Crowdsec not working under opnsense

1

my crowdsec extension in my zimaboard would not work under opnsense.
here´s the log file:
time=“30-10-2023 06:36:18” level=info msg=“Starting crowdsec-firewall-bouncer v0.0.28-freebsd-af6e7e2”
time=“30-10-2023 06:36:18” level=info msg=“backend type : pf”
time=“30-10-2023 06:36:18” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec_blacklists -T flush”
time=“30-10-2023 06:36:18” level=info msg=“Checking pf table: crowdsec_blacklists”
time=“30-10-2023 06:36:18” level=info msg=“pf initiated for ipv4”
time=“30-10-2023 06:36:18” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec6_blacklists -T flush”
time=“30-10-2023 06:36:18” level=info msg=“Checking pf table: crowdsec6_blacklists”
time=“30-10-2023 06:36:18” level=info msg=“pf initiated for ipv6”
time=“30-10-2023 06:36:18” level=info msg=“Using API key auth”
time=“30-10-2023 06:36:18” level=info msg=“Processing new and deleted decisions . . .”
time=“30-10-2023 06:36:18” level=info msg=“Serving metrics at 127.0.0.1:60601/metrics”
time=“30-10-2023 06:36:48” level=error msg=“auth-api: auth with api key failed return nil response, error: dial tcp 127.0.0.1:8080: i/o timeout”
time=“30-10-2023 06:36:48” level=error msg=“Get "http://127.0.0.1:8080/v1/decisions/stream?startup=true\”: dial tcp 127.0.0.1:8080: i/o timeout"
time=“30-10-2023 06:36:48” level=info msg=“Shutting down backend”
time=“30-10-2023 06:36:48” level=info msg=“flushing ‘crowdsec’ table(s)”
time=“30-10-2023 06:36:48” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec_blacklists -T flush”
time=“30-10-2023 06:36:48” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec6_blacklists -T flush”
time=“30-10-2023 06:36:48” level=fatal msg=“process terminated with error: bouncer stream halted”

what is the problem?

2

Hello,

From your logs, it seems the bouncer doesn’t manage to reach the local API:

time=“30-10-2023 06:36:48” level=error msg=“auth-api: auth with api key failed return nil response, error: dial tcp 127.0.0.1:8080: i/o timeout”

The logs you shared are the logs of the bouncer, can you share the logs from your crowdsec service itself ?

3

Thank you.
This is the log of /var/log/crowdsec/crowdsec-firewall-bouncer.log:

time=“30-10-2023 06:36:18” level=info msg=“Starting crowdsec-firewall-bouncer v0.0.28-freebsd-af6e7e2”
time=“30-10-2023 06:36:18” level=info msg=“backend type : pf”
time=“30-10-2023 06:36:18” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec_blacklists -T flush”
time=“30-10-2023 06:36:18” level=info msg=“Checking pf table: crowdsec_blacklists”
time=“30-10-2023 06:36:18” level=info msg=“pf initiated for ipv4”
time=“30-10-2023 06:36:18” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec6_blacklists -T flush”
time=“30-10-2023 06:36:18” level=info msg=“Checking pf table: crowdsec6_blacklists”
time=“30-10-2023 06:36:18” level=info msg=“pf initiated for ipv6”
time=“30-10-2023 06:36:18” level=info msg=“Using API key auth”
time=“30-10-2023 06:36:18” level=info msg=“Processing new and deleted decisions . . .”
time=“30-10-2023 06:36:18” level=info msg=“Serving metrics at 127.0.0.1:60601/metrics”
time=“30-10-2023 06:36:48” level=error msg=“auth-api: auth with api key failed return nil response, error: dial tcp 127.0.0.1:8080: i/o timeout”
time=“30-10-2023 06:36:48” level=error msg=“Get "http://127.0.0.1:8080/v1/decisions/stream?startup=true\”: dial tcp 127.0.0.1:8080: i/o timeout"
time=“30-10-2023 06:36:48” level=info msg=“Shutting down backend”
time=“30-10-2023 06:36:48” level=info msg=“flushing ‘crowdsec’ table(s)”
time=“30-10-2023 06:36:48” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec_blacklists -T flush”
time=“30-10-2023 06:36:48” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec6_blacklists -T flush”
time=“30-10-2023 06:36:48” level=fatal msg=“process terminated with error: bouncer stream halted”

4
5

sorry, but where is it located? The are no other logfiles in /var/log/crowdsec/.