# Where to run Crowdsec?

**URL:** <https://discourse.crowdsec.net/t/where-to-run-crowdsec/1861>\
**Category:** crowdsec\
**Created:** [June 8, 2024, 10:07am UTC](https://discourse.crowdsec.net/t/where-to-run-crowdsec/1861 "2024-06-08T10:07:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nk97](https://avatars.discourse-cdn.com/v4/letter/n/dec6dc/32.png) [@nk97](https://discourse.crowdsec.net/u/nk97)\
**Post date:** [June 8, 2024, 10:07am UTC](https://discourse.crowdsec.net/t/where-to-run-crowdsec/1861/1 "2024-06-08T10:07:16Z")

</div>

I’m wondering **where** to install Crowdsec?

Isn’t there an advantage to installing Crowdsec at the router/firewall level (opnsense) upstream? All servers behind this router, whether DNS, web, mail, etc., could benefit from the protection?

I see this way of using Crowdsec as a proactive approach on the firewall, using Crowdsec’s public IP blocklists. Because, let’s agree, the logs from WEB1 nginx server don’t reach the router level, and therefore we can’t benefit from real-time active protection. Just passive on the router? True?

Would we need to forward the nginx WEB1 logs to the firewall to use them as a Bouncer on it?

What do you think about installing Crowdsec everywhere on my LAN? On the router, on the reverse proxy, and on the web server? Using the multi-site LAPI feature? Isn’t it too resource-consuming? Just installing on the router and parsing the nginx logs that could be transmitted to the firewall?

 ![Sans-titre-2024-01-29-1757](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/09abe5e9dc1aac694c2ea260afc39e242ab3dd52.png)

I am aware of this approach

> **[Setting up A Multi-Server Security Engine Installation](https://www.crowdsec.net/blog/multi-server-setup)**
>
> Learn how to deploy multiple Security Engines in a multi-server setup with one of the servers configured to store and share the collected signals.

There was already a topic almost identical to mine in the past, but this post alone is not enough for me to understand.

> [@Newbie question: Where to run crowdsec?](https://discourse.crowdsec.net/t/newbie-question-where-to-run-crowdsec/1612):
>
> Hi Team! Just to introduce myself - I’m a private hobby IT admin for my own installation. At the moment - besides other things - I’m running my own Nextcloud server on an Ubuntu 22.04.03 LTS installation. As I’m running a couple of other web servers like IP cameras etc. I’m using a Raspberry PI based reverse proxy. Now here is the question: I did migrate my Nextcloud installation from Fail2Ban to crowdsec. While watching TV last night I started asking myself if the crowdsec installation has to…

---

<div class="post-metadata">

**Author:** ![nk97](https://avatars.discourse-cdn.com/v4/letter/n/dec6dc/32.png) [@nk97](https://discourse.crowdsec.net/u/nk97)\
**Post date:** [June 10, 2024, 4:20pm UTC](https://discourse.crowdsec.net/t/where-to-run-crowdsec/1861/2 "2024-06-10T16:20:21Z")

</div>

Here’s how I see things.

- Crowdsec installed with a **bouncer** on OPNsense Firewall, allowing for iptables manipulation for banning.

- Crowdsec installed **without a bouncer** (less resources?) on a web server with port 22 open.

Both Crowdsec instances communicate via LAPI.

A hacker performs a brute-force attack on port 22 on the web server. The server reports the information to the Crowdsec Bouncer on the firewall, which applies a ban to the hacker’s IP.

Is this the expected behavior for this installation, or am I mistaken? Are there areas for improvement ?

 ![HZO46](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/2bc5fd8c1222c04aa81208cc68062eb9795ade5e.jpeg)

---

<div class="post-metadata">

**Author:** ![alendroit](https://avatars.discourse-cdn.com/v4/letter/a/ad7895/32.png) [@alendroit](https://discourse.crowdsec.net/u/alendroit)\
**Post date:** [June 10, 2024, 5:24pm UTC](https://discourse.crowdsec.net/t/where-to-run-crowdsec/1861/3 "2024-06-10T17:24:50Z")

</div>

Hello,  
I have a similar architecture. Firewall → Reverse proxy (haproxy) → website (nginx)  
I installed crowdsec on the firewall to parse haproxy logs. And I use the haproxy bouncer to ban ips.  
I guess you should install crowdsec in your webserver if you want to use app sec rules. It seems that parsing body is painful with haproxy. (Or I just miss something obvious ^^)

For the crowdsec LAPI, It seems that a plugin exist for the opnsense appliance but I never tested it. It could worth to test it. In my case I installed it on a small debian.

TLDR; I would install crowdsec on reverse proxy to parse access log and install iptable bouncer on the firewall.