE metrics to the CrowdSec Console for custom scenarios? For my custom scenarios, I have defined the following labels: labels: remediation: true classi…

---

## [All working but nftables empty](https://discourse.crowdsec.net/t/all-working-but-nftables-empty/2771)

<div class="topic-metadata">

**Author:** [@TomTom](https://discourse.crowdsec.net/u/TomTom)\
**Replies:** 0\
**Last updated:** [February 20, 2026, 1:33pm UTC](https://discourse.crowdsec.net/t/all-working-but-nftables-empty/2771 "2026-02-20T13:33:19Z")

</div>

Hi, I just encountered the following problem: I received tons of emails about bans, always from the same IP addresses. After researching the server, I found that everything was running fine, but the NF tables were empty…

---

## [Activation email](https://discourse.crowdsec.net/t/activation-email/2768)

<div class="topic-metadata">

**Author:** [@Lukes](https://discourse.crowdsec.net/u/Lukes)\
**Replies:** 0\
**Last updated:** [February 14, 2026, 2:12pm UTC](https://discourse.crowdsec.net/t/activation-email/2768 "2026-02-14T14:12:51Z")

</div>

For some reason, I did not receive the email during registration in the CrowdSec Console, and there is no resend button available. When I try to register again or reset the password, I get the error: “An account linked t…

---

## [K8s LAPI restarts periodically, can't find config, restarts again](https://discourse.crowdsec.net/t/k8s-lapi-restarts-periodically-cant-find-config-restarts-again/2767)

<div class="topic-metadata">

**Author:** [@sven](https://discourse.crowdsec.net/u/sven)\
**Replies:** 0\
**Last updated:** [February 13, 2026, 1:41pm UTC](https://discourse.crowdsec.net/t/k8s-lapi-restarts-periodically-cant-find-config-restarts-again/2767 "2026-02-13T13:41:57Z")

</div>

Hi friends, Running a LAPI server installed with Helm in a K8s cluster. Just short under an hour of running, the pod is restarted. There are no K8s events nor crashloops related to the pod, it just runs and then restart…

---

## [New haproxy bouncer : ban issue?](https://discourse.crowdsec.net/t/new-haproxy-bouncer-ban-issue/2766)

<div class="topic-metadata">

**Author:** [@sebastian](https://discourse.crowdsec.net/u/sebastian)\
**Replies:** 0\
**Last updated:** [February 12, 2026, 1:26pm UTC](https://discourse.crowdsec.net/t/new-haproxy-bouncer-ban-issue/2766 "2026-02-12T13:26:26Z")

</div>

hello we are deploying the new haproxy bouncer, so far so good, ban works and offending ip get the html ban page. the ban trigger is a nikto scan, the ban works at he haprocy http/https level, but i can rerun the nikto…

---

## [CrowdSec custom parser not recognizing timestamp](https://discourse.crowdsec.net/t/crowdsec-custom-parser-not-recognizing-timestamp/2765)

<div class="topic-metadata">

**Author:** [@Lukes](https://discourse.crowdsec.net/u/Lukes)\
**Replies:** 0\
**Last updated:** [February 11, 2026, 12:29pm UTC](https://discourse.crowdsec.net/t/crowdsec-custom-parser-not-recognizing-timestamp/2765 "2026-02-11T12:29:55Z")

</div>

Hi all, I’m new to CrowdSec and I’m trying to create a custom parser for Stalwart logs. My logs look like this: 2026-02-11T08:16:01Z INFO Banned due to scan (security.scan-ban) listenerId = "smtp", localPort = 25, rem…

---

## [Need help. Is it a bug?](https://discourse.crowdsec.net/t/need-help-is-it-a-bug/2763)

<div class="topic-metadata">

**Author:** [@coloradobug](https://discourse.crowdsec.net/u/coloradobug)\
**Replies:** 0\
**Last updated:** [February 11, 2026, 8:34am UTC](https://discourse.crowdsec.net/t/need-help-is-it-a-bug/2763 "2026-02-11T08:34:15Z")

</div>

Good day. First of all, I apologize for the machine translation; English is not my native language. Recently, something strange has been happening with the program. Let me explain step by step. We have Crowdsec install…

---

## [Security Engine: no activity on OPNsense](https://discourse.crowdsec.net/t/security-engine-no-activity-on-opnsense/2761)

