Via the terminal with `sudo cscli

Via the terminal with sudo cscli decisions add -i 173.80.198.81 -R http -d 20m

47 Replies

I'm confused what this has to do with Cloudflare then?

I'm using crowdsec through cloudflare tunnel for my nextcloud instance that I'm self hosting Via the crowdsec-cloudflare-bouncer

fleabeardOP•3y ago

I believe I have enough space in my dashboard to allow banning for crowdsec purposes.

Cyb3r-Jak3•3y ago

Managed challenge doesn't mean that connections are blocked. It means Cloudflare checks the browser but will still let it through if it passes the challenge

fleabeardOP•3y ago

Oh, ok. So that means Cloudflare wouldn't ever do the blocking. My webserver would need to do that?

Cyb3r-Jak3•3y ago

Cloudflare will block the connection if it fails the challenge. If you want to block connections rather than challenge change default_action: managed_challenge to default_action: block

fleabeardOP•3y ago

Sorry, which file would I need to update that in? Oh, I see where. Would you say this is sufficient? https://hastebin.com/tuxamelera.yaml

Cyb3r-Jak3•3y ago

You are overriding the action in the zone section

    zones:
    - actions: 
      - managed_challenge # valid choices are either of managed_challenge, js_challenge, block
      zone_id: 7fdd9d866a2667...............

    zones:
    - actions: 
      - managed_challenge # valid choices are either of managed_challenge, js_challenge, block
      zone_id: 7fdd9d866a2667...............

Unless that is expected, you want to change to block as well

fleabeardOP•3y ago

Boy... right there in black & white lol. Thank you. I will try this now. Ok, made the changes to this now: https://hastebin.com/orogozaqet.yaml - Tried another test ban with sudo cscli decisions add -i 173.80.198.81 -R http -d 20m - but I'm still able to reach my website after a few refreshes 😦

Cyb3r-Jak3•3y ago

I would check the firewall rule in Cloudflare WAF to see if it has changed from managed_challenge there

fleabeardOP•3y ago

Looks like it's managed_challenge there :

Cyb3r-Jak3•3y ago

Try just changing it in the WAF rule

fleabeardOP•3y ago

I think I updated it correctly in the WAF rule?

Cyb3r-Jak3•3y ago

Yeah that should do it

fleabeardOP•3y ago

Thanks, I saved it and restarted my server. I re-banned the IP and tried accessing the site and it still loads the page 😦

Cyb3r-Jak3•3y ago

Well that's weird. Some sanity checks 1. Can you see if the IP actually makes it to the list. 2. Does anything appear in the WAF log that shows the IP being allowed through

fleabeardOP•3y ago

If I tail my nextcloud.log I can see the IP address hitting the server:

{"reqId":"V9BXkrLybotWQUnGeNCX","level":2,"time":"2022-10-15T15:56:17+00:00","remoteAddr":"173.80.198.81","user":"--","app":"no app in context","method":"POST","url":"/index.php/login","message":"Login failed: test (Remote IP: 173.80.198.81)","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/105.0.1343.53","version":"24.0.6.1","data":[]}

{"reqId":"V9BXkrLybotWQUnGeNCX","level":2,"time":"2022-10-15T15:56:17+00:00","remoteAddr":"173.80.198.81","user":"--","app":"no app in context","method":"POST","url":"/index.php/login","message":"Login failed: test (Remote IP: 173.80.198.81)","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/105.0.1343.53","version":"24.0.6.1","data":[]}

tbh, I'm not entirely sure how to check the WAF log.

Cyb3r-Jak3•3y ago

https://dash.cloudflare.com/?to=/:account/:zone/security

fleabeardOP•3y ago

Ok, I don't appear to see anything hit my WAF firewall logs since yesterday.

fleabeardOP•3y ago

Previous 30 mins:

Cyb3r-Jak3•3y ago

Alright looks like the IP is never making it to the list then. Might want to check the logs for the application that adds IPs to the list to make sure there are no errors there

fleabeardOP•3y ago

Ok, not really seeing anything in my /var/log/crowdsec-cloudflare-bouncer.log file. I'm assuming this is the application that adds IPs to the list. Quick question about the block rule. Is that function going away in the future for managed_challenge to take it's place?

