# IP in Blocklist not blocked from iptables

**URL:** <https://discourse.crowdsec.net/t/ip-in-blocklist-not-blocked-from-iptables/2452>\
**Category:** crowdsec\
**Created:** [March 22, 2025, 10:07pm UTC](https://discourse.crowdsec.net/t/ip-in-blocklist-not-blocked-from-iptables/2452 "2025-03-22T22:07:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Krisskross](https://avatars.discourse-cdn.com/v4/letter/k/c68b51/32.png) [@Krisskross](https://discourse.crowdsec.net/u/Krisskross)\
**Post date:** [March 22, 2025, 10:07pm UTC](https://discourse.crowdsec.net/t/ip-in-blocklist-not-blocked-from-iptables/2452/1 "2025-03-22T22:07:00Z")

</div>

Hello,  
my Linux-configuration:

- crowdsec & crowdsec-firewall installed localy
- iptable
- traefik as docker container  
The IPs that come through the Crowdsec community aren’t blocked for me. For example, I have one or more IPs listed in crowdsec-blacklists-3 that aren’t DROPED by iptables. I think I have a misconfiguration.

iptables -S shows like:  
-P INPUT ACCEPT  
-P FORWARD DROP  
-P OUTPUT ACCEPT  
-N CROWDSEC\_CHAIN  
-N DOCKER  
-N DOCKER-BRIDGE  
-N DOCKER-CT  
-N DOCKER-FORWARD  
-N DOCKER-ISOLATION-STAGE-1  
-N DOCKER-ISOLATION-STAGE-2  
-N DOCKER-USER  
-A INPUT -j CROWDSEC\_CHAIN  
-A FORWARD -j DOCKER-USER  
-A FORWARD -j DOCKER-FORWARD  
-A CROWDSEC\_CHAIN -m set --match-set crowdsec-blacklists-3 src -j DROP  
-A CROWDSEC\_CHAIN -m set --match-set crowdsec-blacklists-2 src -j DROP  
-A CROWDSEC\_CHAIN -m set --match-set crowdsec-blacklists-1 src -j DROP  
-A CROWDSEC\_CHAIN -m set --match-set crowdsec-blacklists-0 src -j DROP

can you help me?

---

<div class="post-metadata">

**Author:** ![LearningSpot](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/learningspot/32/1142_2.png) [@LearningSpot](https://discourse.crowdsec.net/u/LearningSpot)\
**Post date:** [March 23, 2025, 2:33am UTC](https://discourse.crowdsec.net/t/ip-in-blocklist-not-blocked-from-iptables/2452/2 "2025-03-23T02:33:26Z")

</div>

I think you need to add Crowdsec docker container in the same network as traefik to block IPs if you already haven’t. Maybe can follow the instructions from this post :

> **[Enhance Docker Compose Security with CrowdSec and Traefik](https://www.crowdsec.net/blog/enhance-docker-compose-security)**
>
> How have you been managing your Docker security without analyzing data? Learn how to enhance your Docker Compose security in this tutorial.

---

<div class="post-metadata">

**Author:** ![Krisskross](https://avatars.discourse-cdn.com/v4/letter/k/c68b51/32.png) [@Krisskross](https://discourse.crowdsec.net/u/Krisskross)\
**Post date:** [March 23, 2025, 10:35am UTC](https://discourse.crowdsec.net/t/ip-in-blocklist-not-blocked-from-iptables/2452/3 "2025-03-23T10:35:14Z")

</div>

Thanks for your reply.

I have Crowdsec installed locally, not via Docker containers. Crowdsec works fine with the containers; IPs are blocked, for example, for hhtp\_probing via the local API.

The blacklists are synchronized correctly and contain many IPs.

My Problem is that IPs on the blacklists are not blocked / droped.

Why? What’s wrong with the configuration?

---

<div class="post-metadata">

**Author:** ![LearningSpot](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/learningspot/32/1142_2.png) [@LearningSpot](https://discourse.crowdsec.net/u/LearningSpot)\
**Post date:** [March 23, 2025, 11:05am UTC](https://discourse.crowdsec.net/t/ip-in-blocklist-not-blocked-from-iptables/2452/4 "2025-03-23T11:05:25Z")

</div>

Did you install crowdsec traefik bouncer? Without that Crowdsec cannot block IPs proxy with traefik.

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [March 23, 2025, 12:28pm UTC](https://discourse.crowdsec.net/t/ip-in-blocklist-not-blocked-from-iptables/2452/5 "2025-03-23T12:28:02Z")

</div>

It depends on your setup, from the iptables dump I can see you haven’t enabled the `DOCKER_USER` chain which is needed to place the drop rule on docker routing.

If you use Cloudflare or another upstream proxy then yes you need to use the traefik plugin / layer 7 remediation on the webserver.

---

<div class="post-metadata">

**Author:** ![Krisskross](https://avatars.discourse-cdn.com/v4/letter/k/c68b51/32.png) [@Krisskross](https://discourse.crowdsec.net/u/Krisskross)\
**Post date:** [March 24, 2025, 9:41am UTC](https://discourse.crowdsec.net/t/ip-in-blocklist-not-blocked-from-iptables/2452/8 "2025-03-24T09:41:38Z")

</div>

Reinstalling the firewall bouncer seems to solve my problem.