Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Crowdsec finally comming to pfSense

    Scheduled Pinned Locked Moved pfSense Packages
    68 Posts 19 Posters 13.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Antibiotic @provels
      last edited by

      @provels Did you test last one 1.6.1_1 released 9 hours ago?

      pfSense plus 24.11 on Topton mini PC
      CPU: Intel N100
      NIC: Intel i-226v 4 pcs
      RAM : 16 GB DDR5
      Disk: 128 GB NVMe
      Brgds, Archi

      provelsP 1 Reply Last reply Reply Quote 0
      • provelsP
        provels @Antibiotic
        last edited by

        @Antibiotic No, I can wait. You first!

        Peder

        MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
        BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

        A 2 Replies Last reply Reply Quote 0
        • A
          Antibiotic @provels
          last edited by

          @provels Any ideas when will come to official? or even planning to come?As i know a huge problem was with a use of ram disk. I do not know, they are resolve this problem or not!

          pfSense plus 24.11 on Topton mini PC
          CPU: Intel N100
          NIC: Intel i-226v 4 pcs
          RAM : 16 GB DDR5
          Disk: 128 GB NVMe
          Brgds, Archi

          provelsP 1 Reply Last reply Reply Quote 0
          • A
            Antibiotic @provels
            last edited by

            @provels said in Crowdsec finally comming to pfSense:

            No, I can wait. You first!

            O_O)))

            pfSense plus 24.11 on Topton mini PC
            CPU: Intel N100
            NIC: Intel i-226v 4 pcs
            RAM : 16 GB DDR5
            Disk: 128 GB NVMe
            Brgds, Archi

            1 Reply Last reply Reply Quote 0
            • provelsP
              provels @Antibiotic
              last edited by

              @Antibiotic No idea. I hadn't even heard of it before this thread.

              Peder

              MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
              BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

              1 Reply Last reply Reply Quote 0
              • O
                ong1234
                last edited by

                Yes, would be great if it is 'officially' supported by Pfsense.

                1 Reply Last reply Reply Quote 1
                • A
                  Antibiotic
                  last edited by

                  Hello, any info about official support of this package?

                  pfSense plus 24.11 on Topton mini PC
                  CPU: Intel N100
                  NIC: Intel i-226v 4 pcs
                  RAM : 16 GB DDR5
                  Disk: 128 GB NVMe
                  Brgds, Archi

                  1 Reply Last reply Reply Quote 0
                  • B
                    btspce
                    last edited by

                    We are also waiting for the package to land in the main repo. Any ETA ?

                    A 1 Reply Last reply Reply Quote 0
                    • A
                      Antibiotic @btspce
                      last edited by

                      @btspce As I know a problem was with a RAM disk to use.
                      No any idea, how is going now)))

                      pfSense plus 24.11 on Topton mini PC
                      CPU: Intel N100
                      NIC: Intel i-226v 4 pcs
                      RAM : 16 GB DDR5
                      Disk: 128 GB NVMe
                      Brgds, Archi

                      1 Reply Last reply Reply Quote 0
                      • wgstarksW
                        wgstarks
                        last edited by

                        Since Netgate recommends uninstalling 3rd party plugins prior to updating pfsense I’m wondering if that process is documented anywhere? I’ve seen the install docs but maybe I just missed the uninstall docs.

                        Box: SG-4200

                        provelsP 1 Reply Last reply Reply Quote 0
                        • provelsP
                          provels @wgstarks
                          last edited by

                          @wgstarks From https://doc.crowdsec.net/docs/getting_started/install_crowdsec_pfsense

                          # pkg remove pfSense-pkg-crowdsec crowdsec crowdsec-firewall-bouncer
                          # rm -rf /usr/local/etc/crowdsec /usr/local/etc/rc.conf.d/crowdsec*
                          # rm -rf /var/db/crowdsec /var/log/crowdsec* /var/run/crowdsec*
                          

                          Peder

                          MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                          BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                          wgstarksW 1 Reply Last reply Reply Quote 2
                          • wgstarksW
                            wgstarks @provels
                            last edited by

                            @provels said in Crowdsec finally comming to pfSense:

                            @wgstarks From https://doc.crowdsec.net/docs/getting_started/install_crowdsec_pfsense

                            # pkg remove pfSense-pkg-crowdsec crowdsec crowdsec-firewall-bouncer
                            # rm -rf /usr/local/etc/crowdsec /usr/local/etc/rc.conf.d/crowdsec*
                            # rm -rf /var/db/crowdsec /var/log/crowdsec* /var/run/crowdsec*
                            

                            Thanks. I just found the doc you linked. Probably should have done the google search first.😁

                            Box: SG-4200

                            1 Reply Last reply Reply Quote 0
                            • wgstarksW
                              wgstarks
                              last edited by wgstarks

                              This install didn't work for me using the doc linked just above. I got several errors regarding the FreeBSD version-

                              [24.03-RELEASE][root@heimdall.dahoney.me]/root: pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.2/crowdsec-firewall-bouncer-0.0.28_3.pkg
                              Fetching crowdsec-firewall-bouncer-0.0.28_3.pkg: 100%    4 MiB   3.8MB/s    00:01    
                              Installing crowdsec-firewall-bouncer-0.0.28_3...
                              pkg: wrong architecture: FreeBSD:14:amd64 instead of FreeBSD:15:amd64
                              Extracting crowdsec-firewall-bouncer-0.0.28_3: 100%
                              
                              

                              And then when I try the enroll command I get command not found-

                              [24.03-RELEASE][root@heimdall.dahoney.me]/root: sudo cscli console enroll -e context clzeha7*****************uikulpm
                              sudo: Command not found.
                              [24.03-RELEASE][root@heimdall.dahoney.me]/root: cscli console enroll -e context clzeha7*****************uikulpm
                              cscli: Command not found.
                              
