Crowdsec / Firehol

[Setsuneh]

Hi,

Do you have any documentation on implementing your project in CrowdSec as well as in FireHOL?

Thank you !

[Aetherinox]

Not off hand. I haven't used Crowdsec in great detail so I'll have to install and play with it.

Primarily, I use ConfigServer,

I did look at a few docs real quick, and FireHOL supports the blocklists I generate with one ip per line, so these should definitely plug in. What I'm not seeing is where you add the list.

Same for CrowdSec, I haven't had a lot of time with it, I use Fail2Ban. But these lists should most definitely be compatible, as others generate lists similar to mine that FireHOL and CrowdSec users are using.

I'll have to go dig into some docs.

[Setsuneh]

Here is a start of research on my side, by installing first the package crowdsec-blocklist-mirror

I've modified too crowdsec-blocklist-mirror.yaml :

 - endpoint: /master
    format: plain_text
    url: "https://raw.githubusercontent.com/Aetherinox/blocklists/main/blocklists/master.ipset"
    authentication:
      type: none

  - endpoint: /highrisk
    format: plain_text
    url: "https://raw.githubusercontent.com/Aetherinox/blocklists/main/blocklists/highrisk.ipset"
    authentication:
      type: none

Tried with block-ai-bots.txt, but Crowdsec does not block ClaudeBot after this unfortunatly

[Aetherinox]

I'm doing a quick and dirty search, since I know how fail2ban and CSF work.

Have you seen this video? https://www.youtube.com/watch?v=_oelAHaGXpQ

It appears blocklists are handled as "endpoints". The video shows how to set up blocklist mirror and the guy goes through setting up a blocklist and then enabling the server.

If you're using docker, I haven't found any docker instructions. 99.999% of all the stuff I install is for docker, and then I route it to my main machine.

The blocklist explanation starts at https://youtu.be/_oelAHaGXpQ?t=212

[Setsuneh]

He uses folder, but here we try with URL + txt.
It is possible to test it with curl too :

curl -I http://127.0.0.1:41412/highrisk
HTTP/1.1 200 OK
Date: Sun, 22 Jun 2025 19:47:09 GMT
Content-Type: text/plain; charset=utf-8

HTTP/1.1 200 OK
Date: Sun, 22 Jun 2025 19:47:09 GMT
Content-Type: text/plain; charset=utf-8

[LaurenceJJones]

Hey, Laurence from CrowdSec here 👋🏻

Hope you don't mind me jumping in. Just to clarify, blocklist-mirror is a formatted output of the decisions held by the Security Engine. You would first set up the Security Engine and configure blocklist-mirror to point to your LAPI.

If you want to include external feeds, you can import them into the Security Engine directly. For example, using a cron job, you can ingest an external blocklist like this:

curl -s https://raw.githubusercontent.com/Aetherinox/blocklists/main/blocklists/master.ipset | grep -v '^#' | grep -v '/' | grep -v '^$' | cscli decisions import -i- --format values

This command downloads the list, strips out comments, skips CIDR ranges, and imports individual IPs as decisions. Once imported, blocklist-mirror will pick them up and expose them for use across your infrastructure.

Hope this clears things up, but if you have any questions, feel free to ask.