# Crowdsec not working under opnsense

**URL:** <https://discourse.crowdsec.net/t/crowdsec-not-working-under-opnsense/1507>\
**Category:** Uncategorized\
**Created:** [November 12, 2023, 11:45am UTC](https://discourse.crowdsec.net/t/crowdsec-not-working-under-opnsense/1507 "2023-11-12T11:45:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![boesemani](https://avatars.discourse-cdn.com/v4/letter/b/f0a364/32.png) [@boesemani](https://discourse.crowdsec.net/u/boesemani)\
**Post date:** [November 12, 2023, 11:45am UTC](https://discourse.crowdsec.net/t/crowdsec-not-working-under-opnsense/1507/1 "2023-11-12T11:45:25Z")

</div>

my crowdsec extension in my zimaboard would not work under opnsense.  
here´s the log file:  
time=“30-10-2023 06:36:18” level=info msg=“Starting crowdsec-firewall-bouncer v0.0.28-freebsd-af6e7e2”  
time=“30-10-2023 06:36:18” level=info msg=“backend type : pf”  
time=“30-10-2023 06:36:18” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec\_blacklists -T flush”  
time=“30-10-2023 06:36:18” level=info msg=“Checking pf table: crowdsec\_blacklists”  
time=“30-10-2023 06:36:18” level=info msg=“pf initiated for ipv4”  
time=“30-10-2023 06:36:18” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec6\_blacklists -T flush”  
time=“30-10-2023 06:36:18” level=info msg=“Checking pf table: crowdsec6\_blacklists”  
time=“30-10-2023 06:36:18” level=info msg=“pf initiated for ipv6”  
time=“30-10-2023 06:36:18” level=info msg=“Using API key auth”  
time=“30-10-2023 06:36:18” level=info msg=“Processing new and deleted decisions . . .”  
time=“30-10-2023 06:36:18” level=info msg=“Serving metrics at 127.0.0.1:60601/metrics”  
time=“30-10-2023 06:36:48” level=error msg=“auth-api: auth with api key failed return nil response, error: dial tcp 127.0.0.1:8080: i/o timeout”  
time=“30-10-2023 06:36:48” level=error msg=“Get "[http://127.0.0.1:8080/v1/decisions/stream?startup=true\](http://127.0.0.1:8080/v1/decisions/stream?startup=true%5C)”: dial tcp 127.0.0.1:8080: i/o timeout"  
time=“30-10-2023 06:36:48” level=info msg=“Shutting down backend”  
time=“30-10-2023 06:36:48” level=info msg=“flushing ‘crowdsec’ table(s)”  
time=“30-10-2023 06:36:48” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec\_blacklists -T flush”  
time=“30-10-2023 06:36:48” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec6\_blacklists -T flush”  
time=“30-10-2023 06:36:48” level=fatal msg=“process terminated with error: bouncer stream halted”

what is the problem?

---

<div class="post-metadata">

**Author:** ![thibault](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/thibault/32/2_2.png) [@thibault](https://discourse.crowdsec.net/u/thibault)\
**Post date:** [November 14, 2023, 9:55am UTC](https://discourse.crowdsec.net/t/crowdsec-not-working-under-opnsense/1507/2 "2023-11-14T09:55:19Z")

</div>

Hello,

From your logs, it seems the bouncer doesn’t manage to reach the local API:

> time=“30-10-2023 06:36:48” level=error msg=“auth-api: auth with api key failed return nil response, error: dial tcp 127.0.0.1:8080: i/o timeout”

The logs you shared are the logs of the bouncer, can you share the logs from your crowdsec service itself ?

---

<div class="post-metadata">

**Author:** ![boesemani](https://avatars.discourse-cdn.com/v4/letter/b/f0a364/32.png) [@boesemani](https://discourse.crowdsec.net/u/boesemani)\
**Post date:** [November 14, 2023, 3:32pm UTC](https://discourse.crowdsec.net/t/crowdsec-not-working-under-opnsense/1507/3 "2023-11-14T15:32:39Z")

</div>

Thank you.  
This is the log of /var/log/crowdsec/crowdsec-firewall-bouncer.log:

time=“30-10-2023 06:36:18” level=info msg=“Starting crowdsec-firewall-bouncer v0.0.28-freebsd-af6e7e2”  
time=“30-10-2023 06:36:18” level=info msg=“backend type : pf”  
time=“30-10-2023 06:36:18” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec\_blacklists -T flush”  
time=“30-10-2023 06:36:18” level=info msg=“Checking pf table: crowdsec\_blacklists”  
time=“30-10-2023 06:36:18” level=info msg=“pf initiated for ipv4”  
time=“30-10-2023 06:36:18” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec6\_blacklists -T flush”  
time=“30-10-2023 06:36:18” level=info msg=“Checking pf table: crowdsec6\_blacklists”  
time=“30-10-2023 06:36:18” level=info msg=“pf initiated for ipv6”  
time=“30-10-2023 06:36:18” level=info msg=“Using API key auth”  
time=“30-10-2023 06:36:18” level=info msg=“Processing new and deleted decisions . . .”  
time=“30-10-2023 06:36:18” level=info msg=“Serving metrics at 127.0.0.1:60601/metrics”  
time=“30-10-2023 06:36:48” level=error msg=“auth-api: auth with api key failed return nil response, error: dial tcp 127.0.0.1:8080: i/o timeout”  
time=“30-10-2023 06:36:48” level=error msg=“Get "[http://127.0.0.1:8080/v1/decisions/stream?startup=true\](http://127.0.0.1:8080/v1/decisions/stream?startup=true%5C)”: dial tcp 127.0.0.1:8080: i/o timeout"  
time=“30-10-2023 06:36:48” level=info msg=“Shutting down backend”  
time=“30-10-2023 06:36:48” level=info msg=“flushing ‘crowdsec’ table(s)”  
time=“30-10-2023 06:36:48” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec\_blacklists -T flush”  
time=“30-10-2023 06:36:48” level=info msg=“pf table clean-up: /sbin/pfctl -t crowdsec6\_blacklists -T flush”  
time=“30-10-2023 06:36:48” level=fatal msg=“process terminated with error: bouncer stream halted”

---

<div class="post-metadata">

**Author:** ![thibault](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/thibault/32/2_2.png) [@thibault](https://discourse.crowdsec.net/u/thibault)\
**Post date:** [November 16, 2023, 10:22am UTC](https://discourse.crowdsec.net/t/crowdsec-not-working-under-opnsense/1507/4 "2023-11-16T10:22:09Z")

</div>

> [@thibault](#):
>
> can you share the logs from your crowdsec service itself ?

> **[Troubleshooting Guide | CrowdSec](https://doc.crowdsec.net/docs/next/troubleshooting/#crowdsec-log-location)**
>
> You may see CrowdSec referred to as "Security Engine" and Bouncers referred to as "Remediation Components" within new documentation. This is to better reflect the role of each component within the CrowdSec ecosystem.

---

<div class="post-metadata">

**Author:** ![boesemani](https://avatars.discourse-cdn.com/v4/letter/b/f0a364/32.png) [@boesemani](https://discourse.crowdsec.net/u/boesemani)\
**Post date:** [November 16, 2023, 12:56pm UTC](https://discourse.crowdsec.net/t/crowdsec-not-working-under-opnsense/1507/5 "2023-11-16T12:56:43Z")

</div>

sorry, but where is it located? The are no other logfiles in /var/log/crowdsec/.