                              

                              The 4200 is running pfSense+ 24.03 if that matters.

                              Update: Installed the SUDO package and now I get this-

                              [24.03-RELEASE][root@heimdall.dahoney.me]/root: sudo cscli console enroll -e context clzeha7******************uikulpm
                              WARN can't load CAPI credentials from '/usr/local/etc/crowdsec/online_api_credentials.yaml' (missing login field) 
                              FATA the Central API (CAPI) must be configured with 'cscli capi register' 
                              

                              Box: SG-4200

                              M 1 Reply Last reply Reply Quote 0
                              • JonathanLeeJ
                                JonathanLee
                                last edited by JonathanLee

                                What is so great about Crowdsec? Is this the same company that Blackrock investing purchased? Is this also the company responsible for the issue with windows updates? Is this part of Solarwinds and the security issues they had and or Fire eye?

                                Long story short what improves within pfSense with this software? Azure use? Cloud platform?

                                What’s the background with this company? Is it a subsidiary of another company? Please also explain if Blackrock invested in this business, I tend to avoid anything that Blackrock gets involved in as they have a history of destroying companies and taking patents and other intellectual property rights away from them in the process. I have seen this a number of times with tech companies and Blackrock investments, way to much to say it is a fluke anymore.

                                So why use Crowdsec? Why are they not on the main repo?

                                Make sure to upvote

                                M wgstarksW 2 Replies Last reply Reply Quote 0
                                • M
                                  mcury @JonathanLee
                                  last edited by

                                  @JonathanLee Youtube Video

                                  I think this video explains how it works, there is no relation with Crowdstrike.

                                  dead on arrival, nowhere to be found.

                                  1 Reply Last reply Reply Quote 3
                                  • wgstarksW
                                    wgstarks @JonathanLee
                                    last edited by wgstarks

                                    @JonathanLee said in Crowdsec finally comming to pfSense:

                                    What is so great about Crowdsec? Is this the same company that Blackrock investing purchased? Is this also the company responsible for the issue with windows updates? Is this part of Solarwinds and the security issues they had and or Fire eye?

                                    Long story short what improves within pfSense with this software? Azure use? Cloud platform?

                                    What’s the background with this company? Is it a subsidiary of another company? Please also explain if Blackrock invested in this business, I tend to avoid anything that Blackrock gets involved in as they have a history of destroying companies and taking patents and other intellectual property rights away from them in the process. I have seen this a number of times with tech companies and Blackrock investments, way to much to say it is a fluke anymore.

                                    So why use Crowdsec? Why are they not on the main repo?

                                    I believe you have them mistaken with CrowdStrike.

                                    Box: SG-4200

                                    1 Reply Last reply Reply Quote 3
                                    • w0wW
                                      w0w
                                      last edited by

                                      The fact that CrowdSec is still not available in the pfSense repository says a lot. It probably suggests that there are some problems with either maintaining its code or its implementation.

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mmetc @wgstarks
                                        last edited by

                                        @wgstarks said in Crowdsec finally comming to pfSense:

                                        [24.03-RELEASE][root@heimdall.dahoney.me]/root: pkg add -f https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.2/crowdsec-firewall-bouncer-0.0.28_3.pkg
                                        Fetching crowdsec-firewall-bouncer-0.0.28_3.pkg: 100%    4 MiB   3.8MB/s    00:01    
                                        Installing crowdsec-firewall-bouncer-0.0.28_3...
                                        pkg: wrong architecture: FreeBSD:14:amd64 instead of FreeBSD:15:amd64
                                        Extracting crowdsec-firewall-bouncer-0.0.28_3: 100%
                                        
                                        

                                        If you click "Assets" on the release page you will find the archive for your version

                                        https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases/download/v0.1.3-1.6.2/freebsd-15-amd64.tar

                                        Download, untar and then pkg install in the right order.

                                        wgstarksW 2 Replies Last reply Reply Quote 0
                                        • B
                                          buixor
                                          last edited by

                                          Our PR has been sitting for the last 9 months or so without feedback: https://github.com/pfsense/FreeBSD-ports/pull/1311

                                          If anybody from the project has a chance to provide us feedback as to what we need to do or improve to see it being merged, don't hesitate to reach out!

                                          1 Reply Last reply Reply Quote 1
                                          • wgstarksW
                                            wgstarks @mmetc
                                            last edited by

                                            @mmetc
                                            Do I need to uninstall the currently installed version first?

                                            Box: SG-4200

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.