[INSTALLATION] Fail2ban/crowdsec and their interaction with this project, worth it?

[maxdd]

Hello,
this is not really an installation issue per se but more like a question related about the synergy between tools such as fail2ban and crowdsec.
My understanding was that nginx ultimate bad bot blocker also contains a list of IPs which are somewhat up-to-date, is that the case or the main intention of the tool is to reject attacks mainly based on patterns/ua and leave the bad IPs as a secondary feature?

Are then fail2ban/crowdsec overkill against nginx logs?

[itoffshore]

@maxdd - I always used UBBB with fail2ban (which was already detecting & blocking clients who generated too many bad 40x's)

• I think the proper place for rate limiting requests is in the firewall (all web clients should behave nicely)

• I prefer nftables firewalls as it's a single config for ipv4 / ipv6 & ipset functionality is built in.

• Blocking bad ip's in ipsets at the nftables ingress level hook is a good choice for performance (i.e before packets traverse connection tracking & before prerouting) - requires kernel 5.10+ & nftables 0.9.7+

[HKPhysicist]

Have you tried CSF firewall?
They can use ipsets which is super fast.

[itoffshore]

@HKPhysicist - nftables has:

• ipset functionality built in
• ipv4 & ipv6 configuration in a single file

CSF firewall uses iptables - I've never used CSF so cannot really comment. It does look like a good choice if you don't know how to drop common attacks / like to have a GUI.

plain nftables with fail2ban will probably always be a bit faster (as it's tuned to your environment)

• I block 5-6000 persistent ip's with no issues with nftables & fail2ban:

• Reading journald directly in fail2ban will also always be quicker

I always intended UBBB to have blocking done by ipset / fail2ban (& not by nginx) - as it's much, much faster (& you can drop bad packets at the ingress level in nftables before they hit conntrack preserving server resources)

I always only had nginx log the 405s for fail2ban to pick up & ban.