Why self-host CrowdSec on a VPS
Fail2ban works in a closed loop: it reads your logs and bans according to your rules. CrowdSec adds a collaborative dimension. When its engine detects malicious behavior (SSH bruteforce, scan, web exploitation) thanks to scenarios, it reports the IP to a community database; in return, you benefit from a shared blocklist built from the reports of thousands of other machines. The result: you block malicious IPs before they even attack you. CrowdSec also separates detection (the agent that analyzes the logs) from remediation (the bouncers that apply the blocking at the firewall, Nginx, Traefik or Cloudflare level). This modular architecture and hosting everything on your VPS give you far richer protection than a simple local ban, without depending on a SaaS WAF that sees all your traffic pass through.
What CrowdSec brings to your VPS
- Community blocklist: benefit from the reports of thousands of servers to block malicious IPs upstream.
- Behavioral detection via scenarios (SSH, HTTP, bruteforce, scan) more refined than a simple failure count.
- Modular bouncers: apply the blocking at the firewall, Nginx, Traefik, Cloudflare or application level.
- Web console to visualize alerts, decisions and banned IPs in real time.
- Hub of ready-to-use collections to protect SSH, Nginx, WordPress and many other services.
- Low footprint and decoupled detection/remediation architecture, suited to a VPS.
Requirements to host it
The CrowdSec agent is lightweight: a 1 vCPU VPS with 1 GB of RAM is enough to protect a standard web and SSH server. The local database (SQLite by default) takes up little space; switch to PostgreSQL only if you centralize several agents. You need root access to install the agent and the firewall bouncer, as well as the logs of the services to monitor (auth.log for SSH, access.log for Nginx). No additional inbound port is required: CrowdSec communicates outbound with the community API. A domain name is only necessary if you want to expose the local console.
Install CrowdSec and its firewall bouncer
Install the CrowdSec agent
Add the official repository then install: curl -s https://install.crowdsec.net | sudo sh then sudo apt install crowdsec. The agent automatically detects the services present (SSH, Nginx) and installs the appropriate collections.
Check the active scenarios
List what is loaded: sudo cscli scenarios list and sudo cscli collections list. Add a collection from the hub if needed, for example sudo cscli collections install crowdsecurity/nginx.
Install a bouncer to apply the blocking
The agent detects but does not block on its own. Install the firewall bouncer: sudo apt install crowdsec-firewall-bouncer-iptables. It inserts the decisions into iptables/nftables and actually bans the reported IPs.
Enable the community blocklist
Register the instance to receive the shared blocklist: sudo cscli capi register, then restart the agent. You now benefit from the reports of the entire community in addition to your own detections.
Test and inspect the decisions
Simulate a detection or check the state: sudo cscli decisions list displays the banned IPs, sudo cscli alerts list the alerts. You can ban manually with sudo cscli decisions add --ip X.X.X.X.
Connect the console (optional)
For graphical monitoring, enroll the agent in the CrowdSec console with sudo cscli console enroll VOTRE_CLE, or keep everything local via cscli if you prefer not to expose anything externally.
Combine two bouncers for defense in depth: a firewall bouncer (iptables) that blocks SSH attacks and scans at the network level, and an application bouncer (Nginx or Traefik) that can present a captcha rather than outright blocking suspicious web IPs. This reduces false positives on your legitimate traffic while keeping strict remediation on the lower layers. Also consider whitelisting your office's fixed IP via cscli so you never ban yourself.
The official documentation
For advanced configuration and options specific to the tool, refer to the official CrowdSec documentation. This guide covers deployment on a VPS; the vendor's documentation remains the reference for fine-tuning, major updates and specific use cases.
