Install CrowdSec on VPS - Modern IPS System

June 2026 · 9 min read

CrowdSec is a modern Intrusion Prevention System (IPS) that goes beyond Fail2ban — instead of blocking IPs based only on local log analysis, CrowdSec shares attack data crowdsourced from servers worldwide, helping you detect threats faster and prevent attacks before they hit your VPS Moreover, CrowdSec uses machine learning to identify complex attack patterns like slowloris, WAF bypasses, and multi-vector brute force attempts while consuming 30% less CPU/RAM than Fail2ban. Bouncers integrate seamlessly with Nginx, Apache, Docker, iptables, and kernel filters This guide covers installing CrowdSec + bouncers on standard VPS infrastructure.

CrowdSec vs Fail2ban: Key Differences

Threat Intelligence: CrowdSec shares IP/pattern data from a global network automatically. Fail2ban requires paid threat feeds or external subscriptions
Detection: CrowdSec uses scenario-based rules + ML for complex attack patterns. Fail2ban relies on regex matching single log lines
Remediation: CrowdSec bouncers work at multiple layers (iptables/Nginx/Docker/kernel) from one installation. Fail2ban requires separate jails for each service
Scalability: CrowdSec designed for multi-server deployments where blocked IPs benefit the entire network. Fail2ban operates in isolation per-server

Install CrowdSec Agent

# Add CrowdSec repository (Ubuntu/Debian)
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash

# Install CrowdSec
sudo apt update
sudo apt install crowdsec -y

# Verify installation
crowdsec --version

# Start CrowdSec service
sudo systemctl restart crowdsec
sudo systemctl enable crowdsec

# Check status
sudo systemctl status crowdsec

Tip: CrowdSec uses ports 6060, 6061 for local bouncer communication (localhost only) — no external exposure needed from your VPS.

Configure CrowdSec: Exclude Unnecessary Logs

By default, CrowdSec scans all logs. To reduce noise from healthchecks, old logs, or unused services, configure acquisition and parsers:

sudo nano /etc/crowdsec/acquis.yaml

# Comment out parsers you don't need (add # prefix)
# Example: disable docker logs if not using containers
# - /var/log/auth.log
# - /var/log/syslog
# + /var/log/nginx/*.log    # Enable only Nginx
# + /var/log/mysql/error.log   # Enable MySQL errors

# Exclude CrowdSec's own logs to prevent recursive detection
# - /var/log/crowdsec/agent.log

# Restart to apply changes
sudo systemctl restart crowdsec

Install Bouncer for Nginx

Bouncers are the enforcement layer — when CrowdSec detects an attack, the bouncer blocks the IP at web server level instantly:

# Install Nginx bouncer
sudo apt install crowdsec-nginx-bouncer -y

# Enable Lua module for Nginx
sudo nano /etc/nginx/modules-enabled/50-mod-http-lua.conf

# Verify this line exists (add if missing):
load_module modules/ngx_http_lua_module.so;

# Create Nginx integration config
sudo nano /etc/nginx/http.d/crowdsec.conf

# Add this configuration:
lua_shared_dict crowdsec 10m;
init_by_lua_file /usr/local/lib/lua/crowdsec-bouncer/init.lua;
access_by_lua_file /usr/local/lib/lua/crowdsec-bouncer/access.lua;

# Place above server blocks in nginx.conf, then test
sudo nginx -t
sudo systemctl reload nginx

Tip: Nginx bouncer requires Lua module ngx_http_lua_module. If missing, install libnginx-mod-http-lua

Install Bouncer for iptables (Protects SSH + Full VPS)

# Install firewall bouncer for iptables/nftables
sudo apt install crowdsec-firewall-bouncer -y

# Edit bouncer configuration
sudo nano /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml

# Choose backend: nftables (modern) or iptables (legacy)
firewall_backend: nftables    # or iptables (check with: iptables --version)
dice_size: 10
dice_rolls: 1

# If using nftables, create required chains first
sudo nft add table inet crowdsec
sudo nft add chain inet crowdsec crowdsec-chain '{ type filter hook input priority filter; policy accept; }'

# Enable the bouncer
sudo systemctl restart crowdsec-firewall-bouncer
sudo systemctl enable crowdsec-firewall-bouncer

Deploy WordPress Plugin for Attack Detection

If running WordPress, install the CrowdSec plugin to capture brute force attempts, SQL injection, and XSS attacks:

# Via WordPress admin dashboard:
# Plugins → Add New → Search "CrowdSec"
# Install "CrowdSec WordPress Security" by CrowdSec

# Or manual installation:
cd /var/www/html/wp-content/plugins/
sudo wget https://downloads.wordpress.org/plugin/crowdsec.zip
sudo unzip crowdsec.zip
sudo chown -R www-data:www-data crowdsec/

