plugins
plugins copied to clipboard
Add additional Crowdsec bouncers (Caddy, nginx, HaProxy)
Important notices Before you add a new report, we ask you kindly to acknowledge the following:
- [X ] I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
- [ X] I have searched the existing issues, open and closed, and I'm convinced that mine is new.
- [ X] When the request is meant for an existing plugin, I've added its name to the title.
Is your feature request related to a problem? Please describe. OPNsense currently only supports the crowdsec-firewall-bouncer remediation component (bouncer). This works great for blocking direct traffic to the firewall but does not allow Layer 7 blocking. For example, I use Cloudflare proxy and my WAN only accepts inbound from the Cloudflare IP ranges (https://www.cloudflare.com/ips/). That's all the firewall sees so it can't block by the proxy protocol or x-forwarded-for header that caddy, nginx, and haproxy would see.
Describe the solution you'd like I would like to see these additional bouncers added as installation candidates in OPNsense.
Describe alternatives you've considered I have considered moving nginx off of my OPNsense box and running it in linux just to have this functionality but would ideally like to keep it where it's at.
I could also set up Crowdsec and the Bouncers on each one of my services but would prefer to have it right on the reverse proxy.
I have also looked into used the Crowdsec Blocklist Mirror bouncer but nginx does not allow the use of a file location in the IP ACL section and I would need to manually change the formatting to meet nginx requirements.
Additional context Crowdsec resources for the mentioned bouncers: Caddy Bouncer - https://app.crowdsec.net/hub/author/hslatman/remediation-components/caddy-crowdsec-bouncer nginx Bouncer - https://docs.crowdsec.net/u/bouncers/nginx Haproxy Bouncer - https://docs.crowdsec.net/u/bouncers/haproxy