# CS-Firewall-Bouncer nftables

**URL:** <https://discourse.crowdsec.net/t/cs-firewall-bouncer-nftables/682>\
**Category:** crowdsec\
**Created:** [March 11, 2022, 8:19pm UTC](https://discourse.crowdsec.net/t/cs-firewall-bouncer-nftables/682 "2022-03-11T20:19:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![schoutentl](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@schoutentl](https://discourse.crowdsec.net/u/schoutentl)\
**Post date:** [March 11, 2022, 8:19pm UTC](https://discourse.crowdsec.net/t/cs-firewall-bouncer-nftables/682/1 "2022-03-11T20:19:02Z")

</div>

Fresh install, changed port for api and .yaml files. As I got the (this is already used aka bind error message).

I have manually deleted the bouncers and manually added them and changed the api key in the bounce.yaml file. Below is what I see in the logs. Any help would be appreciated. I am just not seeing why it won’t link up.

Ubuntu 18.04 (EVE-NG).

bouncer logs:  
time=“11-03-2022 11:02:45” level=fatal msg=“API error: access forbidden”  
time=“11-03-2022 11:53:29” level=info msg=“config is valid”  
time=“11-03-2022 11:53:29” level=info msg=“backend type : nftables”  
time=“11-03-2022 11:53:29” level=info msg=“nftables initiated”  
time=“11-03-2022 11:53:29” level=info msg=“Processing new and deleted decisions . . .”  
time=“11-03-2022 11:53:29” level=fatal msg=“API error: access forbidden”  
time=“11-03-2022 13:25:36” level=info msg=“config is valid”  
time=“11-03-2022 13:25:36” level=info msg=“backend type : nftables”

bouncer yaml:  
mode: nftables  
pid\_dir: /var/run/  
update\_frequency: 10s  
daemonize: true  
log\_mode: file  
log\_dir: /var/log/  
log\_level: info  
api\_url: [http://localhost:8090/](http://localhost:8090/)  
api\_key: \<api\_key-redacted\>  
disable\_ipv6: false  
deny\_action: DROP  
deny\_log: false  
supported\_decisions\_types:

- ban  
#to change log prefix  
#deny\_log\_prefix: "crowdsec: "

---

<div class="post-metadata">

**Author:** ![schoutentl](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@schoutentl](https://discourse.crowdsec.net/u/schoutentl)\
**Post date:** [March 11, 2022, 8:19pm UTC](https://discourse.crowdsec.net/t/cs-firewall-bouncer-nftables/682/2 "2022-03-11T20:19:50Z")

</div>

Some data is missing the config.yaml matches, the api\_credential yaml matches. Am I missing something?

---

<div class="post-metadata">

**Author:** ![schoutentl](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@schoutentl](https://discourse.crowdsec.net/u/schoutentl)\
**Post date:** [March 11, 2022, 8:31pm UTC](https://discourse.crowdsec.net/t/cs-firewall-bouncer-nftables/682/3 "2022-03-11T20:31:20Z")

</div>

So basically I updated these three locations because of the bind error issue.  
I used netstat to confirm it wasn’t in use. And that error went away. But the above listed logs show the failure.

/etc/crowdsec/config.yaml  
api \> listen\_uri: 127.0.0.1:8090

/etc/crowdsec/local\_api\_credentials.yaml  
url: [[http://127.0.0.1:8090](http://127.0.0.1:8090) ]

/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml  
api\_url: [http://localhost:8090/](http://localhost:8090/)

---

<div class="post-metadata">

**Author:** ![schoutentl](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@schoutentl](https://discourse.crowdsec.net/u/schoutentl)\
**Post date:** [March 11, 2022, 9:06pm UTC](https://discourse.crowdsec.net/t/cs-firewall-bouncer-nftables/682/4 "2022-03-11T21:06:19Z")

</div>

Ok I did this before but tried again using this command.

```auto
cscli bouncers add myBouncer -l 24

```

That gave me an API\_KEY, as expected. I replaced the unescaped variable in `/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml` and now the `cs-firewall-bouncer` appears to be running.

Seeing this when I run metrics so assuming I am good.

INFO[11-03-2022 04:05:41 PM] Local Api Machines Metrics:  
±-------------------------------------------------±-----------±-------±-----+  
| MACHINE | ROUTE | METHOD | HITS |  
±-------------------------------------------------±-----------±-------±-----+  
| 4770fd769e1c41da93e06dceade24ffeThymmyH8JFyB2Q8h | /v1/alerts | GET | 1 |  
±-------------------------------------------------±-----------±-------±-----+  
INFO[11-03-2022 04:05:41 PM] Local Api Bouncers Metrics:  
±---------------------------±---------------------±-------±-----+  
| BOUNCER | ROUTE | METHOD | HITS |  
±---------------------------±---------------------±-------±-----+  
| FirewallBouncer-1647028615 | /v1/decisions/stream | GET | 17 |  
±---------------------------±---------------------±-------±-----+

---

<div class="post-metadata">

**Author:** ![klausagnoletti](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/klausagnoletti/32/201_2.png) [@klausagnoletti](https://discourse.crowdsec.net/u/klausagnoletti)\
**Post date:** [March 14, 2022, 11:03am UTC](https://discourse.crowdsec.net/t/cs-firewall-bouncer-nftables/682/5 "2022-03-14T11:03:10Z")

</div>

Thanks for the post. Am I right to assume that your problem is fixed and you don’t need anymore help?

---

<div class="post-metadata">

**Author:** ![schoutentl](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@schoutentl](https://discourse.crowdsec.net/u/schoutentl)\
**Post date:** [March 14, 2022, 11:53am UTC](https://discourse.crowdsec.net/t/cs-firewall-bouncer-nftables/682/6 "2022-03-14T11:53:55Z")

</div>

That is correct I posted what I did for the resolution. If it needs more clarity let me know.

---

<div class="post-metadata">

**Author:** ![klausagnoletti](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/klausagnoletti/32/201_2.png) [@klausagnoletti](https://discourse.crowdsec.net/u/klausagnoletti)\
**Post date:** [March 16, 2022, 4:02pm UTC](https://discourse.crowdsec.net/t/cs-firewall-bouncer-nftables/682/7 "2022-03-16T16:02:47Z")

</div>

No that’s fine. Thanks!