Hey all, i’ve decided I should probably setup something else to help block nefarious IP addresses. I’ve been looking into CrowdSec and Fail2Ban but i’m not really sure the best one to use.
My setup is OpnSense -> Nginx Proxy Manager -> Servers. I think I need to setup CrowdSec/Fail2Ban on the Nginx Proxy Manager to filter the access logs, then ideally it would setup the blocks on OpnSense - but i’m not sure that can be done?
Any experience in a setup like this? I’ve found a few guides but some of them seem fairly outdated.
Edit: thanks everybody for the great info. General consensus seems to be with crowdsec so I’ll go down that path and see how it goes.
It would protect all the services. Instead of having to secure each one, you only expose the VPN server and connect to that. You don’t have to worry about North Korean hackers breaching your services if they’re not exposed at all, only the single VPN service. Less attack surface, less worry.
And basically useless if you need external users to be able to connect to the services.
This is a scenario where a single node VPN would reduce, not increase OP’s security stance. You do have to worry about NK hackers breaching your services because they’re all exposed through the single node VPN server. Same attack surface, less knowledge needed to hit the target with the payload.