CrowdSec: The Collaborative IPS That Blocks Attackers Before They Reach You

Every server exposed to the internet gets hammered. SSH brute-force starts within minutes. Web crawlers probe for admin panels and CVEs. Port scanners map exposure. The default posture — fail2ban a few IPs — stops working at scale. CrowdSec is the modern answer.

It watches logs and HTTP traffic for malicious behavior, identifies attacking IPs, and feeds decisions to bouncers that block at the firewall, reverse proxy, or Kubernetes ingress. The differentiator: the community blocklist. 200,000+ installations share attack signals globally. When an IP attacks someone else, you block it before it reaches you.

What CrowdSec is

CrowdSec is an open-source crowdsourced IPS and WAF. Written in Go, MIT licensed, currently v1.7.8 (May 2026). 14,100+ GitHub stars. Used by 200,000+ installations across VMs, Docker stacks, Kubernetes, and bare metal.

Three layers:

• Security Engine — reads logs and HTTP requests, matches behavioral scenarios, generates decisions (ban this IP for 4 hours)
• Bouncers — enforce decisions at firewall, reverse proxy, CDN, or application level
• Central API + Community Blocklist — shares signals, downloads the curated global blocklist

"Detect Here, Remedy There" — one Security Engine can protect multiple services through multiple bouncers simultaneously.

Detection — scenarios and parsers

Logs flow through: Acquisition → Parsers → Scenarios. The Hub provides parsers for nginx, sshd, Apache, postfix, MySQL, and dozens more. Built-in scenarios:

• crowdsecurity/ssh-bf — SSH brute force (5 failed auth in 20s → ban)
• crowdsecurity/http-crawl-non_statics — probing for sensitive paths
• crowdsecurity/wordpress-bf — WordPress wp-login brute force
• crowdsecurity/http-probing — systematic path scanning
• crowdsecurity/http-bad-user-agent — known malicious user agents

AppSec — WAF component

CrowdSec's AppSec component inspects HTTP requests forwarded from Nginx, Traefik, HAProxy, or Caddy for SQL injection, XSS, path traversal, CVE exploitation patterns (105,000+ rules), and virtual patching. Supports ModSecurity SecLang rules — teams migrating from ModSecurity can bring existing rule sets. OWASP CRS compatible.

Community blocklist

Every enrolled CrowdSec instance shares attack signals. Signals are aggregated and validated — IPs appearing across enough installations join the Community Blocklist. Every engine downloads this and blocks proactively. CrowdSec claims this blocks threats 7–60 days ahead of traditional vendors. Free tier covers the most active attackers; paid tiers add premium feeds and enriched CTI.

Bouncers

• cs-firewall-bouncer — iptables/nftables, blocks at kernel level
• cs-nginx-bouncer — Nginx Lua module, serves 403 or captcha
• cs-traefik-bouncer — Traefik middleware plugin
• cs-cloudflare-bouncer — pushes decisions to Cloudflare via API
• cs-aws-waf-bouncer — pushes to AWS WAF IP sets
• cs-kubernetes-bouncer — Kubernetes network policy enforcement

Docker Compose deployment

services:
  crowdsec:
    image: crowdsecurity/crowdsec:latest
    restart: unless-stopped
    environment:
      COLLECTIONS: "crowdsecurity/linux crowdsecurity/traefik"
    volumes:
      - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
      - ./crowdsec/db:/var/lib/crowdsec/data
      - /var/log:/var/log:ro

  traefik-bouncer:
    image: fbonalair/traefik-crowdsec-bouncer:latest
    restart: unless-stopped
    environment:
      CROWDSEC_BOUNCER_API_KEY: ${CROWDSEC_BOUNCER_KEY}
      CROWDSEC_AGENT_HOST: crowdsec:8080

acquis.yaml configures log sources:

filenames:
  - /var/log/traefik/*.log
labels:
  type: traefik
---
filenames:
  - /var/log/auth.log
labels:
  type: syslog

Enroll in the free Console: cscli console enroll <token>. Key CLI commands:

cscli decisions list                           # active bans
cscli decisions add --ip 1.2.3.4 --duration 24h
cscli collections install crowdsecurity/wordpress
cscli metrics

For Kubernetes: official Helm chart deploys the Security Engine as a DaemonSet, bouncer as ingress middleware, decisions synchronized cluster-wide.

CrowdSec vs fail2ban

• Community blocklist — blocks known attackers globally before they hit you; fail2ban only reacts to your own logs
• Bouncer model — enforce at any layer; fail2ban is coupled to iptables
• AppSec/WAF — HTTP request inspection; fail2ban reads logs only
• Multi-machine — shared decision database; fail2ban is per-machine

Who it's for

Good fit: any internet-exposed server needing more than fail2ban; Traefik Docker stacks; Kubernetes clusters; teams wanting community threat intel without commercial feeds.

Not ideal: enterprise WAF governance with compliance reporting; air-gapped environments where sharing signals externally is not acceptable.

My take

The community blocklist alone justifies the setup overhead — blocking known attackers proactively is qualitatively different from reacting after they've started. For Traefik Docker stacks, the integration is seamless. The free tier (MIT Security Engine + Community Blocklist) is genuinely useful without any commercial upgrade, and the 200,000+ installation network is a real moat: the more people run it, the better the blocklist gets.