Hi,
on my fresh installed openWRT I was able to get crowdsec configured and running. It is also enrolled to the crowdsec API.
When I try to manually block an IP it is working fine, the IP is blocked perfectly.
But I do have the feeling that not everything is working like expected and looking into the log of Crowdsec is showing me the following:
time="2025-10-31T11:02:08Z" level=info msg="Starting community-blocklist update"
time="2025-10-31T11:02:09Z" level=info msg="capi/community-blocklist : 0 explicit deletions"
time="2025-10-31T11:02:12Z" level=info msg="crowdsecurity/community-blocklist : added 15000 entries, deleted 14993 entries (alert:25)"
time="2025-10-31T11:02:13Z" level=info msg="lists:firehol_botscout_7d : added 1847 entries, deleted 1847 entries (alert:26)"
time="2025-10-31T11:02:14Z" level=info msg="lists:firehol_greensnow : added 4702 entries, deleted 4702 entries (alert:27)"
time="2025-10-31T11:25:05Z" level=info msg="capi metrics: sending"
So it seems that the entries got added but instantly deleted afterwards.
The list of IPs for the nft are also looking good:
218.188.156.138 timeout 23h59m52s860ms expires 10h42m19s900ms, 218.208.4.179 timeout 23h59m52s860ms expires 10h42m19s900ms,
219.75.254.26 timeout 23h59m52s860ms expires 10h42m19s900ms, 220.93.109.117 timeout 23h59m52s860ms expires 10h42m19s900ms,
220.233.199.84 timeout 23h59m52s860ms expires 10h42m19s900ms, 221.8.23.9 timeout 23h59m52s860ms expires 10h42m19s900ms,
223.29.253.17 timeout 23h59m52s860ms expires 10h42m19s900ms, 223.29.253.27 timeout 23h59m52s860ms expires 10h42m19s900ms,
223.29.253.111 timeout 23h59m52s860ms expires 10h42m19s910ms, 223.29.253.127 timeout 23h59m52s860ms expires 10h42m19s910ms,
223.29.253.159 timeout 23h59m52s860ms expires 10h42m19s900ms, 223.29.253.224 timeout 23h59m52s860ms expires 10h42m19s910ms }
}
chain crowdsec-chain-input {
type filter hook input priority filter + 4; policy accept;
ct state established,related accept
iifname != "eth1.140" accept
counter packets 82 bytes 3037
ip saddr @crowdsec-blacklists-CAPI counter packets 1 bytes 48 drop
ip saddr @crowdsec-blacklists-lists-firehol_greensnow counter packets 0 bytes 0 drop
ip saddr @crowdsec-blacklists-lists-firehol_botscout_7d counter packets 0 bytes 0 drop
}
chain crowdsec-chain-forward {
type filter hook forward priority filter + 4; policy accept;
ct state established,related accept
iifname != "eth1.140" accept
counter packets 396 bytes 20800
ip saddr @crowdsec-blacklists-CAPI counter packets 109 bytes 5836 drop
ip saddr @crowdsec-blacklists-lists-firehol_greensnow counter packets 0 bytes 0 drop
ip saddr @crowdsec-blacklists-lists-firehol_botscout_7d counter packets 0 bytes 0 drop
}
}
No decisions and alerts yet which is strange.
How can I resolve this or is that an normal behaviour?
Cheers
Shorty.