Cyb3r-Jak3•3y ago

Block isn't going away from the Cloudflare side.

fleabeardOP•3y ago

Oh, for some reason the team over at Crowdsec thought it was going away when I reached out for help on it today lol

Cyb3r-Jak3•3y ago

It might be going away on crowdsec side but not Cloudflare

fleabeardOP•3y ago

Do you know what would be causing this? I don't think my list is full.

sudo systemctl status crowdsec-cloudflare-bouncer
× crowdsec-cloudflare-bouncer.service - CrowdSec bouncer for cloudflare
     Loaded: loaded (/etc/systemd/system/crowdsec-cloudflare-bouncer.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Sun 2022-10-16 15:14:06 UTC; 1s ago
    Process: 531 ExecStart=/usr/bin/crowdsec-cloudflare-bouncer -c /etc/crowdsec/bouncers/crowdsec-cloudflare-bouncer.yaml (code=exited, status=1/FAILURE)
   Main PID: 531 (code=exited, status=1/FAILURE)
        CPU: 98ms

Oct 16 15:14:05 Nextcloud systemd[1]: Started CrowdSec bouncer for cloudflare.
Oct 16 15:14:06 Nextcloud crowdsec-cloudflare-bouncer[531]: time="16-10-2022 15:14:06" level=fatal msg="This account is at the maximum number of lists (10019)"

sudo systemctl status crowdsec-cloudflare-bouncer
× crowdsec-cloudflare-bouncer.service - CrowdSec bouncer for cloudflare
     Loaded: loaded (/etc/systemd/system/crowdsec-cloudflare-bouncer.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Sun 2022-10-16 15:14:06 UTC; 1s ago
    Process: 531 ExecStart=/usr/bin/crowdsec-cloudflare-bouncer -c /etc/crowdsec/bouncers/crowdsec-cloudflare-bouncer.yaml (code=exited, status=1/FAILURE)
   Main PID: 531 (code=exited, status=1/FAILURE)
        CPU: 98ms

Oct 16 15:14:05 Nextcloud systemd[1]: Started CrowdSec bouncer for cloudflare.
Oct 16 15:14:06 Nextcloud crowdsec-cloudflare-bouncer[531]: time="16-10-2022 15:14:06" level=fatal msg="This account is at the maximum number of lists (10019)"

fleabeardOP•3y ago

Cyb3r-Jak3•3y ago

It's trying to create a new list and not append to current list

fleabeardOP•3y ago

Ah okay, I may need to revisit my crowdsec-cloudflare-bouncer.yaml to make sure it's pointing to the right list?

Cyb3r-Jak3•3y ago

It depends if you can manually point to the list ID. If not then you need to delete the current list

fleabeardOP•3y ago

Hmm, there appears to be this in the bouncer.yaml ip_list_prefix: crowdsec_block - the name of my current list is crowdsec_block on the CF dashboard:

Cyb3r-Jak3•3y ago

Yeah but that's just the name

fleabeardOP•3y ago

Ok, I see what you're saying now. It does have a value for accounts: - id: <long sting> - Do you know where I can find this id?

Cyb3r-Jak3•3y ago

Account and Zone ID can be found here https://dash.cloudflare.com/?to=/:account/:zone scroll down on the right

fleabeardOP•3y ago

Ok, good. Mine is set to the correct Zone ID and Account ID already.

Cyb3r-Jak3•3y ago

Yeah I think it lost the list ID

fleabeardOP•3y ago

Think deleting the list is the fix for that?

Cyb3r-Jak3•3y ago

Yeah it would be

fleabeardOP•3y ago

Thanks man, I'll give that a try 🙂

fleabeardOP•3y ago

Welp! lol

fleabeardOP•3y ago

I'm just gonna create a new list Oh, I can't since I'm tied to only 1 list it seems. I managed to figure out how to delete it 🙂 So, which should I make first. The list or the firewall rule?

Cyb3r-Jak3•3y ago

Delete the firewall rule then the list and restart the bouncer service so it makes the rule and list again

fleabeardOP•3y ago

Oh, that may have been where I goofed earlier as I was creating the list/rules manually from the dashboard (or one or the other as it were) It's working now! Thank you so much for your help, friend!

fleabeardOP•3y ago

Sorry, got one more question for you as I've been documenting all steps to see if I can replicate things for another website. I'm back to getting the error level=fatal msg="This account is at the maximum number of lists (10019)" when viewing sudo systemctl status crowdsec-cloudflare-bouncer - There actually isn't any firewall rules showing on the CF dashboard for this domain, so I'm a bit confused why it would be saying this?

Cyb3r-Jak3•3y ago

This is the lists page https://discord.com/channels/595317990191398933/1030884977094701116/1031225690697256971 And lists are per account not per zone

fleabeardOP•3y ago

Oh, okay. I see! Thank you! Is there a way to obtain more lists? Like, can an additional list be purchased?

Cyb3r-Jak3•3y ago

I don't think you can buy lists specifically but the pro plan gets 10 IP lists

Gaming

Programming

Via the terminal with `sudo cscli