# Crowdsec OPNSense external sources

**URL:** <https://discourse.crowdsec.net/t/crowdsec-opnsense-external-sources/1530>\
**Category:** Uncategorized\
**Created:** [November 27, 2023, 5:49pm UTC](https://discourse.crowdsec.net/t/crowdsec-opnsense-external-sources/1530 "2023-11-27T17:49:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![KidMapIdu](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@KidMapIdu](https://discourse.crowdsec.net/u/KidMapIdu)\
**Post date:** [November 27, 2023, 5:49pm UTC](https://discourse.crowdsec.net/t/crowdsec-opnsense-external-sources/1530/1 "2023-11-27T17:49:26Z")

</div>

Dear all,

I’m running Crowdsec-Plugin on a OPNSense and everything looks fine.

Now I want to embed some more sources.

I have a internal machine with docker and vaultwarden installed. This machine is available through HA-Proxy on OPNSense. Now I want to include Vaultwardens Log-Files into Crowdsec (analyze on the machine on docker and block the atackers directly on OPNSense).

My problem is, I don’t know which modules I need on my docker machine (VMWare) and how to submit the result to OPNSense where Crowdsec incl. blocker for the firewall is already installed.

Are there any manuals out there or do you have some hints for me?

Thanks

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [November 27, 2023, 8:03pm UTC](https://discourse.crowdsec.net/t/crowdsec-opnsense-external-sources/1530/2 "2023-11-27T20:03:41Z")

</div>

So this is what we class as a “multi server setup”, so the aim is to install a security engine within the docker stack and forward alerts to the main opnsense.

> **[About multi-server setup | CrowdSec](https://docs.crowdsec.net/docs/user_guides/multiserver_setup/)**
>
> Crowdsec's architecture allows distributed setups, as most components communicate via HTTP API.

[https://www.crowdsec.net/blog/multi-server-setup](https://www.crowdsec.net/blog/multi-server-setup)

[![](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/ff8305eede2e1aea136535a50bf210e06b65d323.jpeg "Workshop: How to set up a CrowdSec multi server installation") ](https://www.youtube.com/watch?v=V4rr2gcPfW0)

But what you want to achieve is your opnsense to listen to external events so that means the LAPI will need to bind to “external port” OR be proxied by HA-proxy (Within the video I show you how to proxy it via nginx which is same premise).

Then within the docker environment you want to spin up a container that will make a requests to the central LAPI. That’s all you need to do as the remediation components installed on opnsense should already handle blocking.

---

<div class="post-metadata">

**Author:** ![KidMapIdu](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@KidMapIdu](https://discourse.crowdsec.net/u/KidMapIdu)\
**Post date:** [November 28, 2023, 7:51pm UTC](https://discourse.crowdsec.net/t/crowdsec-opnsense-external-sources/1530/3 "2023-11-28T19:51:49Z")

</div>

Dear iiAmLoz,

Thanks a lot.

Just to be sure I understand right:

1. Modify LAPI on OPNSense to “hear” on one of the internal IPs (instead of 127.0.0.1) - this can be done via web-GUI
2. Install Crowdsec on the Docker machine
3. Install Vaultwarden-Collection on Docker machine
4. Modify Crowdsec on Docker machine to report to OPNSense instead of LAPI on Docker machine

That’s all?

I will give it a try and hope I will success.

Just another question on crowdsec’s principle:

When Running Crowdsec on Machine 1 as a central Crowdsec instance - Machine 2,3,4 will report to Machine 1 and Machine 5,6,7 will have running bouncers/remediation components which also interact with machine 1 → all remediation components will block all attackers found on machines 2,3,4?

It’s not the fact, that for example Machine 2 with Remediation on machine 5 is paired and machine 4 with remediation on machine 6 is paired …? Or another example Machine 1 as central instance and machine 2 will have collections and remediation on one machine - same for machine 3 and 4 → here it’s also not right, that machine 2 will only block its own attackers, it will also block known attackers from machine 3 and 4 even if these doesn’t attack machine 2 - all in case every part reports to machine 1?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [November 30, 2023, 10:55am UTC](https://discourse.crowdsec.net/t/crowdsec-opnsense-external-sources/1530/4 "2023-11-30T10:55:31Z")

</div>

> [@KidMapIdu](#):
>
> When Running Crowdsec on Machine 1 as a central Crowdsec instance - Machine 2,3,4 will report to Machine 1 and Machine 5,6,7 will have running bouncers/remediation components which also interact with machine 1 → all remediation components will block all attackers found on machines 2,3,4?

Exactly, centralizing the alerts means all your instances can share decisions between themselves.

---

<div class="post-metadata">

**Author:** ![KidMapIdu](https://avatars.discourse-cdn.com/v4/letter/k/46a35a/32.png) [@KidMapIdu](https://discourse.crowdsec.net/u/KidMapIdu)\
**Post date:** [December 3, 2023, 9:47am UTC](https://discourse.crowdsec.net/t/crowdsec-opnsense-external-sources/1530/5 "2023-12-03T09:47:09Z")

</div>

Thanks a lot - it works like expected.

But it was hard to get it working on Ubuntu 22.04 and docker - a lot of manuals wrote different things and on top the docker-compose bundled with ubuntu (at this timepoint) was broken so that docker-compose exec … results in an error message.

A lot of trial and error solved the problems (the resulting milestones were:

1. update docker-compose
2. insert the credentials from local\_api\_credentials into docker-compose.yml otherwise it will overwrite the local\_api\_credentials on every restart of the container.)