1.7 KiB
name, description, metadata
| name | description | metadata | ||
|---|---|---|---|---|
| crowdsec-bans-own-devices | crowdsec http-probing bans Connor's own phone because http_path keeps the query string, so one app session looks like dozens of distinct 404s |
|
On mainframe, "can't reach my services from outside the LAN" has been crowdsec banning Connor's own device, not DNS/DDNS/ports/TLS. Confirmed 2026-09-27.
crowdsecurity/caddy-logs sets evt.Meta.http_path to request.uri — the full
URI including the query string. crowdsecurity/http-probing keys
distinct: evt.Meta.http_path with capacity: 10, so any app that hits ONE
endpoint with many different query params and gets 4xx back looks like dozens of
distinct probed paths and overflows the bucket. The nft firewall-bouncer then
DROPS that IP for 4h: every service times out from that address while the LAN is
completely unaffected — which is what makes it read as a port-forward or DNS fault.
Worked example: Substreamer/air-sonic requesting /rest/getCoverArt.view?id=al-N&size=N
against shanty, which 404s art it doesn't have → 22 distinct URIs → ban.
Fixed by ~/config/crowdsec/parsers/s02-enrich/zz-shanty-subsonic-whitelist.yaml
(scoped to 404 + /rest/ on shanty only). Editing it needs
sudo podman restart connor_crowdsec_1 — see podman-compose-bind-mount-restart.
Diagnostic order that actually works: cscli decisions list and
grep -c <ip> against sudo nft list table ip crowdsec FIRST. Note
cscli decisions list -i <ip> did not filter as expected — it printed CAPI
entries too, so the nft set membership check is the reliable one. Beware:
http-crawl-non_statics is NOT the same hazard — it keys distinct on
file_name, so normal streaming doesn't trip it.