<div class="topic-metadata">

**Author:** [@dtgolder](https://discourse.crowdsec.net/u/dtgolder)\
**Replies:** 3\
**Last updated:** [February 10, 2026, 7:06pm UTC](https://discourse.crowdsec.net/t/security-engine-no-activity-on-opnsense/2761 "2026-02-10T19:06:24Z")

</div>

Hi– New user here…have installed Crowdsec on OPNsense as a plugin. It seems to be configured correctly, but I’m getting a persistent “Security Engine - no activity” error: Security Engine No Alerts The Engine No Alert…

---

## [Remediation Component keeps failing](https://discourse.crowdsec.net/t/remediation-component-keeps-failing/2762)

<div class="topic-metadata">

**Author:** [@SloppyCarlton](https://discourse.crowdsec.net/u/SloppyCarlton)\
**Replies:** 2\
**Last updated:** [February 10, 2026, 11:22am UTC](https://discourse.crowdsec.net/t/remediation-component-keeps-failing/2762 "2026-02-10T11:22:13Z")

</div>

I’m a newcomer to Crowdsec, and I’ve run into a major issue with getting my deployment of Crowdsec to work on my system. I’ve got Crowdsec running in a Docker container and my chosen remediation component running on bar…

---

## [SECUBOX - New OpenWRT based system for security](https://discourse.crowdsec.net/t/secubox-new-openwrt-based-system-for-security/2760)

<div class="topic-metadata">

**Author:** [@Gandalf](https://discourse.crowdsec.net/u/Gandalf)\
**Replies:** 1\
**Last updated:** [February 8, 2026, 8:59am UTC](https://discourse.crowdsec.net/t/secubox-new-openwrt-based-system-for-security/2760 "2026-02-08T08:59:10Z")

</div>

Next up? VoIP Integration (secubox-voip) — Asterisk micro-PBX for E2E encrypted calls over WireGuard mesh Matrix Integration (secubox-matrix) — Conduit Matrix server (~15MB RAM) for E2EE messaging Factory Auto…

---

## [No new decisions in a few days (solved)](https://discourse.crowdsec.net/t/no-new-decisions-in-a-few-days-solved/2030)

<div class="topic-metadata">

**Author:** [@Finance6104](https://discourse.crowdsec.net/u/Finance6104)\
**Replies:** 1\
**Last updated:** [February 5, 2026, 11:30am UTC](https://discourse.crowdsec.net/t/no-new-decisions-in-a-few-days-solved/2030 "2026-02-05T11:30:41Z")

</div>

Hi I started to use Crowdsec a week ago to secure my hosted services. During the first week I got about 20 decisions from my configuration. All those decisions came from my NPMPlus (Nginx Proxy manager fork) collection …

---

## [Error in appSec config](https://discourse.crowdsec.net/t/error-in-appsec-config/2758)

<div class="topic-metadata">

**Author:** [@urbaman](https://discourse.crowdsec.net/u/urbaman)\
**Replies:** 1\
**Last updated:** [February 5, 2026, 10:04am UTC](https://discourse.crowdsec.net/t/error-in-appsec-config/2758 "2026-02-05T10:04:09Z")

</div>

Hi, I’m trying to configure my appsec instance via helm chart, but cannot get it do work: Values: appsec: enabled: true acquisitions: - source: appsec listen\_addr: "0.0.0.0:7422" path: / …

---

## [Crowdsec banning my ip from random websites?](https://discourse.crowdsec.net/t/crowdsec-banning-my-ip-from-random-websites/2755)

<div class="topic-metadata">

**Author:** [@asdasdasda](https://discourse.crowdsec.net/u/asdasdasda)\
**Replies:** 1\
**Last updated:** [February 5, 2026, 10:02am UTC](https://discourse.crowdsec.net/t/crowdsec-banning-my-ip-from-random-websites/2755 "2026-02-05T10:02:28Z")

</div>

Hello, I am just daily internet user and I keep getting banned from random websites by crowdsec i am trying to access, i have no idea why. as i said i am just a normal dude. could you guys help me thanks.

