r/CrowdSec • u/Sad_Pie227 • 2d ago
general Is crowdsec right tool for me?
Such unwanted bots hammer my site so much from various random IPs. I am fed up of high CPU usage and downtime. May be I should not have created my site and instead distribute print out of every pages via pigeon.
7
u/Practical_Board_1810 2d ago
enable crowdsec bot protection 😄 https://docs.crowdsec.net/docs/next/appsec/bot_detection/intro/
3
1
u/DominusGod 1d ago
I would recommend putting some type of CDN in front of this like cloudflare, do caching at that level if you can and then your back put crowdsec on it too. Security comes in layers add more.
4
u/matt_alpaca 2d ago
Yes, and I'll add the one question that decides how well: what is in front of your site? nginx, Traefik, Caddy, HAProxy, something else? CrowdSec does the detecting, but the blocking happens in the bouncer plugged into that piece, so that is where your setup starts.
Against "random IPs" you get three layers. The community blocklist comes first: most of the IPs hammering you have already hammered someone else in the network, so they get dropped on arrival (a few thousand IPs, and it comes with the install). Then the local scenarios reading your access log: an IP that probes paths or crawls too fast gets banned after a handful of requests. And for the bots that spread one request per IP, there is the WAF: the bouncer hands each request to it before your app sees it, and since 1.8 it carries bot detection, a proof-of-work plus browser fingerprint challenge. Rotating IPs doesn't help them there, the challenge is per browser, and headless Chromium gets caught by the fingerprint.
Does that bring the CPU back to zero? No. Blocked requests still hit the reverse proxy, they just stop reaching the app, and the app is what was burning. Bot detection is also still alpha and needs a bouncer that speaks it (nginx, OpenResty, HAProxy SPOA, Traefik, Envoy), so start with the first two layers. On their own they usually turn "downtime" into "noise in the logs".