feat: Add secubox-app-crowdsec-bouncer wrapper package (v0.0.31)
Create SecuBox wrapper for CrowdSec Firewall Bouncer with enhanced automation and configuration for OpenWrt routers. Package Structure: - Lightweight wrapper depending on upstream crowdsec-firewall-bouncer - No compilation needed (PKG_ARCH=all) - Enhanced UCI configuration with router-optimized defaults - Automatic bouncer registration via uci-defaults script Files Created: - Makefile: OpenWrt package definition with dependencies - README.md: Comprehensive documentation (configuration, troubleshooting) - files/crowdsec-bouncer.config: Enhanced UCI config template - files/crowdsec-bouncer.defaults: Auto-registration and setup script Features: - Auto-detection of LAN/WAN interfaces - Automatic API key generation and registration with CrowdSec LAPI - nftables kernel module loading - Configures IPv4/IPv6 filtering on INPUT/FORWARD chains - Integrates with existing luci-app-crowdsec-dashboard Configuration Highlights: - Default interfaces: br-lan, eth1 - Logging enabled by default - Update frequency: 10s - Deny action: drop - Both IPv4 and IPv6 enabled Dependencies: - crowdsec-firewall-bouncer (upstream from feeds/packages) - crowdsec (SecuBox package) - nftables - uci + libuci Note: Build requires rsync for OpenWrt SDK perl dependency. Package ready for integration once build environment is complete. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
parent
dcfa5bf799
commit
9b59b55c9e
43
package/secubox/secubox-app-crowdsec-bouncer/Makefile
Normal file
43
package/secubox/secubox-app-crowdsec-bouncer/Makefile
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
include $(TOPDIR)/rules.mk
|
||||||
|
|
||||||
|
PKG_NAME:=secubox-app-crowdsec-bouncer
|
||||||
|
PKG_VERSION:=0.0.31
|
||||||
|
PKG_RELEASE:=1
|
||||||
|
PKG_ARCH:=all
|
||||||
|
PKG_MAINTAINER:=CyberMind Studio <contact@cybermind.fr>
|
||||||
|
PKG_LICENSE:=MIT
|
||||||
|
|
||||||
|
include $(INCLUDE_DIR)/package.mk
|
||||||
|
|
||||||
|
define Package/secubox-app-crowdsec-bouncer
|
||||||
|
SECTION:=net
|
||||||
|
CATEGORY:=Network
|
||||||
|
PKGARCH:=all
|
||||||
|
SUBMENU:=SecuBox Apps
|
||||||
|
TITLE:=SecuBox CrowdSec Firewall Bouncer wrapper
|
||||||
|
DEPENDS:=+uci +libuci +crowdsec-firewall-bouncer +crowdsec +nftables
|
||||||
|
endef
|
||||||
|
|
||||||
|
define Package/secubox-app-crowdsec-bouncer/description
|
||||||
|
Enhanced wrapper for CrowdSec Firewall Bouncer with automatic configuration
|
||||||
|
and registration for SecuBox-powered OpenWrt routers. Provides nftables-based
|
||||||
|
IP blocking from CrowdSec decisions with automatic API key management and
|
||||||
|
interface detection.
|
||||||
|
endef
|
||||||
|
|
||||||
|
define Package/secubox-app-crowdsec-bouncer/conffiles
|
||||||
|
/etc/config/crowdsec
|
||||||
|
endef
|
||||||
|
|
||||||
|
define Build/Compile
|
||||||
|
endef
|
||||||
|
|
||||||
|
define Package/secubox-app-crowdsec-bouncer/install
|
||||||
|
$(INSTALL_DIR) $(1)/etc/config
|
||||||
|
$(INSTALL_CONF) ./files/crowdsec-bouncer.config $(1)/etc/config/crowdsec-bouncer
|
||||||
|
|
||||||
|
$(INSTALL_DIR) $(1)/etc/uci-defaults
|
||||||
|
$(INSTALL_BIN) ./files/crowdsec-bouncer.defaults $(1)/etc/uci-defaults/99_crowdsec-bouncer
|
||||||
|
endef
|
||||||
|
|
||||||
|
$(eval $(call BuildPackage,secubox-app-crowdsec-bouncer))
|
||||||
369
package/secubox/secubox-app-crowdsec-bouncer/README.md
Normal file
369
package/secubox/secubox-app-crowdsec-bouncer/README.md
Normal file
@ -0,0 +1,369 @@
|
|||||||
|
# SecuBox CrowdSec Firewall Bouncer
|
||||||
|
|
||||||
|
Enhanced wrapper package for CrowdSec Firewall Bouncer with automatic configuration and registration for SecuBox-powered OpenWrt routers.