# Activate in WordPress admin: Plugins → Activate "CrowdSec"
# Configure in: Settings → CrowdSec → Add API token (see next section)

Create API Token for CrowdSec Console (Optional but Recommended)

To monitor attacks, view decisions, and access the web dashboard, generate an API token:

# Generate bouncer token
sudo cscli bouncers add my-vps-bouncer

# Token output displays credentials for integrations

# View all registered bouncers
sudo cscli bouncers list

# Delete unused bouncers
sudo cscli bouncers delete BOUNCER_ID

Verify CrowdSec is Working Correctly

# Check CrowdSec service status
sudo crowdsec -c /etc/crowdsec/config.yaml -cli

# View live metrics
sudo cscli metrics

# List all decisions (blocked IPs)
sudo cscli decisions list

# View generated alerts
sudo cscli alerts list

# Verify bouncers attached
sudo cscli bouncers list

# Monitor CrowdSec agent log
sudo tail -f /var/log/crowdsec/agent.log

# Monitor firewall bouncer log
sudo tail -f /var/log/crowdsec/firewall-bouncer.log

Tip: If CrowdSec detects no alerts, verify log paths in acquis.yaml. Test by creating sample log entries in /tmp to ensure parsers trigger correctly.

Troubleshooting Common Issues

Error: "firewall backend not available"

System lacks nftables or iptables support; firewall-bouncer cannot bind to the firewall backend.

# Check which backend is available
nftables --version      # If error: nftables not installed
iptables --version      # Verify iptables presence

# Install iptables if missing
sudo apt install iptables

# Switch backend in crowdsec-firewall-bouncer.yaml
firewall_backend: iptables

# Load required kernel modules
sudo modprobe nf_conntrack
sudo modprobe nf_tables

# Restart bouncer
sudo systemctl restart crowdsec-firewall-bouncer

Error: "agent.log reports acquisition error" + "Cannot read log file"

CrowdSec agent lacks read permission on log files (runs as crowdsec user).

# Check current permissions on Nginx logs
ls -la /var/log/nginx/*.log

# Grant crowdsec user read access
sudo chown -R crowdsec:adm /var/log/nginx/
sudo chmod 640 /var/log/nginx/*.log

# Same for auth logs
sudo chown -R crowdsec:adm /var/log/auth.log
sudo chmod 640 /var/log/auth.log

# Add crowdsec to adm group for system logs
sudo usermod -a -G adm crowdsec

# Restart
sudo systemctl restart crowdsec

Error: "no decision made" — CrowdSec detects attacks but blocks nothing

Scenarios are disabled or bouncers haven't attached to detection rules.

# List installed scenarios
sudo cscli scenarios list

# Install SSH brute-force detection scenario
sudo cscli scenarios install crowdsecurity/ssh-bf

# Or install all default scenarios
sudo cscli hub install

# Verify bouncer attachment
sudo cscli bouncers list -o json | grep -i scenario

# If detached, register bouncer with scenarios
sudo cscli bouncers add my-bouncer --machine-name localhost

# Restart services
sudo systemctl restart crowdsec

Error: "Nginx bouncer: Lua error" after installation

Lua module not loaded correctly in Nginx configuration.

# Verify Nginx has Lua module compiled
nginx -V 2>&1 | grep -i lua

# Install Lua module if missing
sudo apt install libnginx-mod-http-lua

# Check Nginx main config
sudo nano /etc/nginx/nginx.conf
# Should contain: load_module modules/ngx_http_lua_module.so;

# Test configuration
sudo nginx -t

# Restart Nginx
sudo systemctl restart nginx
sudo systemctl restart crowdsec

Frequently Asked Questions

What data does CrowdSec send over the internet? Is my server info exposed?

CrowdSec agent sends aggregated threat data to the CrowdSec API (api.crowdsec.net) — not full log files, only detected IPs and attack patterns. Metrics are sent to build the global threat database; when other servers detect attacks from the same IP, your agent receives the decision without waiting for a local attack. You can enable offline mode to disable external communication (though threat intelligence benefits decrease). No sensitive application data leaves your VPS.

Does CrowdSec protect against DDoS?

Partially — CrowdSec detects slowloris, connection exhaustion, and rate-based attacks. Layer 3 packet floods require upstream protection (Cloudflare, AWS Shield, CAF). CrowdSec excels at application-level DDoS (WordPress POST floods, asset scraping, brute-force requests). That's where the bouncer truly shines by blocking the source instantly.

Can I manually block IPs without waiting for crowdsourced data?

Yes — use sudo cscli decisions add -i 1.2.3.4 -d 24h -r "manual block" to manually ban an IP. For custom logic, clone default scenarios from /etc/crowdsec/scenarios/, modify the configuration, and adjust thresholds to detect attacks faster locally while still benefiting from global crowdsourced decisions.