• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Crowdsec finally comming to pfSense

Scheduled Pinned Locked Moved pfSense Packages
68 Posts 19 Posters 17.3k Views 26 Watching
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • A Offline
    Antibiotic @SteveITS
    last edited by Apr 8, 2024, 6:36 PM

    @SteveITS Ok, thanks. But any profit to use /var in RAM, if pfSense instal on nvrme?

    pfSense plus 24.11 on Topton mini PC
    CPU: Intel N100
    NIC: Intel i-226v 4 pcs
    RAM : 16 GB DDR5
    Disk: 128 GB NVMe
    Brgds, Archi

    S 1 Reply Last reply Apr 8, 2024, 7:23 PM Reply Quote 1
    • S Offline
      SteveITS Rebel Alliance @Antibiotic
      last edited by Apr 8, 2024, 7:23 PM

      @Antibiotic said in Crowdsec finally comming to pfSense:

      But any profit to use /var in RAM, if pfSense instal on nvrme?

      Not that much, no. It can save disk writes if you do a lot of logging. Our clients often have eMMC drives and we disable a lot of logging.

      Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
      When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
      Upvote ๐Ÿ‘ helpful posts!

      A 1 Reply Last reply Apr 9, 2024, 1:58 PM Reply Quote 1
      • A Offline
        Antibiotic @SteveITS
        last edited by Antibiotic Apr 9, 2024, 2:00 PM Apr 9, 2024, 1:58 PM

        @SteveITS Can you please share, what kind of logs you disabled? and where, could be also will switch OFF!

        pfSense plus 24.11 on Topton mini PC
        CPU: Intel N100
        NIC: Intel i-226v 4 pcs
        RAM : 16 GB DDR5
        Disk: 128 GB NVMe
        Brgds, Archi

        S 1 Reply Last reply Apr 9, 2024, 3:13 PM Reply Quote 1
        • S Offline
          SteveITS Rebel Alliance @Antibiotic
          last edited by Apr 9, 2024, 3:13 PM

          @Antibiotic

          • uncheck "Log packets matched from the default block rules in the ruleset"
          • uncheck "Log packets blocked by 'Block Bogon Networks' rules"
          • uncheck "Log packets blocked by 'Block Private Networks' rules"
          • set "Log Compression" = None on all devices with ZFS (off by default but on if you restore an old config to new unit), or devices with eMMC
          • Suricata uncheck "Enable HTTP Log"

          re: default block rules, we turn those on temporarily if we're debugging something.

          Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
          Upvote ๐Ÿ‘ helpful posts!

          A 1 Reply Last reply Apr 9, 2024, 4:07 PM Reply Quote 2
          • A Offline
            Antibiotic @SteveITS
            last edited by Apr 9, 2024, 4:07 PM

            @SteveITS Thank you , one question if use Crowdsec which one reading different logs, this unchecks will not OFF some important data logs for Crowdsec readings?

            pfSense plus 24.11 on Topton mini PC
            CPU: Intel N100
            NIC: Intel i-226v 4 pcs
            RAM : 16 GB DDR5
            Disk: 128 GB NVMe
            Brgds, Archi

            S 1 Reply Last reply Apr 9, 2024, 5:24 PM Reply Quote 1
            • S Offline
              SteveITS Rebel Alliance @Antibiotic
              last edited by Apr 9, 2024, 5:24 PM

              @Antibiotic I have not used the Crowdsec plugin.

              Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
              When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
              Upvote ๐Ÿ‘ helpful posts!

              D 1 Reply Last reply Apr 9, 2024, 7:18 PM Reply Quote 1
              • D Offline
                Dobby_ @SteveITS
                last edited by Apr 9, 2024, 7:18 PM

                @SteveITS said in Crowdsec finally comming to pfSense:

                @Antibiotic I have not used the Crowdsec plugin.

                Hey Steve do you know where to find "Crowdsec" for installing it on pfSense?
                I havw done a pkg info and pkg search for Crowdsec and also in the package
                manager I canยดt see an option to install it as a pkg.

                #~. @Dobby

                Turris Omnia - 4 Ports - 2 GB RAM / TurrisOS 7 Release (Btrfs)
                PC Engines APU4D4 - 4 Ports - 4 GB RAM / pfSense CE 2.7.2 Release (ZFS)
                PC Engines APU6B4 - 4 Ports - 4 GB RAM / pfSense+ (Plus) 24.03_1 Release (ZFS)

                S 1 Reply Last reply Apr 9, 2024, 7:59 PM Reply Quote 1
                • S Offline
                  SteveITS Rebel Alliance @Dobby_
                  last edited by Apr 9, 2024, 7:59 PM

                  @Dobby_ said in Crowdsec finally comming to pfSense:

                  do you know where to find "Crowdsec" for installing it on pfSense

                  It's a manual install and I want to say is therefore CE only? (not sure on that) A link was above:

                  @mmetc said in Crowdsec finally comming to pfSense:

                  The package can be installed by hand in the meanwhile

                  https://docs.crowdsec.net/docs/next/getting_started/install_crowdsec_pfsense

                  Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                  When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
                  Upvote ๐Ÿ‘ helpful posts!