---

## [CrowdSec Blocklist Subscription plan for homelab users?](https://discourse.crowdsec.net/t/crowdsec-blocklist-subscription-plan-for-homelab-users/1675)

<div class="topic-metadata">

**Author:** [@dagger](https://discourse.crowdsec.net/u/dagger)\
**Replies:** 3\
**Last updated:** [February 3, 2026, 10:01pm UTC](https://discourse.crowdsec.net/t/crowdsec-blocklist-subscription-plan-for-homelab-users/1675 "2026-02-03T22:01:31Z")

</div>

As a homelab user without a corporate wallet, the enterprise plan is a bit pricey for me. I still would not mind having access to the real-time updates and curated blocklist, which are also provided by the CrowdSec Bloc…

---

## [I'm directly get blocked by your services](https://discourse.crowdsec.net/t/im-directly-get-blocked-by-your-services/2751)

<div class="topic-metadata">

**Author:** [@fine77](https://discourse.crowdsec.net/u/fine77)\
**Replies:** 0\
**Last updated:** [January 27, 2026, 1:48pm UTC](https://discourse.crowdsec.net/t/im-directly-get-blocked-by-your-services/2751 "2026-01-27T13:48:23Z")

</div>

what is the issue here? i’m trying to implement your services but ending up with 403 Forbidden every time at my opnsense firewalls. i can not see that i’ve done something wrong and i’m not attacking your services. in t…

---

## [New OpenWRT based system for security](https://discourse.crowdsec.net/t/new-openwrt-based-system-for-security/2749)

<div class="topic-metadata">

**Author:** [@Gandalf](https://discourse.crowdsec.net/u/Gandalf)\
**Replies:** 1\
**Last updated:** [January 21, 2026, 9:07am UTC](https://discourse.crowdsec.net/t/new-openwrt-based-system-for-security/2749 "2026-01-21T09:07:29Z")

</div>

Hello all, I am working on a new OpenWRT based system inluding latest CrowdSec… All works fine by now and the development continue to elaborate an enduser security home and small companies solutions… You can check and…

---

## [How to disable contributing/signal sharing?](https://discourse.crowdsec.net/t/how-to-disable-contributing-signal-sharing/2744)

<div class="topic-metadata">

**Author:** [@earthen2](https://discourse.crowdsec.net/u/earthen2)\
**Replies:** 2\
**Last updated:** [January 12, 2026, 12:51pm UTC](https://discourse.crowdsec.net/t/how-to-disable-contributing-signal-sharing/2744 "2026-01-12T12:51:00Z")

</div>

Hello, CrowdSec only gives users a lite version of the Community blocklist if they don’t contribute regularly. I have no public services which means I will never get the full blocklist anyway so I might as well disable …

---

## [Don't get the correct IP in Bouncer](https://discourse.crowdsec.net/t/dont-get-the-correct-ip-in-bouncer/2449)

<div class="topic-metadata">

**Author:** [@Thorsten2605](https://discourse.crowdsec.net/u/Thorsten2605)\
**Replies:** 1\
**Last updated:** [January 11, 2026, 12:53pm UTC](https://discourse.crowdsec.net/t/dont-get-the-correct-ip-in-bouncer/2449 "2026-01-11T12:53:19Z")

</div>

Hi, I’m running traefik and crowdsec behind a Metallb in a kubernetes cluster. But I don’t get the real IPs of the clients which access a site behind traefik. In the log of the lapi I only see the internal k8s IP Adres…

---

## [N8n collection?](https://discourse.crowdsec.net/t/n8n-collection/2740)

<div class="topic-metadata">

**Author:** [@icanthelp](https://discourse.crowdsec.net/u/icanthelp)\
**Replies:** 3\
**Last updated:** [January 8, 2026, 10:50am UTC](https://discourse.crowdsec.net/t/n8n-collection/2740 "2026-01-08T10:50:08Z")

</div>

Searching for n8n on the hub yields no results. How come nobody has come up with a collection for such a popular web app?

