# Crowdsec ok - Bouncer-nft not working

**URL:** <https://discourse.crowdsec.net/t/crowdsec-ok-bouncer-nft-not-working/699>\
**Category:** Uncategorized\
**Created:** [March 17, 2022, 8:54pm UTC](https://discourse.crowdsec.net/t/crowdsec-ok-bouncer-nft-not-working/699 "2022-03-17T20:54:28Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![stratege1401](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/stratege1401/32/332_2.png) [@stratege1401](https://discourse.crowdsec.net/u/stratege1401)\
**Post date:** [March 17, 2022, 8:54pm UTC](https://discourse.crowdsec.net/t/crowdsec-ok-bouncer-nft-not-working/699/1 "2022-03-17T20:54:28Z")

</div>

Hello,

The bouncer-nft doesnt work at all.  
I should have entry like those in my nft ruleset:

```auto
table ip crowdsec {
        set crowdsec-blacklists {
                type ipv4_addr
                flags timeout
                elements = { xxx.xxx.xxx.xxx timeout 6d16h56m45s16ms expires 6d16h14m37s824ms, 1.9.78.242 timeout 6d19h56m45s20ms expires 6d19h14m38s8ms,
# from another working server using samehardware and same distro !!!

```

and i should have those line in my journalctrl

```auto
 kernel: crowdsec drop: IN=enp5s0f1 OUT= MAC=00:1b:21:bc:e0:a1:34:27:92:60:e0:ca:08:00 SRC=XXX.XXX.XXX.XXX DST=192.168.1.137 LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=18178 DF PROTO=TCP SPT=42544 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0

```

Unfortunatly, nothing works…

- **My server specs**

```auto
My server run Linux-Debian11.2 5.10.0-12-amd64 #1 SMP 5.10.103-1 (2022-03-07) x86_64 GNU/Linux
Apache/2.4.52 
PHP 8.0.16 
using UFW over nftables

```

- **Crowdsec Information and specs**

```auto
2022/03/17 21:22:58 version: v1.3.2-debian-pragmatic-b66366c28c9b0c8843913afb05c553e658513d63
2022/03/17 21:22:58 Codename: alphaga
2022/03/17 21:22:58 BuildDate: 2022-03-04_12:05:09
2022/03/17 21:22:58 GoVersion: 1.17.5
2022/03/17 21:22:58 Platform: linux
2022/03/17 21:22:58 Constraint_parser: >= 1.0, <= 2.0
2022/03/17 21:22:58 Constraint_scenario: >= 1.0, < 3.0
2022/03/17 21:22:58 Constraint_api: v1
2022/03/17 21:22:58 Constraint_acquis: >= 1.0, < 2.0

`cscli bouncer list`
`FirewallBouncer-1647543472 127.0.0.1 ✔️ 2022-03-17T20:23:51Z crowdsec-firewall-bouncer v0.0.23-debian-pragmatic-5a27e28ac5b528ab02fc35ae81459f75f69a3866`

```

- **Bouncer Information**

Installation via `apt install crowdsec-firewall-bouncer-nftables`

```auto
mode: nftables
pid_dir: /var/run/
update_frequency: 10s
daemonize: true
log_mode: file
log_dir: /var/log/
log_level: info
log_compression: true
log_max_size: 100
log_max_backups: 3
log_max_age: 30
api_url: http://127.0.0.1:8080/
api_key: myapikey
insecure_skip_verify: false
disable_ipv6: false
deny_action: DROP
deny_log: false
supported_decisions_types:
  - ban
#to change log prefix
#deny_log_prefix: "crowdsec: "
#to change the blacklists name
blacklists_ipv4: crowdsec-blacklists
blacklists_ipv6: crowdsec6-blacklists
#if present, insert rule in those chains
iptables_chains:
  - INPUT
# - FORWARD
# - DOCKER-USER

## nftables
nftables:
  ipv4:
    enabled: true
    set-only: false
    table: crowdsec
    chain: crowdsec-chain
  ipv6:
    enabled: true
    set-only: false
    table: crowdsec6
    chain: crowdsec6-chain
# packet filter
pf:
  # an empty string disables the anchor
  anchor_name: ""