                  D 1 Reply Last reply Apr 9, 2024, 8:21 PM Reply Quote 2
                  • D Offline
                    Dobby_ @SteveITS
                    last edited by Apr 9, 2024, 8:21 PM

                    @SteveITS

                    Thank you I got installed now.

                    #~. @Dobby

                    Turris Omnia - 4 Ports - 2 GB RAM / TurrisOS 7 Release (Btrfs)
                    PC Engines APU4D4 - 4 Ports - 4 GB RAM / pfSense CE 2.7.2 Release (ZFS)
                    PC Engines APU6B4 - 4 Ports - 4 GB RAM / pfSense+ (Plus) 24.03_1 Release (ZFS)

                    1 Reply Last reply Reply Quote 1
                    • A Offline
                      Antibiotic
                      last edited by Antibiotic Apr 10, 2024, 3:31 PM Apr 10, 2024, 3:30 PM

                      Could some1 to explain, is it possible to read Windows PC log with Crowdsec installed on pfSense or need to install Crowdsec also for Windows PC?

                      pfSense plus 24.11 on Topton mini PC
                      CPU: Intel N100
                      NIC: Intel i-226v 4 pcs
                      RAM : 16 GB DDR5
                      Disk: 128 GB NVMe
                      Brgds, Archi

                      1 Reply Last reply Reply Quote 1
                      • P Offline
                        provels
                        last edited by provels Apr 12, 2024, 1:50 PM Apr 12, 2024, 10:01 AM

                        Is CrowdSec meant to replace pfB? Snort, Suricata? Augment them? Thanks.

                        Peder

                        MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                        BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                        A 1 Reply Last reply Apr 12, 2024, 3:50 PM Reply Quote 1
                        • A Offline
                          Antibiotic @provels
                          last edited by Antibiotic Apr 12, 2024, 4:01 PM Apr 12, 2024, 3:50 PM

                          @provels You can read here:

                          "https://www.crowdsec.net/blog/suricata-vs-crowdsec"

                          I think Crowdsec blacklist working the same as pfBlockerNG, THE POINT of this, that pfBlockerNG limited to one hour update maximum , Crowdsec update more frequently I think!

                          pfSense plus 24.11 on Topton mini PC
                          CPU: Intel N100
                          NIC: Intel i-226v 4 pcs
                          RAM : 16 GB DDR5
                          Disk: 128 GB NVMe
                          Brgds, Archi

                          1 Reply Last reply Reply Quote 2
                          • P Offline
                            provels
                            last edited by Apr 24, 2024, 1:27 PM

                            Looks like the pfSense install is not supported in FreeBSD 15 (24.03-RELEASE upgrade). Sad face.

                            Peder

                            MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                            BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                            M 1 Reply Last reply Apr 25, 2024, 7:35 AM Reply Quote 3
                            • M Offline
                              mmetc @provels
                              last edited by Apr 25, 2024, 7:35 AM

                              @provels this? https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3/freebsd-15-amd64.tar

                              P 1 Reply Last reply Apr 25, 2024, 7:48 AM Reply Quote 1
                              • P Offline
                                provels @mmetc
                                last edited by provels Apr 25, 2024, 8:22 AM Apr 25, 2024, 7:48 AM

                                @mmetc Not sure at present. I saw Crowdsec was uninstalled by the upgrade process when I upgraded yesterday and saw an OS mismatch when I tried to reinstall, hence my post. But there is a pfSense update issued overnight with the following log:

                                The following 3 package(s) will be affected (of 0 checked):
                                
                                Installed packages to be REMOVED:
                                	re2: 20231101
                                
                                Installed packages to be UPGRADED:
                                	pfSense: 24.03 -> 24.03_1 [pfSense]
                                
                                Installed packages to be REINSTALLED:
                                	abseil-20230125.3 [pfSense] (ABI changed: 'freebsd:14:x86:64' -> 'freebsd:15:x86:64')
                                

                                So maybe fixed, don't know yet.

                                Edit: Same errors as yesterday.

                                [24.03-RELEASE][root@fw.workgroup]/root: pkg add -f /root/CrowdSec/re2-20231101.pkg
                                Installing re2-20231101...
                                pkg: wrong architecture: FreeBSD:14:amd64 instead of FreeBSD:15:amd64
                                Extracting re2-20231101: 100%
                                
                                Installing crowdsec-1.6.0...
                                pkg: wrong architecture: FreeBSD:14:amd64 instead of FreeBSD:15:amd64
                                Extracting crowdsec-1.6.0: 100%
                                
                                Installing pfSense-pkg-crowdsec-0.1.3...
                                pkg: wrong architecture: FreeBSD:14:amd64 instead of FreeBSD:15:amd64
                                Extracting pfSense-pkg-crowdsec-0.1.3: 100%
                                
                                

                                Edit2: So I guess it's working even after mismatch messages. Probably the reason for this line in the install instructions. What do I know, I'm just some hack who will install anything! :)

