IPset timeout value and profile ban time

Kaspar · August 27, 2024, 7:42pm

I am new to CrowSec and struggle to see the relation between the ban time defined in the profiles.yaml file (4 hours by default) and the timeout value used for IP’s in the ipset list.

The timeout value on IP’s in the ipset list is always larger then the ban time defined the profiles.yaml file. Why is that?

iiAmLoz · August 30, 2024, 7:46am

It shouldn’t be as we use the ban duration within seconds form:

github.com

crowdsecurity/cs-firewall-bouncer/blob/9594360ca83272d5c15ed1c343a6d96868d83cbc/pkg/iptables/iptables_context.go#L109


      
          		return err
          	}
          
          	log.Debugf("ipset add ban [%s] (for %d seconds)", *decision.Value, int(banDuration.Seconds()))
          
          	if banDuration.Seconds() > 2147483 {
          		log.Warnf("Ban duration too long (%d seconds), maximum for ipset is 2147483, setting duration to 2147482", int(banDuration.Seconds()))
          		banDuration = time.Duration(2147482) * time.Second
          	}
          
          	cmd := exec.Command(ctx.ipsetBin, "-exist", "add", ctx.SetName, *decision.Value, "timeout", strconv.Itoa(int(banDuration.Seconds())))
          	log.Debugf("ipset add : %s", cmd.String())
          
          	if out, err := cmd.CombinedOutput(); err != nil {
          		log.Infof("Error while inserting in set (%s): %v --> %s", cmd.String(), err, string(out))
          	}
          	// ipset -exist add test 192.168.0.1 timeout 600
          	return nil
          }
          
          func (ctx *ipTablesContext) shutDown() error {

if you can provide some debug information?

Kaspar · September 6, 2024, 1:16pm

My mistake. After reading up on the Crowdsec documentation I realized that ban time for bans from the Central Database (CAPI) are substantially longer. 167 hours if I am not mistaken, against 4 hours for local bans. This explains the much longer ban time I was seeing.

Is there a way adjust the default ban time for bans from the Central Database (CAPI)?

Topic		Replies	Views
How to ban IP permanently? crowdsec	1	1241	October 26, 2021
Block duration from profiles.yaml not applied after reload crowdsec	8	1167	March 23, 2021
Ban escalation time crowdsec	4	1659	November 18, 2022
Default Ban time duration crowdsec	4	4416	November 10, 2020
Profiles configuration	12	1892	September 3, 2021

IPset timeout value and profile ban time

Related topics