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
The CrowdSec Firewall Bouncer is a component that blocks malicious IP addresses detected by CrowdSec using nftables firewall rules. This package wraps the upstream `crowdsec-firewall-bouncer` with SecuBox-specific enhancements:
|
||||||
|
|
||||||
|
- **Automatic API key registration** with CrowdSec LAPI
|
||||||
|
- **Interface auto-detection** for LAN/WAN
|
||||||
|
- **Pre-configured defaults** optimized for routers
|
||||||
|
- **UCI configuration** for easy management via LuCI
|
||||||
|
- **Seamless integration** with SecuBox CrowdSec dashboard
|
||||||
|
|
||||||
|
## Features
|
||||||
|
|
||||||
|
- **nftables-based blocking**: Uses modern nftables instead of legacy iptables
|
||||||
|
- **IPv4 and IPv6 support**: Blocks threats on both protocol versions
|
||||||
|
- **Real-time updates**: Polls CrowdSec LAPI for new decisions (default: 10s)
|
||||||
|
- **Flexible filtering**: Configure INPUT and FORWARD chain filtering
|
||||||
|
- **Logging support**: Optional logging of blocked connections
|
||||||
|
- **Multiple deny actions**: drop, reject, or tarpit malicious traffic
|
||||||
|
- **Interface-based filtering**: Specify which interfaces to protect
|
||||||
|
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
- `crowdsec` - CrowdSec detection engine (must be installed and running)
|
||||||
|
- `crowdsec-firewall-bouncer` - Upstream firewall bouncer binary
|
||||||
|
- `nftables` - Modern Linux firewall
|
||||||
|
- Working CrowdSec Local API (LAPI) on port 8080
|
||||||
|
|
||||||
|
## Installation
|
||||||
|
|
||||||
|
### Via opkg
|
||||||
|
|
||||||
|
```bash
|
||||||
|
opkg update
|
||||||
|
opkg install secubox-app-crowdsec-bouncer
|
||||||
|
```
|
||||||
|
|
||||||
|
### From Source
|
||||||
|
|
||||||
|
```bash
|
||||||
|
./secubox-tools/local-build.sh build secubox-app-crowdsec-bouncer
|
||||||
|
opkg install /path/to/secubox-app-crowdsec-bouncer_*.ipk
|
||||||
|
```
|
||||||
|
|
||||||
|
## Initial Configuration
|
||||||
|
|
||||||
|
The package automatically configures itself on first install via the UCI defaults script:
|
||||||
|
|
||||||
|
1. **Merges configuration** into `/etc/config/crowdsec`
|
||||||
|
2. **Detects network interfaces** (LAN/WAN)
|
||||||
|
3. **Registers bouncer** with CrowdSec LAPI
|
||||||
|
4. **Generates API key** and stores in UCI
|
||||||
|
5. **Loads nftables modules**
|
||||||
|
|
||||||
|
After installation, you need to:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Enable the bouncer
|
||||||
|
uci set crowdsec.bouncer.enabled='1'
|
||||||
|
uci commit crowdsec
|
||||||
|
|
||||||
|
# Start the service
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer enable
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer start
|
||||||
|
```
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
All configuration is done via UCI at `/etc/config/crowdsec` in the `bouncer` section:
|
||||||
|
|
||||||
|
```uci
|
||||||
|
config bouncer
|
||||||
|
option enabled '1' # Enable/disable bouncer
|
||||||
|
option ipv4 '1' # Enable IPv4 filtering
|
||||||
|
option ipv6 '1' # Enable IPv6 filtering
|
||||||
|
option api_url 'http://127.0.0.1:8080/' # CrowdSec LAPI URL
|
||||||
|
option api_key '<generated>' # API key (auto-generated)
|
||||||
|
option update_frequency '10s' # How often to poll for decisions
|
||||||
|
option priority '4' # nftables hook priority
|
||||||
|
option deny_action 'drop' # Action: drop|reject|tarpit
|
||||||
|
option deny_log '1' # Log blocked connections
|
||||||
|
option log_prefix 'CrowdSec: ' # Kernel log prefix
|
||||||
|
option log_level 'info' # Log level
|
||||||
|
option filter_input '1' # Filter INPUT chain
|
||||||
|
option filter_forward '1' # Filter FORWARD chain
|
||||||
|
option chain_name 'crowdsec-chain' # IPv4 chain name
|
||||||
|
option chain6_name 'crowdsec6-chain' # IPv6 chain name
|
||||||
|
option retry_initial_connect '1' # Retry if LAPI unavailable
|
||||||
|
list interface 'br-lan' # Interfaces to filter
|
||||||
|
list interface 'eth1'
|
||||||
|
```
|
||||||
|
|
||||||
|
### Common Configuration Tasks
|
||||||
|
|
||||||
|
#### Change Update Frequency
|
||||||
|
|
||||||
|
```bash
|
||||||
|
uci set crowdsec.bouncer.update_frequency='30s'
|
||||||
|
uci commit crowdsec
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer restart
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Add/Remove Protected Interfaces
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Add interface
|
||||||
|
uci add_list crowdsec.bouncer.interface='wlan0'
|
||||||
|
|
||||||
|
# Remove specific interface
|
||||||
|
uci del_list crowdsec.bouncer.interface='eth1'
|
||||||
|
|
||||||
|
# Commit and restart
|
||||||
|
uci commit crowdsec
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer restart
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Change Deny Action
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Options: drop (silent), reject (send ICMP), tarpit (slow response)
|
||||||
|
uci set crowdsec.bouncer.deny_action='reject'
|
||||||
|
uci commit crowdsec
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer restart
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Enable/Disable Logging
|
||||||
|
|
||||||
|
```bash
|
||||||
|
uci set crowdsec.bouncer.deny_log='1' # Enable
|
||||||
|
uci set crowdsec.bouncer.deny_log='0' # Disable
|
||||||
|
uci commit crowdsec
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer restart
|
||||||
|
```
|
||||||
|
|
||||||
|
## Manual Bouncer Registration
|
||||||
|
|
||||||
|
If automatic registration fails, register manually:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Register bouncer and get API key
|
||||||
|
API_KEY=$(cscli bouncers add crowdsec-firewall-bouncer -o raw)
|
||||||
|
|
||||||
|
# Set in UCI
|
||||||
|
uci set crowdsec.bouncer.api_key="$API_KEY"
|
||||||
|
uci commit crowdsec
|
||||||
|
|
||||||
|
# Restart bouncer
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer restart
|
||||||
|
```
|
||||||
|
|
||||||
|
## Verification
|
||||||
|
|
||||||
|
### Check Bouncer Status
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Service status
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer status
|
||||||
|
|
||||||
|
# Check if running
|
||||||
|
ps | grep cs-firewall-bouncer
|
||||||
|
|
||||||
|
# Check bouncer registration
|
||||||
|
cscli bouncers list
|
||||||
|
```
|
||||||
|
|
||||||
|
### Check nftables Rules
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# IPv4 table
|
||||||
|
nft list table ip crowdsec
|
||||||
|
|
||||||
|
# IPv6 table
|
||||||
|
nft list table ip6 crowdsec6
|
||||||
|
|
||||||
|
# Check blacklist set
|
||||||
|
nft list set ip crowdsec crowdsec-blacklists
|
||||||
|
```
|
||||||
|
|
||||||
|
### Verify Blocking
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Add a test decision
|
||||||
|
cscli decisions add --ip 1.2.3.4 --duration 4h --reason "Test block"
|
||||||
|
|
||||||
|
# Check if IP is in blacklist
|
||||||
|
nft list set ip crowdsec crowdsec-blacklists | grep 1.2.3.4
|
||||||
|
|
||||||
|
# Delete test decision
|
||||||
|
cscli decisions delete --ip 1.2.3.4
|
||||||
|
```
|
||||||
|
|
||||||
|
### Check Logs
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Service logs
|
||||||
|
logread | grep crowdsec-firewall-bouncer
|
||||||
|
|
||||||
|
# Kernel logs for blocked packets (if deny_log=1)
|
||||||
|
dmesg | grep CrowdSec
|
||||||
|
|
||||||
|
# Check bouncer log file
|
||||||
|
tail -f /var/log/crowdsec-firewall-bouncer.log
|
||||||
|
```
|
||||||
|
|
||||||
|
## How It Works
|
||||||
|
|
||||||
|
1. **Startup**:
|
||||||
|
- Reads UCI configuration from `/etc/config/crowdsec`
|
||||||
|
- Generates YAML config at `/var/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml`
|
||||||
|
- Creates nftables tables (`crowdsec`, `crowdsec6`)
|
||||||
|
- Creates nftables sets for blacklists
|
||||||
|
- Adds filter chains to INPUT/FORWARD hooks
|
||||||
|
|
||||||
|
2. **Runtime**:
|
||||||
|
- Polls CrowdSec LAPI every `update_frequency` seconds
|
||||||
|
- Fetches active ban decisions
|
||||||
|
- Updates nftables sets with banned IPs
|
||||||
|
- Sets timeout based on decision duration
|
||||||
|
- Automatically removes expired bans
|
||||||
|
|
||||||
|
3. **Shutdown**:
|
||||||
|
- Deletes nftables tables and chains
|
||||||
|
- Removes YAML config
|
||||||
|
- Cleans up resources
|
||||||
|
|
||||||
|
## Integration with CrowdSec Dashboard
|
||||||
|
|
||||||
|
The SecuBox CrowdSec dashboard (`luci-app-crowdsec-dashboard`) automatically detects the bouncer:
|
||||||
|
|
||||||
|
- **Detection**: Checks for `cs-firewall-bouncer` process
|
||||||
|
- **Display**: Shows bouncer status in Overview page
|
||||||
|
- **Decisions**: Shows blocked IPs and applies them via bouncer
|
||||||
|
|
||||||
|
Access the dashboard at: **System → CrowdSec → Overview**
|
||||||
|
|
||||||
|
## Troubleshooting
|
||||||
|
|
||||||
|
### Bouncer Not Starting
|
||||||
|
|
||||||
|
**Check CrowdSec is running**:
|
||||||
|
```bash
|
||||||
|
/etc/init.d/crowdsec status
|
||||||
|
cscli lapi status
|
||||||
|
```
|
||||||
|
|
||||||
|
**Check nftables is available**:
|
||||||
|
```bash
|
||||||
|
nft list tables
|
||||||
|
modprobe nf_tables
|
||||||
|
```
|
||||||
|
|
||||||
|
**Check API key is set**:
|
||||||
|
```bash
|
||||||
|
uci get crowdsec.bouncer.api_key
|
||||||
|
```
|
||||||
|
|
||||||
|
### No IPs Being Blocked
|
||||||
|
|
||||||
|
**Check for active decisions**:
|
||||||
|
```bash
|
||||||
|
cscli decisions list
|
||||||
|
```
|
||||||
|
|
||||||
|
**Check nftables sets**:
|
||||||
|
```bash
|
||||||
|
nft list set ip crowdsec crowdsec-blacklists
|
||||||
|
```
|
||||||
|
|
||||||
|
**Check bouncer can reach LAPI**:
|
||||||
|
```bash
|
||||||
|
# From bouncer log
|
||||||
|
logread | grep "connection refused\|timeout"
|
||||||
|
```
|
||||||
|
|
||||||
|
### Interface Not Filtered
|
||||||
|
|
||||||
|
**Check interface list**:
|
||||||
|
```bash
|
||||||
|
uci show crowdsec.bouncer.interface
|
||||||
|
```
|
||||||
|
|
||||||
|
**Verify interface exists**:
|
||||||
|
```bash
|
||||||
|
ip link show
|
||||||
|
```
|
||||||
|
|
||||||
|
**Check nftables rules reference correct interface**:
|
||||||
|
```bash
|
||||||
|
nft list chain ip crowdsec crowdsec-chain-input
|
||||||
|
```
|
||||||
|
|
||||||
|
### High CPU Usage
|
||||||
|
|
||||||
|
**Reduce update frequency**:
|
||||||
|
```bash
|
||||||
|
uci set crowdsec.bouncer.update_frequency='30s'
|
||||||
|
uci commit crowdsec
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer restart
|
||||||
|
```
|
||||||
|
|
||||||
|
**Disable logging**:
|
||||||
|
```bash
|
||||||
|
uci set crowdsec.bouncer.deny_log='0'
|
||||||
|
uci commit crowdsec
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer restart
|
||||||
|
```
|
||||||
|
|
||||||
|
## Advanced Configuration
|
||||||
|
|
||||||
|
### Using Remote LAPI
|
||||||
|
|
||||||
|
To connect to a remote CrowdSec LAPI:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Set remote LAPI URL
|
||||||
|
uci set crowdsec.bouncer.api_url='https://crowdsec-lapi.example.com:8080/'
|
||||||
|
|
||||||
|
# Register bouncer on remote server
|
||||||
|
ssh remote-server "cscli bouncers add router-bouncer"
|
||||||
|
|
||||||
|
# Copy API key and set locally
|
||||||
|
uci set crowdsec.bouncer.api_key='<remote-api-key>'
|
||||||
|
uci commit crowdsec
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer restart
|
||||||
|
```
|
||||||
|
|
||||||
|
### Custom Chain Priority
|
||||||
|
|
||||||
|
Higher priority = earlier in filter chain:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Default is 4 (before normal filter rules)
|
||||||
|
uci set crowdsec.bouncer.priority='10'
|
||||||
|
uci commit crowdsec
|
||||||
|
/etc/init.d/crowdsec-firewall-bouncer restart
|
||||||
|
```
|
||||||
|
|
||||||
|
### Prometheus Metrics
|
||||||
|
|
||||||
|
The bouncer can expose Prometheus metrics (requires recompilation with metrics enabled).
|
||||||
|
|
||||||
|
## Files
|
||||||
|
|
||||||
|
- `/etc/config/crowdsec` - UCI configuration
|
||||||
|
- `/etc/init.d/crowdsec-firewall-bouncer` - Init script (from upstream)
|
||||||
|
- `/var/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml` - Generated YAML config
|
||||||
|
- `/var/log/crowdsec-firewall-bouncer.log` - Bouncer log file
|
||||||
|
- `/usr/bin/cs-firewall-bouncer` - Bouncer binary
|
||||||
|
|
||||||
|
## Links
|
||||||
|
|
||||||
|
- [CrowdSec Documentation](https://docs.crowdsec.net/)
|
||||||
|
- [Firewall Bouncer GitHub](https://github.com/crowdsecurity/cs-firewall-bouncer)
|
||||||
|
- [nftables Documentation](https://wiki.nftables.org/)
|
||||||
|
- [SecuBox Project](https://secubox.com)
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
MIT License - See upstream package for details
|
||||||
|
|
||||||
|
## Support
|
||||||
|
|
||||||
|
For issues related to:
|
||||||
|
- **SecuBox integration**: Open issue on SecuBox GitHub
|
||||||
|
- **Bouncer functionality**: Refer to [cs-firewall-bouncer issues](https://github.com/crowdsecurity/cs-firewall-bouncer/issues)
|
||||||
|
- **CrowdSec core**: Refer to [CrowdSec documentation](https://docs.crowdsec.net/)
|
||||||
@ -0,0 +1,22 @@
|
|||||||
|
config bouncer
|
||||||
|
option enabled '0'
|
||||||
|
option ipv4 '1'
|
||||||
|
option ipv6 '1'
|
||||||
|
option api_url 'http://127.0.0.1:8080/'
|
||||||
|
option api_key ''
|
||||||
|
option update_frequency '10s'
|
||||||
|
option priority '4'
|
||||||
|
option deny_action 'drop'
|
||||||
|
option deny_log '1'
|
||||||
|
option log_prefix 'CrowdSec: '
|
||||||
|
option log_level 'info'
|
||||||
|
option log_max_size '100'
|
||||||
|
option log_max_backups '3'
|
||||||
|
option log_max_age '30'
|
||||||
|
option filter_input '1'
|
||||||
|
option filter_forward '1'
|
||||||
|
option chain_name 'crowdsec-chain'
|
||||||
|
option chain6_name 'crowdsec6-chain'
|
||||||
|
option retry_initial_connect '1'
|
||||||
|
list interface 'br-lan'
|
||||||
|
list interface 'eth1'
|
||||||
@ -0,0 +1,154 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
#
|
||||||
|
# CrowdSec Firewall Bouncer - UCI Defaults Script
|
||||||
|
# Automatically configures and registers the firewall bouncer on first install
|
||||||
|
#
|
||||||
|
|
||||||
|
BOUNCER_NAME="crowdsec-firewall-bouncer"
|
||||||
|
CONFIG_FILE="/etc/config/crowdsec"
|
||||||
|
BOUNCER_CONFIG="/etc/config/crowdsec-bouncer"
|
||||||
|
|
||||||
|
# Function to check if CrowdSec is installed and running
|
||||||
|
check_crowdsec() {
|
||||||
|
if ! command -v cscli >/dev/null 2>&1; then
|
||||||
|
echo "CrowdSec (cscli) not found. Please install crowdsec first."
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if LAPI is reachable
|
||||||
|
if ! cscli lapi status >/dev/null 2>&1; then
|
||||||
|
echo "CrowdSec LAPI not running. Start crowdsec service first."
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to register bouncer and get API key
|
||||||
|
register_bouncer() {
|
||||||
|
local api_key
|
||||||
|
|
||||||
|
# Check if bouncer already registered
|
||||||
|
if cscli bouncers list | grep -q "$BOUNCER_NAME"; then
|
||||||
|
echo "Bouncer '$BOUNCER_NAME' already registered"
|
||||||
|
# Try to get existing key (note: cscli doesn't show keys after creation)
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Register new bouncer
|
||||||
|
echo "Registering bouncer '$BOUNCER_NAME' with CrowdSec LAPI..."
|
||||||
|
api_key=$(cscli bouncers add "$BOUNCER_NAME" -o raw 2>/dev/null)
|
||||||
|
|
||||||
|
if [ -n "$api_key" ] && [ "$api_key" != "null" ]; then
|
||||||
|
echo "Bouncer registered successfully"
|
||||||
|
# Update UCI config with API key
|
||||||
|
uci set crowdsec.bouncer.api_key="$api_key"
|
||||||
|
uci commit crowdsec
|
||||||
|
return 0
|
||||||
|
else
|
||||||
|
echo "Failed to register bouncer"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to detect network interfaces
|
||||||
|
detect_interfaces() {
|
||||||
|
local interfaces=""
|
||||||
|
local lan_iface
|
||||||
|
local wan_iface
|
||||||
|
|
||||||
|
# Get LAN interface
|
||||||
|
lan_iface=$(uci -q get network.lan.device)
|
||||||
|
[ -z "$lan_iface" ] && lan_iface=$(uci -q get network.lan.ifname)
|
||||||
|
[ -z "$lan_iface" ] && lan_iface="br-lan"
|
||||||
|
|
||||||
|
# Get WAN interface
|
||||||
|
wan_iface=$(uci -q get network.wan.device)
|
||||||
|
[ -z "$wan_iface" ] && wan_iface=$(uci -q get network.wan.ifname)
|
||||||
|
[ -z "$wan_iface" ] && wan_iface="eth1"
|
||||||
|
|
||||||
|
interfaces="$lan_iface $wan_iface"
|
||||||
|
|
||||||
|
echo "$interfaces"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to merge bouncer config into main crowdsec config
|
||||||
|
merge_config() {
|
||||||
|
# Check if bouncer section already exists in main config
|
||||||
|
if ! uci -q get crowdsec.bouncer >/dev/null 2>&1; then
|
||||||
|
echo "Creating bouncer section in /etc/config/crowdsec..."
|
||||||
|
|
||||||
|
# Copy from template if it exists
|
||||||
|
if [ -f "$BOUNCER_CONFIG" ]; then
|
||||||
|
# Read values from bouncer config template
|
||||||
|
uci -q import crowdsec < "$BOUNCER_CONFIG"
|
||||||
|
else
|
||||||
|
# Create basic bouncer section
|
||||||
|
uci set crowdsec.bouncer=bouncer
|
||||||
|
uci set crowdsec.bouncer.enabled='0'
|
||||||
|
uci set crowdsec.bouncer.ipv4='1'
|
||||||
|
uci set crowdsec.bouncer.ipv6='1'
|
||||||
|
uci set crowdsec.bouncer.api_url='http://127.0.0.1:8080/'
|
||||||
|
uci set crowdsec.bouncer.update_frequency='10s'
|
||||||
|
uci set crowdsec.bouncer.deny_action='drop'
|
||||||
|
uci set crowdsec.bouncer.deny_log='1'
|
||||||
|
uci set crowdsec.bouncer.log_prefix='CrowdSec: '
|
||||||
|
uci set crowdsec.bouncer.log_level='info'
|
||||||
|
uci set crowdsec.bouncer.filter_input='1'
|
||||||
|
uci set crowdsec.bouncer.filter_forward='1'
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Auto-detect and set interfaces
|
||||||
|
local ifaces
|
||||||
|
ifaces=$(detect_interfaces)
|
||||||
|
uci delete crowdsec.bouncer.interface 2>/dev/null
|
||||||
|
for iface in $ifaces; do
|
||||||
|
uci add_list crowdsec.bouncer.interface="$iface"
|
||||||
|
done
|
||||||
|
|
||||||
|
uci commit crowdsec
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to load nftables kernel modules
|
||||||
|
load_nftables_modules() {
|
||||||
|
modprobe nf_tables 2>/dev/null
|
||||||
|
modprobe nft_chain_nat 2>/dev/null
|
||||||
|
modprobe nf_nat 2>/dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
# Main execution
|
||||||
|
main() {
|
||||||
|
echo "Configuring CrowdSec Firewall Bouncer..."
|
||||||
|
|
||||||
|
# Merge configuration
|
||||||
|
merge_config
|
||||||
|
|
||||||
|
# Load required kernel modules
|
||||||
|
load_nftables_modules
|
||||||
|
|
||||||
|
# Check if CrowdSec is available
|
||||||
|
if ! check_crowdsec; then
|
||||||
|
echo "CrowdSec not ready. Bouncer registration skipped."
|
||||||
|
echo "Run 'cscli bouncers add $BOUNCER_NAME' manually after starting crowdsec."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Register bouncer
|
||||||
|
if register_bouncer; then
|
||||||
|
echo "Bouncer configuration complete"
|
||||||
|
echo "Enable the bouncer with: uci set crowdsec.bouncer.enabled='1'; uci commit crowdsec"
|
||||||
|
echo "Start the service with: /etc/init.d/crowdsec-firewall-bouncer enable && /etc/init.d/crowdsec-firewall-bouncer start"
|
||||||
|
else
|
||||||
|
echo "Bouncer registration failed. You may need to register manually:"
|
||||||
|
echo " cscli bouncers add $BOUNCER_NAME"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Run main function
|
||||||
|
main
|
||||||
|
|
||||||
|
# Cleanup: remove this script after execution
|
||||||
|
rm -f /etc/uci-defaults/99_crowdsec-bouncer
|
||||||
|
|
||||||
|
exit 0
|
||||||
Loading…
Reference in New Issue
Block a user