---

## [Question about docker labels](https://discourse.crowdsec.net/t/question-about-docker-labels/2741)

<div class="topic-metadata">

**Author:** [@icanthelp](https://discourse.crowdsec.net/u/icanthelp)\
**Replies:** 2\
**Last updated:** [January 7, 2026, 7:12pm UTC](https://discourse.crowdsec.net/t/question-about-docker-labels/2741 "2026-01-07T19:12:44Z")

</div>

I have an Emby server that I want to protect. Luckily, I have found this crowdsec collection for it. I have added the two crowdsec labels and the traefik middlewares label you see here: labels: traefik.http.…

---

## [Genuine Seafile requests trigger a ban](https://discourse.crowdsec.net/t/genuine-seafile-requests-trigger-a-ban/2743)

<div class="topic-metadata">

**Author:** [@nicolazilio](https://discourse.crowdsec.net/u/nicolazilio)\
**Replies:** 1\
**Last updated:** [January 7, 2026, 4:24pm UTC](https://discourse.crowdsec.net/t/genuine-seafile-requests-trigger-a-ban/2743 "2026-01-07T16:24:51Z")

</div>

Hello thero, I’ve recently added CrowdSec in front of my Seafile instance and I have found that genuine requests trigger a ban is there a way that I can prevent that from happening? Thank you! P.S.: BTW, CrowdSec …

---

## [I can setup in windows server 2008r2 system,the error is service 'crowdsec' failed to strat. verify that you have suffcient privilege](https://discourse.crowdsec.net/t/i-can-setup-in-windows-server-2008r2-system-the-error-is-service-crowdsec-failed-to-strat-verify-that-you-have-suffcient-privilege/2742)

<div class="topic-metadata">

**Author:** [@echo50059](https://discourse.crowdsec.net/u/echo50059)\
**Replies:** 1\
**Last updated:** [January 7, 2026, 4:07pm UTC](https://discourse.crowdsec.net/t/i-can-setup-in-windows-server-2008r2-system-the-error-is-service-crowdsec-failed-to-strat-verify-that-you-have-suffcient-privilege/2742 "2026-01-07T16:07:38Z")

</div>

I need help~ my acquis.yamal is vent\_ids: 4625 4623 event\_level: information labels: type: eventlog ##Firewall filenames: C:\\Windows\\System32\\LogFiles\\Firewall\*.log labels: type: windows-firewall ##SQL Se…

---

## [Pls help with my noob config](https://discourse.crowdsec.net/t/pls-help-with-my-noob-config/2738)

<div class="topic-metadata">

**Author:** [@icanthelp](https://discourse.crowdsec.net/u/icanthelp)\
**Replies:** 1\
**Last updated:** [January 6, 2026, 4:58pm UTC](https://discourse.crowdsec.net/t/pls-help-with-my-noob-config/2738 "2026-01-06T16:58:33Z")

</div>

I’ve been experimenting with crowdsec but some things are still unclear to me. My homelab consists mainly of docker containers: traefik reverse proxy with maxlerebourg’s crowdsec-bouncer-traefik-plugin crowdsec traefi…

---

## [Need help to get custom whitelist to work](https://discourse.crowdsec.net/t/need-help-to-get-custom-whitelist-to-work/2736)

<div class="topic-metadata">

**Author:** [@Udeson](https://discourse.crowdsec.net/u/Udeson)\
**Replies:** 0\
**Last updated:** [December 27, 2025, 2:58pm UTC](https://discourse.crowdsec.net/t/need-help-to-get-custom-whitelist-to-work/2736 "2025-12-27T14:58:07Z")

</div>

Hey guys, I need your support to push me in the right direction getting my custom whitelist to work. Setup: Ubuntu Server with Pangolin and Crowdsec (Crowdsec-Bouncer-Traefik-Plugin) installation as Docker-Images Cro…

---

## [I don't get it with whitelisting](https://discourse.crowdsec.net/t/i-dont-get-it-with-whitelisting/2734)

<div class="topic-metadata">

**Author:** [@chrnoe](https://discourse.crowdsec.net/u/chrnoe)\
**Replies:** 0\
**Last updated:** [December 23, 2025, 12:32am UTC](https://discourse.crowdsec.net/t/i-dont-get-it-with-whitelisting/2734 "2025-12-23T00:32:45Z")

</div>

I have a whitelist \`/etc/crowdsec/postoverflows/s70-meine-dav-whitelist.yaml\`: name: me/meine-dav-whitelist description: “Whitelist DAV sync clients for brute-force” filter: “evt.Meta.service == ‘http’ && evt.Meta.log\_t…

[Previous page](https://discourse.crowdsec.net/latest.md)

[Next page](https://discourse.crowdsec.net/latest.md?page=2)