I would like to share my recipe for running a CrowdSec
firewall bouncer on an EdgeOS router – it was tested on a ER-6P and it worked
quite well for the last 4 months on my company’s router.
I’m assuming the following:
you have admin access to a Linux VM or PC with Ubuntu or Arch
you have basic Linux CLI skills (can open terminal and run commands)
you are familiar with SSH and EdgeOS configuration
you are running a separate machine with CrowdSec’s LocalAPI
(running full CrowdSec installation on router should be possible,
but I didn’t test it)
your router is available at yourroutersaddress. Every time you see this word
in the instructions replace it with your real router’s address
(for ex. 192.168.1.1)
Things you should run on your PC are prefixed with pc ,
the ones to run on your router router and the ones run on a LocalAPI Server - la.
Anyway, let’s get into business:
You have to install Go toolchain and Git on your Linux PC or VM:
Debian/Ubuntu:
pc $ sudo apt install git golang-go
Arch:
pc $ sudo pacman -S go git
Then, clone CrowdSec bouncer repository to folder on your PC:
pc $ git clone https://github.com/crowdsecurity/cs-firewall-bouncer.git
Now you have to establish your router’s architecture.
For modern Cavium-based routers (ER-4, ER-6P, ER-12, …) it’s mips64.
For Mediatek-based ones (ER-X, ER-10X, …) it’s mipsle.
Build your CrowdSec bouncer’s binary
pc $ export GOOS=linux
pc $ # export GOARCH=<your router's architecture> # for example
pc $ export GOARCH=mips64
pc $ make
After a short while, the build process should finish and you’ll have a
bouncer binary in your current folder named crowdsec-firewall-bouncer.
Connect to your LocalAPI server and create a bouncer token:
la $ cscli bouncers add yourroutersname
You’ll get a response similar to:
Api key for 'yourroutersname':
aaaaaaaaaabbbbbbbbbbccccccccddff
Please keep this key since you will not be able to retrieve it!
Save the API key, it will be needed on next step.
It’s time to SSH to your router and prepare your bouncers configuration.
We’ll install everything int the /config folder as it’s the only location
I know that survives firmware upgrades.
I tried to proof this tutorial, but I’m sure there are at least some errors and omissions. Feel free
to post your corrections into this thread, I’ll try to update this guide accordingly.
Enjoy!
Edit: I removed integration with EdgeOS firewall – it caused a lot of race conditions. Right now the bouncer just inserts two rules to INPUT and FORWARD chains.
thankyou so much! your guide (2nd half) was extremely helpful as i’m trying to do the same on OpenWrt and no instructions are available…
i did not manage to get it running yet (no log is created) so difficult to debug… but I would have been really lost without these simple step by step guide…
I wonder why it’s so hard to find simple guides like this? many seem to just address peices or are oversimplified and miss critical steps…
also tried using the configure prompt
root@EdgeRouter# /config/user-data/crowdsec-firewall-bouncer -t -c /config/user-data/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
vbash: /config/user-data/crowdsec-firewall-bouncer: cannot execute binary file
[edit]
These are commands i have ran on the linux box
root@homeassistant:/tmp#git clone GitHub - crowdsecurity/cs-firewall-bouncer: Crowdsec bouncer written in golang for firewalls
root@homeassistant:/tmp/cs-firewall-bouncer# export GOARCH=mips
root@homeassistant:/tmp/cs-firewall-bouncer# export GOOS=linux
root@homeassistant:/tmp/cs-firewall-bouncer# make
root@homeassistant:/tmp/cs-firewall-bouncer# scp crowdsec-firewall-bouncer root@10.0.0.1:/config/user-data/crowdsec-firewall-bouncer
Here is my router uname -a Information
root@EdgeRouter# uname -a
Linux EdgeRouter 4.14.54-UBNT #1 SMP Tue May 11 13:23:28 UTC 2021 mips GNU/Linux
Post your uname -ar to check the arch.
It must be same than the one with file crowdsec-firewall-bouncer
You may also checked another binary of the system with file…like @mwegrzynek already suggest.
Also take a look to your binary with ls -hal crowdsec-firewall-bouncer
to see the status of the eXecute permission. If not already sets, add it with chmod a+x crowdsec-firewall-bouncer
time="09-03-2022 16:10:29" level=info msg="Error while inserting in set (/sbin/ipset -exist add crowdsec-blacklists 222.255.148.167 timeout 596087): exit status 1 --> ipset v6.30: Timeout cannot be used: set was created without timeout support\n"
time="09-03-2022 16:10:29" level=info msg="Error while inserting in set (/sbin/ipset -exist add crowdsec-blacklists 137.184.77.9 timeout 596087): exit status 1 --> ipset v6.30: Timeout cannot be used: set was created without timeout support\n"
time="09-03-2022 16:10:29" level=info msg="Error while inserting in set (/sbin/ipset -exist add crowdsec-blacklists 106.12.176.108 timeout 596087): exit status 1 --> ipset v6.30: Timeout cannot be used: set was created without timeout support\n"
time="09-03-2022 16:10:29" level=info msg="Error while inserting in set (/sbin/ipset -exist add crowdsec-blacklists 165.232.154.178 timeout 596087): exit status 1 --> ipset v6.30: Timeout cannot be used: set was created without timeout support\n"
time="09-03-2022 16:10:29" level=info msg="Error while inserting in set (/sbin/ipset -exist add crowdsec-blacklists 119.159.234.131 timeout 596088): exit status 1 --> ipset v6.30: Timeout cannot be used: set was created without timeout support\n"
time="09-03-2022 16:10:29" level=info msg="Error while inserting in set (/sbin/ipset -exist add crowdsec-blacklists 46.101.149.216 timeout 596088): exit status 1 --> ipset v6.30: Timeout cannot be used: set was created without timeout support\n"
time="09-03-2022 16:10:29" level=info msg="300 decisions added"
I have noticed that if a firewall address group is created before the service stars, it throws errors an it is unable to add ip addresses to it but it is not created beforehand it loasa with no errors, it is able to add addresses to the list but it is imposible to add the grup to a firewall rule…
Regarding your problems with CrowdSec bouncer on OpenWRT: