Crowdsec and shorewall

Crowdsec is open-source and participative IPS. It is easy to setup and uses the power of sharing with fellow users.
If standard packages are used, installation is easy enough, but in the case of using shorewall as iptables manager there is no out of the box support.
The solution is to install custom bouncer and add a “binary” to interface with shorewall cli.
Installation process is well documented. The missing piece is the binary that will interface with shorewall.
shorewall cli does have drop and allow commands, but it does not use the same syntax as crowdsec custom bouncer (add/del).
We can use this simple script as a translator.
#!/bin/bash
#
# Script to add /remove IPs to shorewall blacklist

#determine action
if [ "$1" = "add" ]; then
logger -t crsec-shorewall "add $2 for $3 with $4"
shorewall drop $2
elif [ "$1" = "del" ]; then
logger -t crsec-shorewall "del $2 for $3 with $4"
shorewall allow $2
else
logger -t crsec-shorewall "unknon action"
fi

If you have found a spelling error, please, notify us by selecting that text and pressing Ctrl+Enter.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.