```

- **Crowdsec information** s

`cscli metrics`

```auto
INFO[17-03-2022 09:27:57 PM] Buckets Metrics:
+--------------------------------------+---------------+-----------+--------------+--------+---------+
| BUCKET | CURRENT COUNT | OVERFLOWS | INSTANCIATED | POURED | EXPIRED |
+--------------------------------------+---------------+-----------+--------------+--------+---------+
| crowdsecurity/http-crawl-non_statics | - | - | 1 | 1 | 1 |
| crowdsecurity/http-probing | - | - | 2 | 2 | 2 |
+--------------------------------------+---------------+-----------+--------------+--------+---------+
INFO[17-03-2022 09:27:57 PM] Acquisition Metrics:
+----------------------------------+------------+--------------+----------------+------------------------+
| SOURCE | LINES READ | LINES PARSED | LINES UNPARSED | LINES POURED TO BUCKET |
+----------------------------------+------------+--------------+----------------+------------------------+
| file:/var/log/apache2/access.log | 3224 | 3100 | 124 | 3 |
| file:/var/log/auth.log | 54 | - | 54 | - |
| file:/var/log/kern.log | 4 | - | 4 | - |
| file:/var/log/messages | 4 | - | 4 | - |
| file:/var/log/syslog | 48 | - | 48 | - |
+----------------------------------+------------+--------------+----------------+------------------------+
INFO[17-03-2022 09:27:57 PM] Parser Metrics:
+----------------------------------+------+--------+----------+
| PARSERS | HITS | PARSED | UNPARSED |
+----------------------------------+------+--------+----------+
| child-crowdsecurity/apache2-logs | 3348 | 3100 | 248 |
| child-crowdsecurity/http-logs | 9300 | 9292 | 8 |
| child-crowdsecurity/sshd-logs | 54 | - | 54 |
| child-crowdsecurity/syslog-logs | 110 | 110 | - |
| crowdsecurity/apache2-logs | 3224 | 3100 | 124 |
| crowdsecurity/dateparse-enrich | 3100 | 3100 | - |
| crowdsecurity/geoip-enrich | 3100 | 3100 | - |
| crowdsecurity/http-logs | 3100 | 3096 | 4 |
| crowdsecurity/non-syslog | 3224 | 3224 | - |
| crowdsecurity/sshd-logs | 6 | - | 6 |
| crowdsecurity/syslog-logs | 110 | 110 | - |
| crowdsecurity/whitelists | 3100 | 3100 | - |
+----------------------------------+------+--------+----------+
INFO[17-03-2022 09:27:57 PM] Local Api Metrics:
+----------------------+--------+------+
| ROUTE | METHOD | HITS |
+----------------------+--------+------+
| /v1/decisions/stream | GET | 153 |
| /v1/watchers/login | POST | 2 |
+----------------------+--------+------+
INFO[17-03-2022 09:27:57 PM] Local Api Bouncers Metrics:
+----------------------------+----------------------+--------+------+
| BOUNCER | ROUTE | METHOD | HITS |
+----------------------------+----------------------+--------+------+
| FirewallBouncer-1647543472 | /v1/decisions/stream | GET | 153 |
+----------------------------+----------------------+--------+------+

```

- **Logs**

1. 

crowdsec.log and crowdsec\_api.log are clean… no errors.

1. 

bouncer log is also clean.

time=“17-03-2022 20:52:03” level=info msg=“backend type : nftables”  
time=“17-03-2022 20:52:03” level=info msg=“nftables initiated”  
time=“17-03-2022 20:52:03” level=info msg=“Processing new and deleted decisions . . .”  
time=“17-03-2022 20:52:05” level=info msg=“11731 decisions added”

- nft ruleset

nice and working i am pretty sure.

```auto
table ip crowdsec {
        set crowdsec-blacklists {
                type ipv4_addr
                flags timeout
                elements = {

```

I have absolutely no clue why this install doesn’t work …

I had a working crowdsec/bouncers on that server before an apt-get update/upgrade

I used apt-get to desinstall/purge the previous corrupted crowdsec/bouncer.  
And used again apt-get install for this installation …