                                # setenv IGNORE_OSVERSION yes
                                

                                Peder

                                MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                                BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                                M A 2 Replies Last reply Apr 25, 2024, 8:46 AM Reply Quote 1
                                • M Offline
                                  mmetc @provels
                                  last edited by Apr 25, 2024, 8:46 AM

                                  @provels you can download the archive I linked, there is the same content as the *pkg files but for freebsd 15. A new release with crowdsec 1.6.1 should be uploaded soon, I'll make sure to build the *pkg files with version 15

                                  A bthovenB 2 Replies Last reply Apr 26, 2024, 9:22 PM Reply Quote 3
                                  • A Offline
                                    Antibiotic @provels
                                    last edited by Apr 26, 2024, 4:29 PM

                                    @provels New release there for Freebsd15 and updated to 1.6.1

                                    pfSense plus 24.11 on Topton mini PC
                                    CPU: Intel N100
                                    NIC: Intel i-226v 4 pcs
                                    RAM : 16 GB DDR5
                                    Disk: 128 GB NVMe
                                    Brgds, Archi

                                    1 Reply Last reply Reply Quote 2
                                    • A Offline
                                      Antibiotic @mmetc
                                      last edited by Apr 26, 2024, 9:22 PM

                                      @mmetc Hello after install 1.6.1 on 24.03 have this error
                                      level=error msg="while fetching bouncer info: ent: bouncer not found" ip=127.0.0.1

                                      pfSense plus 24.11 on Topton mini PC
                                      CPU: Intel N100
                                      NIC: Intel i-226v 4 pcs
                                      RAM : 16 GB DDR5
                                      Disk: 128 GB NVMe
                                      Brgds, Archi

                                      1 Reply Last reply Reply Quote 0
                                      • D Offline
                                        Dobby_
                                        last edited by Dobby_ Apr 30, 2024, 2:31 AM Apr 27, 2024, 10:57 AM

                                        For pfSense+ 24.03_1 (amd64) I was following this steps;

                                        Getting started - Install CrowdSec on pfSense

                                        Please scroll down until you read the following (in a blue image)
                                        You will see it here below in the code block
                                        It is the install sequence (from top till down)

                                        # setenv IGNORE_OSVERSION yes
                                        # pkg add -f <link to abseil>
                                        # pkg add -f <link to re2>
                                        # pkg add -f <link to crowdsec-firewall-bouncer>
                                        # pkg add -f <link to crowdsec>
                                        # pkg add -f <link to pfSense-pkg-crowdsec>
                                        

                                        And under this page you find the latest pkgยดs or files for your installation.
                                        pfSense-pkg-Crowdsec, click on assets (11) and the drop down menue is opening then right click on the shown links and past them in the following sequence inside of your pfSense console CLI.

                                        • Connect to your console
                                        • type in (8) for shell
                                        • and now all commands together (one after one) with the right link to the packages

                                        As an example for pfSense+ 24.03_1 (FreeBSD 15) amd64 hardware shown below:

                                        # setenv IGNORE_OSVERSION yes
                                        # pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/abseil-20230125.3.pkg
                                        # pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/re2-20240401.pkg
                                        # pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/crowdsec-firewall-bouncer-0.0.28_3.pkg
                                        # pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/crowdsec-1.6.1.pkg
                                        # pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/pfSense-pkg-crowdsec-0.1.3.pkg
                                        

                                        After installing it you may have a look under system > services > CrowdSec
                                        to ensure that all is right enabled. If not enable (activate) them by clicking
                                        on it, please click then at last on save

                                        CrowdSec1.jpg

                                        Now you should read the rest of the page
                                        Getting started - CrowdSec on pfSense
                                        to configure your installation, matching well to your network setup.

                                        And at least activate both services to make them running.

                                        CrowdSec2.jpg

                                        #~. @Dobby

                                        Turris Omnia - 4 Ports - 2 GB RAM / TurrisOS 7 Release (Btrfs)
                                        PC Engines APU4D4 - 4 Ports - 4 GB RAM / pfSense CE 2.7.2 Release (ZFS)
                                        PC Engines APU6B4 - 4 Ports - 4 GB RAM / pfSense+ (Plus) 24.03_1 Release (ZFS)

                                        1 Reply Last reply Reply Quote 2
                                        • bthovenB Offline
                                          bthoven @mmetc
                                          last edited by Apr 28, 2024, 12:11 AM

                                          @mmetc said in Crowdsec finally comming to pfSense:

                                          @provels you can download the archive I linked, there is the same content as the *pkg files but for freebsd 15. A new release with crowdsec 1.6.1 should be uploaded soon, I'll make sure to build the *pkg files with version 15

                                          I'm currently on version 1.6.0. To upgrade, should I execute only the following commands? Other than the re2 and pfsense packages, it appears that the remaining packages are the same version.

                                          setenv IGNORE_OSVERSION yes
                                          pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/re2-20240401.pkg
                                          pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/crowdsec-1.6.1.pkg
                                          

                                          Is there any breaking changes I should be aware of? I'm running pfSense CE 2.7.2....thanks.

                                          bthovenB 1 Reply Last reply Apr 30, 2024, 1:43 AM Reply Quote 1
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received