When can we expect the crowdsec plugin to be out of beta and included in the OPNSense repo? 22.7?

I just followed the blog to install crowdsec on Opnsense 22.1.8, but can't seem to get either crowdsec or firewall bouncer to run. They're both enabled. Sometimes, firewall bouncer will ✅, but will ❌ after a few minutes. Anybody know what might be going on or where logs are located?

@mention - “Hey!. Not sure if this is the right place to ask but feel free to tell me otherwise :P. I'm running the OPNSense bouncer and is connected to a remote crowdsec install as the LAPI. If I go to `Services -> Crowdsec -> Overview -> Decisions` in OPNSense I can see it is correctly pulling up the decisions from the LAPI and if I go to `Firewall -> Diagnosis -> Aliases` and look up the crowdsec aliases I can see the proper IPs being added/removed there. The problem I'm facing is that if it is an IPv4 address then it is correctly banned and OPNSense properly stops it at the firewall before even reaching my reverse proxy or other services but if it is an IPv6 address it just lets it right through regardless of what the decisions. Even when I see that very same IPv6 address listed in the blocked alias. Any idea where I can start troubleshooting this?.” Please accept my apologies that your message got deleted. Our bot deleted the message as it was classed as line spam.

Greetings!

So Im getting this inside the logs ```WARN[16-05-2022 04:11:27 PM] Crowdsec is not the latest version. Current version is 'v1.3.3' and the latest stable version is 'v1.3.4'. Please update it! WARN[16-05-2022 04:11:27 PM] As a result, you will not be able to use parsers/scenarios/collections added to Crowdsec Hub after CrowdSec v1.3.4 INFO[16-05-2022 04:11:27 PM] Wrote new 355182 bytes index to /usr/local/etc/crowdsec/hub/.index.json``` however there doesn't seem to be anything to update https://github.com/crowdsecurity/opnsense-plugin-crowdsec/releases

Are there any plans on adding more bouncers on FreeBSD? Currently there‘s only the firewall bouncer. Custom bouncer, Nginx and traefik would would be great additions!

Crowdsec plugin was merged to opnsense earlier today. Potentially releasing in 22.1.7?

Hello -- I want to thank the team and all for this excellent work. It appears to be a project that has an excellent future. I do have a question related to an issue with Crowdsec: It installed it on a fresh OPNsense VM in my homelab. I worked alright for a while, it seemed. Days later the service was not running, per the dashboard. When I tried to start it there, it triggered an action but failed to start. Then I found the Console and installed it fine, enable the web-cloud access, all fine. There, it says the bouncer has been inactive five days. Do logs go to syslog? Advice?

to parse pf logs, create a rc script with daemon (e.g. inside a jail): ```sh /usr/sbin/daemon -p ${pidfile} -S -T pf \ tcpdump -Z nobody -l -n -e -i pflog0 ${tcpdumplogd_filter} ``` then log them like so: ```yaml filter: "evt.Parsed.program == 'pf'" name: mypf-logs description: "Parse packet filter logs" # debug: true format: 2.0 pattern_syntax: PF_UDP_DATA: 'UDP' PF_TCP_DATA: 'Flags \[%{WORD:tcp_flags}\], seq %{INT:sequence_number}, win %{INT:tcp_window}(, options \[%{GREEDYDATA:tcp_options}\])?' PF_PROTOCOL_DATA: '(%{PF_TCP_DATA}|%{PF_UDP_DATA}), length %{INT:data_length}' PF_IP_DATA: '%{IP:source_ip}\.%{INT:source_port} > %{IP:dest_ip}\.%{INT:dest_port}' PF_LOG_DATA: '%{GREEDYDATA:timestamp} rule %{INT:rule}/%{INT:sub_rule}\(%{WORD:reason}\): %{WORD:action} %{WORD:direction} on %{DATA:iface}' PF_LOG: '%{PF_LOG_DATA}: %{PF_IP_DATA}: %{PF_PROTOCOL_DATA}' grok: pattern: "%{PF_LOG}" apply_on: message statics: - meta: log_type value: pf --- filter: "evt.Meta.log_type == 'pf' and evt.Parsed.action == 'block'" name: my-pf-logs-drop description: "Identify dropped packets" onsuccess: next_stage statics: - meta: service value: tcp - meta: log_type value: pf_drop - meta: source_ip expression: "evt.Parsed.source_ip" ``` (based on https://hub.crowdsec.net/author/firewallservices/configurations/pf-logs, which only works with pfsense log layout) and react e.g. with https://hub.crowdsec.net/author/firewallservices/configurations/pf-scan-multi_ports

great news for opnsense!