---

<div class="post-metadata">

**Author:** ![stratege1401](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/stratege1401/32/332_2.png) [@stratege1401](https://discourse.crowdsec.net/u/stratege1401)\
**Post date:** [March 23, 2022, 3:29pm UTC](https://discourse.crowdsec.net/t/crowdsec-ok-bouncer-nft-not-working/699/2 "2022-03-23T15:29:19Z")

</div>

Is it the good place to ask for help, not even one answer in almost a week …  
I log 40.6K attack since last march17, and not one is bounced

---

<div class="post-metadata">

**Author:** ![stratege1401](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/stratege1401/32/332_2.png) [@stratege1401](https://discourse.crowdsec.net/u/stratege1401)\
**Post date:** [March 23, 2022, 3:43pm UTC](https://discourse.crowdsec.net/t/crowdsec-ok-bouncer-nft-not-working/699/3 "2022-03-23T15:43:54Z")

</div>

well, i am done asking for help… goinf full purge/reinstall and see by myself

---

<div class="post-metadata">

**Author:** ![alteredCoder](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/alteredcoder/32/44_2.png) [@alteredCoder](https://discourse.crowdsec.net/u/alteredCoder)\
**Post date:** [March 24, 2022, 4:15pm UTC](https://discourse.crowdsec.net/t/crowdsec-ok-bouncer-nft-not-working/699/4 "2022-03-24T16:15:57Z")

</div>

Hello @stratege1401 ,

We are really sorry for the delay. It is the right place to ask, or you can even go to our discord server if you want interactive help.

We have tested the v0.0.23 and it worked well.  
Did you manage to install with from a fresh installation?  
Else do you have the output of the `apt install crowdsec-firewall-bouncer-nftables` command please ? So we can check if something is going wrong during the installation.

---

<div class="post-metadata">

**Author:** ![stratege1401](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/stratege1401/32/332_2.png) [@stratege1401](https://discourse.crowdsec.net/u/stratege1401)\
**Post date:** [March 25, 2022, 2:03am UTC](https://discourse.crowdsec.net/t/crowdsec-ok-bouncer-nft-not-working/699/5 "2022-03-25T02:03:45Z")

</div>

Thanks, i hate discord, so i wont use it… ( already tried, was not even able to see the human quizz, so i wont loose temper with it 🙂 )

I manage to fix the problem by purging crowdsec bouncers from the server… Did not notice it was deprecated…

Work almost fine …

---

<div class="post-metadata">

**Author:** ![thibault](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/thibault/32/2_2.png) [@thibault](https://discourse.crowdsec.net/u/thibault)\
**Post date:** [March 25, 2022, 8:46am UTC](https://discourse.crowdsec.net/t/crowdsec-ok-bouncer-nft-not-working/699/6 "2022-03-25T08:46:41Z")

</div>

Hey @stratege1401 🙂

> [@stratege1401](#):
>
> Work almost fine …

Do you have some feedback to share about the almost part ? (meaning the part that doesn’t work or that you dislike 😛 )

---

<div class="post-metadata">

**Author:** ![stratege1401](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/stratege1401/32/332_2.png) [@stratege1401](https://discourse.crowdsec.net/u/stratege1401)\
**Post date:** [March 25, 2022, 9:51am UTC](https://discourse.crowdsec.net/t/crowdsec-ok-bouncer-nft-not-working/699/7 "2022-03-25T09:51:06Z")

</div>

In fact, as the problem became really smaller than this original post, and some details changed due to some update and twitch, i did create a new thread:

> [@I am missing " log statement to the firewall"](https://discourse.crowdsec.net/t/i-am-missing-log-statement-to-the-firewall/716):
>
> Hello again ( unfortunately slight_smile ) as explain in the bouncers doc, deny\_log - set this to true to add a log statement to the firewall rule Unfortunately, it seem to be broken, because I don’t get any statement in journalctl except: crowdsec-firewall-bouncer[76998]: time="2022-03-25T02:46:45+01:00" level=info msg="crowdsec-firewall-bouncer v0.0.23-debian-pragmatic-5a27e28ac5b528ab02fc35ae81459f75f69a3866" Mar 25 02:46:45 n2 crowdsec-firewall-bouncer[76998]: time="2022-03-25T02:46:4…