Firewall bouncer does not work

crowdsec
1

Now it worked wonderfully for a few days and now the bouncer doesn’t work anymore

2023-11-27T09:42:09.773285+01:00 srv1 systemd[1]: Starting crowdsec-firewall-bouncer.service - The firewall bouncer for CrowdSec...
2023-11-27T09:42:14.137541+01:00 srv1 crowdsec-firewall-bouncer[10047]: time="27-11-2023 09:42:14" level=fatal msg="process terminated with error: bouncer stream halted"
2023-11-27T09:42:14.138730+01:00 srv1 systemd[1]: crowdsec-firewall-bouncer.service: Main process exited, code=exited, status=1/FAILURE
2023-11-27T09:42:14.194730+01:00 srv1 systemd[1]: crowdsec-firewall-bouncer.service: Failed with result 'exit-code'.
2023-11-27T09:42:14.195173+01:00 srv1 systemd[1]: Failed to start crowdsec-firewall-bouncer.service - The firewall bouncer for CrowdSec.
2023-11-27T09:42:20.095663+01:00 srv1 systemd[1]: run-docker-runtime\x2drunc-moby-ab962a7635c4307d960cc085afffa3bfb6603b309496db211c1e9bf9f0072f2d-runc.knLups.mount: Deactivated successfully.
2023-11-27T09:42:21.851716+01:00 srv1 systemd[1]: run-docker-runtime\x2drunc-moby-9a9c743c9629059120f2c91df80f97de5fd8de88a146ee9d55f46f7778d8cd65-runc.cTeFIq.mount: Deactivated successfully.
2023-11-27T09:42:24.260782+01:00 srv1 systemd[1]: crowdsec-firewall-bouncer.service: Scheduled restart job, restart counter is at 21.
2023-11-27T09:42:24.260956+01:00 srv1 systemd[1]: Stopped crowdsec-firewall-bouncer.service - The firewall bouncer for CrowdSec.
2023-11-27T09:42:24.261014+01:00 srv1 systemd[1]: Starting crowdsec-firewall-bouncer.service - The firewall bouncer for CrowdSec...
2023-11-27T09:42:28.673505+01:00 srv1 crowdsec-firewall-bouncer[10345]: time="27-11-2023 09:42:28" level=fatal msg="process terminated with error: bouncer stream halted"
2023-11-27T09:42:28.674573+01:00 srv1 systemd[1]: crowdsec-firewall-bouncer.service: Main process exited, code=exited, status=1/FAILURE
2023-11-27T09:42:28.715052+01:00 srv1 systemd[1]: crowdsec-firewall-bouncer.service: Failed with result 'exit-code'.
2023-11-27T09:42:28.715263+01:00 srv1 systemd[1]: Failed to start crowdsec-firewall-bouncer.service - The firewall bouncer for CrowdSec.

systemctl status crowdsec-firewall-bouncer.service
○ crowdsec-firewall-bouncer.service - The firewall bouncer for CrowdSec
     Loaded: loaded (/etc/systemd/system/crowdsec-firewall-bouncer.service; enabled; preset: enabled)
     Active: inactive (dead) (Result: exit-code) since Mon 2023-11-27 09:53:23 CET; 1min 9s ago
    Process: 16600 ExecStartPre=/usr/bin/crowdsec-firewall-bouncer -c /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml -t (code=exited, status=0/SUCCESS)
    Process: 16628 ExecStart=/usr/bin/crowdsec-firewall-bouncer -c /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml (code=exited, status=1/FAILURE)
    Process: 16662 ExecStartPost=/bin/sleep 0.1 (code=exited, status=0/SUCCESS)
   Main PID: 16628 (code=exited, status=1/FAILURE)
        CPU: 80ms

Nov 27 09:53:23 naboo systemd[1]: crowdsec-firewall-bouncer.service: Scheduled restart job, restart counter is at 45.
Nov 27 09:53:23 naboo systemd[1]: Stopped crowdsec-firewall-bouncer.service - The firewall bouncer for CrowdSec.

OS is Debian 12, up to date

Can anyone help me?

2

This error normally means the connection to the configured API url is unsuccessful due to either cant connect OR invalid api key.

Please check both of these.

3

I tried to register the bouncer …

cscli console enroll cllm24krd0000me0814bwpbt1
WARN[27-11-2023 14:59:21] Unable to retrieve latest crowdsec version: Get "https://version.crowdsec.net/latest": dial tcp: lookup version.crowdsec.net on [::1]:53: read udp [::1]:55792->[::1]:53: read: connection refused, defaulting to master
ERRO[27-11-2023 14:59:21] error while performing request: dial tcp: lookup api.crowdsec.net on [::1]:53: read udp [::1]:37918->[::1]:53: read: connection refused; 4 retries left
INFO[27-11-2023 14:59:21] retrying in 23 seconds (attempt 2 of 5)
ERRO[27-11-2023 14:59:44] error while performing request: dial tcp: lookup api.crowdsec.net on [::1]:53: read udp [::1]:38118->[::1]:53: read: connection refused; 3 retries left
INFO[27-11-2023 14:59:44] retrying in 44 seconds (attempt 3 of 5)
4

That doesnt add the bouncer that enrolls into the cloud console which needs direct internet access or via a proxy.

You add the bouncer by running this command then it will generate a API key, then you configure the LAPI and the api credentials within /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml