Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Crowdsec finally comming to pfSense

    Scheduled Pinned Locked Moved pfSense Packages
    68 Posts 19 Posters 12.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Antibiotic @SteveITS
      last edited by

      @SteveITS Ok, thanks. But any profit to use /var in RAM, if pfSense instal on nvrme?

      pfSense plus 24.11 on Topton mini PC
      CPU: Intel N100
      NIC: Intel i-226v 4 pcs
      RAM : 16 GB DDR5
      Disk: 128 GB NVMe
      Brgds, Archi

      S 1 Reply Last reply Reply Quote 1
      • S
        SteveITS Galactic Empire @Antibiotic
        last edited by

        @Antibiotic said in Crowdsec finally comming to pfSense:

        But any profit to use /var in RAM, if pfSense instal on nvrme?

        Not that much, no. It can save disk writes if you do a lot of logging. Our clients often have eMMC drives and we disable a lot of logging.

        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
        Upvote πŸ‘ helpful posts!

        A 1 Reply Last reply Reply Quote 1
        • A
          Antibiotic @SteveITS
          last edited by Antibiotic

          @SteveITS Can you please share, what kind of logs you disabled? and where, could be also will switch OFF!

          pfSense plus 24.11 on Topton mini PC
          CPU: Intel N100
          NIC: Intel i-226v 4 pcs
          RAM : 16 GB DDR5
          Disk: 128 GB NVMe
          Brgds, Archi

          S 1 Reply Last reply Reply Quote 1
          • S
            SteveITS Galactic Empire @Antibiotic
            last edited by

            @Antibiotic

            • uncheck "Log packets matched from the default block rules in the ruleset"
            • uncheck "Log packets blocked by 'Block Bogon Networks' rules"
            • uncheck "Log packets blocked by 'Block Private Networks' rules"
            • set "Log Compression" = None on all devices with ZFS (off by default but on if you restore an old config to new unit), or devices with eMMC
            • Suricata uncheck "Enable HTTP Log"

            re: default block rules, we turn those on temporarily if we're debugging something.

            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
            Upvote πŸ‘ helpful posts!

            A 1 Reply Last reply Reply Quote 2
            • A
              Antibiotic @SteveITS
              last edited by

              @SteveITS Thank you , one question if use Crowdsec which one reading different logs, this unchecks will not OFF some important data logs for Crowdsec readings?

              pfSense plus 24.11 on Topton mini PC
              CPU: Intel N100
              NIC: Intel i-226v 4 pcs
              RAM : 16 GB DDR5
              Disk: 128 GB NVMe
              Brgds, Archi

              S 1 Reply Last reply Reply Quote 1
              • S
                SteveITS Galactic Empire @Antibiotic
                last edited by

                @Antibiotic I have not used the Crowdsec plugin.

                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                Upvote πŸ‘ helpful posts!

                Dobby_D 1 Reply Last reply Reply Quote 1
                • Dobby_D
                  Dobby_ @SteveITS
                  last edited by

                  @SteveITS said in Crowdsec finally comming to pfSense:

                  @Antibiotic I have not used the Crowdsec plugin.

                  Hey Steve do you know where to find "Crowdsec" for installing it on pfSense?
                  I havw done a pkg info and pkg search for Crowdsec and also in the package
                  manager I canΒ΄t see an option to install it as a pkg.

                  #~. @Dobby

                  Turris Omnia - 4 Ports - 2 GB RAM / TurrisOS 7 Release (Btrfs)
                  PC Engines APU4D4 - 4 Ports - 4 GB RAM / pfSense CE 2.7.2 Release (ZFS)
                  PC Engines APU6B4 - 4 Ports - 4 GB RAM / pfSense+ (Plus) 24.03_1 Release (ZFS)

                  S 1 Reply Last reply Reply Quote 1
                  • S
                    SteveITS Galactic Empire @Dobby_
                    last edited by

                    @Dobby_ said in Crowdsec finally comming to pfSense:

                    do you know where to find "Crowdsec" for installing it on pfSense

                    It's a manual install and I want to say is therefore CE only? (not sure on that) A link was above:

                    @mmetc said in Crowdsec finally comming to pfSense:

                    The package can be installed by hand in the meanwhile

                    https://docs.crowdsec.net/docs/next/getting_started/install_crowdsec_pfsense

                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                    Upvote πŸ‘ helpful posts!

                    Dobby_D 1 Reply Last reply Reply Quote 2
                    • Dobby_D
                      Dobby_ @SteveITS
                      last edited by

                      @SteveITS

                      Thank you I got installed now.

                      #~. @Dobby

                      Turris Omnia - 4 Ports - 2 GB RAM / TurrisOS 7 Release (Btrfs)
                      PC Engines APU4D4 - 4 Ports - 4 GB RAM / pfSense CE 2.7.2 Release (ZFS)
                      PC Engines APU6B4 - 4 Ports - 4 GB RAM / pfSense+ (Plus) 24.03_1 Release (ZFS)

                      1 Reply Last reply Reply Quote 1
                      • A
                        Antibiotic
                        last edited by Antibiotic

                        Could some1 to explain, is it possible to read Windows PC log with Crowdsec installed on pfSense or need to install Crowdsec also for Windows PC?

                        pfSense plus 24.11 on Topton mini PC
                        CPU: Intel N100
                        NIC: Intel i-226v 4 pcs
                        RAM : 16 GB DDR5
                        Disk: 128 GB NVMe
                        Brgds, Archi

                        1 Reply Last reply Reply Quote 1
                        • provelsP
                          provels
                          last edited by provels

                          Is CrowdSec meant to replace pfB? Snort, Suricata? Augment them? Thanks.

                          Peder

                          MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                          BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                          A 1 Reply Last reply Reply Quote 1
                          • A
                            Antibiotic @provels
                            last edited by Antibiotic

                            @provels You can read here:

                            "https://www.crowdsec.net/blog/suricata-vs-crowdsec"

                            I think Crowdsec blacklist working the same as pfBlockerNG, THE POINT of this, that pfBlockerNG limited to one hour update maximum , Crowdsec update more frequently I think!

                            pfSense plus 24.11 on Topton mini PC
                            CPU: Intel N100
                            NIC: Intel i-226v 4 pcs
                            RAM : 16 GB DDR5
                            Disk: 128 GB NVMe
                            Brgds, Archi

                            1 Reply Last reply Reply Quote 2
                            • provelsP
                              provels
                              last edited by

                              Looks like the pfSense install is not supported in FreeBSD 15 (24.03-RELEASE upgrade). Sad face.

                              Peder

                              MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                              BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                              M 1 Reply Last reply Reply Quote 3
                              • M
                                mmetc @provels
                                last edited by

                                @provels this? https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3/freebsd-15-amd64.tar

                                provelsP 1 Reply Last reply Reply Quote 1
                                • provelsP
                                  provels @mmetc
                                  last edited by provels

                                  @mmetc Not sure at present. I saw Crowdsec was uninstalled by the upgrade process when I upgraded yesterday and saw an OS mismatch when I tried to reinstall, hence my post. But there is a pfSense update issued overnight with the following log:

                                  The following 3 package(s) will be affected (of 0 checked):
                                  
                                  Installed packages to be REMOVED:
                                  	re2: 20231101
                                  
                                  Installed packages to be UPGRADED:
                                  	pfSense: 24.03 -> 24.03_1 [pfSense]
                                  
                                  Installed packages to be REINSTALLED:
                                  	abseil-20230125.3 [pfSense] (ABI changed: 'freebsd:14:x86:64' -> 'freebsd:15:x86:64')
                                  

                                  So maybe fixed, don't know yet.

                                  Edit: Same errors as yesterday.

                                  [24.03-RELEASE][root@fw.workgroup]/root: pkg add -f /root/CrowdSec/re2-20231101.pkg
                                  Installing re2-20231101...
                                  pkg: wrong architecture: FreeBSD:14:amd64 instead of FreeBSD:15:amd64
                                  Extracting re2-20231101: 100%
                                  
                                  Installing crowdsec-1.6.0...
                                  pkg: wrong architecture: FreeBSD:14:amd64 instead of FreeBSD:15:amd64
                                  Extracting crowdsec-1.6.0: 100%
                                  
                                  Installing pfSense-pkg-crowdsec-0.1.3...
                                  pkg: wrong architecture: FreeBSD:14:amd64 instead of FreeBSD:15:amd64
                                  Extracting pfSense-pkg-crowdsec-0.1.3: 100%
                                  
                                  

                                  Edit2: So I guess it's working even after mismatch messages. Probably the reason for this line in the install instructions. What do I know, I'm just some hack who will install anything! :)

                                  # setenv IGNORE_OSVERSION yes
                                  

                                  Peder

                                  MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                                  BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                                  M A 2 Replies Last reply Reply Quote 1
                                  • M
                                    mmetc @provels
                                    last edited by

                                    @provels you can download the archive I linked, there is the same content as the *pkg files but for freebsd 15. A new release with crowdsec 1.6.1 should be uploaded soon, I'll make sure to build the *pkg files with version 15

                                    A bthovenB 2 Replies Last reply Reply Quote 3
                                    • A
                                      Antibiotic @provels
                                      last edited by

                                      @provels New release there for Freebsd15 and updated to 1.6.1

                                      pfSense plus 24.11 on Topton mini PC
                                      CPU: Intel N100
                                      NIC: Intel i-226v 4 pcs
                                      RAM : 16 GB DDR5
                                      Disk: 128 GB NVMe
                                      Brgds, Archi

                                      1 Reply Last reply Reply Quote 2
                                      • A
                                        Antibiotic @mmetc
                                        last edited by

                                        @mmetc Hello after install 1.6.1 on 24.03 have this error
                                        level=error msg="while fetching bouncer info: ent: bouncer not found" ip=127.0.0.1

                                        pfSense plus 24.11 on Topton mini PC
                                        CPU: Intel N100
                                        NIC: Intel i-226v 4 pcs
                                        RAM : 16 GB DDR5
                                        Disk: 128 GB NVMe
                                        Brgds, Archi

                                        1 Reply Last reply Reply Quote 0
                                        • Dobby_D
                                          Dobby_
                                          last edited by Dobby_

                                          For pfSense+ 24.03_1 (amd64) I was following this steps;

                                          Getting started - Install CrowdSec on pfSense

                                          Please scroll down until you read the following (in a blue image)
                                          You will see it here below in the code block
                                          It is the install sequence (from top till down)

                                          # setenv IGNORE_OSVERSION yes
                                          # pkg add -f <link to abseil>
                                          # pkg add -f <link to re2>
                                          # pkg add -f <link to crowdsec-firewall-bouncer>
                                          # pkg add -f <link to crowdsec>
                                          # pkg add -f <link to pfSense-pkg-crowdsec>
                                          

                                          And under this page you find the latest pkgΒ΄s or files for your installation.
                                          pfSense-pkg-Crowdsec, click on assets (11) and the drop down menue is opening then right click on the shown links and past them in the following sequence inside of your pfSense console CLI.

                                          • Connect to your console
                                          • type in (8) for shell
                                          • and now all commands together (one after one) with the right link to the packages

                                          As an example for pfSense+ 24.03_1 (FreeBSD 15) amd64 hardware shown below:

                                          # setenv IGNORE_OSVERSION yes
                                          # pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/abseil-20230125.3.pkg
                                          # pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/re2-20240401.pkg
                                          # pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/crowdsec-firewall-bouncer-0.0.28_3.pkg
                                          # pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/crowdsec-1.6.1.pkg
                                          # pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/pfSense-pkg-crowdsec-0.1.3.pkg
                                          

                                          After installing it you may have a look under system > services > CrowdSec
                                          to ensure that all is right enabled. If not enable (activate) them by clicking
                                          on it, please click then at last on save

                                          CrowdSec1.jpg

                                          Now you should read the rest of the page
                                          Getting started - CrowdSec on pfSense
                                          to configure your installation, matching well to your network setup.

                                          And at least activate both services to make them running.

                                          CrowdSec2.jpg

                                          #~. @Dobby

                                          Turris Omnia - 4 Ports - 2 GB RAM / TurrisOS 7 Release (Btrfs)
                                          PC Engines APU4D4 - 4 Ports - 4 GB RAM / pfSense CE 2.7.2 Release (ZFS)
                                          PC Engines APU6B4 - 4 Ports - 4 GB RAM / pfSense+ (Plus) 24.03_1 Release (ZFS)

                                          1 Reply Last reply Reply Quote 2
                                          • bthovenB
                                            bthoven @mmetc
                                            last edited by

                                            @mmetc said in Crowdsec finally comming to pfSense:

                                            @provels you can download the archive I linked, there is the same content as the *pkg files but for freebsd 15. A new release with crowdsec 1.6.1 should be uploaded soon, I'll make sure to build the *pkg files with version 15

                                            I'm currently on version 1.6.0. To upgrade, should I execute only the following commands? Other than the re2 and pfsense packages, it appears that the remaining packages are the same version.

                                            setenv IGNORE_OSVERSION yes
                                            pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/re2-20240401.pkg
                                            pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.1/crowdsec-1.6.1.pkg
                                            

                                            Is there any breaking changes I should be aware of? I'm running pfSense CE 2.7.2....thanks.

                                            bthovenB 1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.