I am constantly being banned from my server

crowdsec
1

CrowdSec runs in the stack (Docker).
Although I added my IP to the exception, I get banned regularly - at least 1x a day.
It always depends on how often I use other Docker services like Seafile and how often I access my server via SSH. Sometimes it is enough to upload/download files to my Seafile server on the cell phone = ban.

I am connected to the Internet non-stop via VPN on my computer and cell phone. Where on SSH (Putty) on Windows I use Putty and WinSCP on my VPN client for exception in split tunnel and added Seafile client on mobile as well via split tunnel as exception. The browsers, however, do not.
That means via Putty SSH, WinSCP client and Seafile client on mobile my authentic IP is used.

Anyway, I keep getting banned and then can’t manage to unban myself because I can’t get in via SSH. Neither on my computer, laptop etc. With and without VPN. I stay banned for about a day.

Tomorrow I could probably access my server again without VPN (no idea why even access without VPN is not even possible right now) via SSH and then manually unban the VPN-IP. Interestingly, Crowdsec never shows that an IP belonging to me was banned although, an IP of mine is successfully removed from the banlist.

2

What scenario is triggering the ban? cause we don’t have a seafile collection so either its custom or you are proxing through a webserver that is then triggering a http collection scenario.

That information would help us debug to create a postoverflow whitelist for seafile. However, it still doesn’t let me understand why a single ban is blocking both VPN and non VPN connects as they should be both external IP’s. How have you configured the firewall remediation component?

3

I would like to send you my settings, but privately. Is that not possible here? Maybe in Discord?

4

Discord would be the best way. You will find me under the same name and avatar.