Open yashodhank opened 2 years ago
buixor
commented
2 years ago Hello !
Thanks for the feedback. It seems that plesk is providing its own nginx package (sw-nginx).
We will see if the bouncer works with their package, or provide an alternative installation method for those that are using 3rd party packages of nginx.
franciscopaniskaseker
commented
1 year ago Hi @buixor do you need any help here to make crowdsec nginx bouncer possible with plesk? I mean, we can do with firewall boucner, but when most of the accounts are under cloudflare, for example, crowdsec firewall bouncer will not be helpful.
I am not sure which is the easiest option: try to make it able to run with sw-nginx or maybe build some nginx proxy container (that can read cloudflare real ips) and execute some iptables rules to filter the traffic, as bitninja container solution does.
what do you think?
hitesh-pathak
commented
9 months ago @franciscopaniskaseker I know the question was not addressed to me, but I have been struggling with nginx + cloudflare too.
For the second suggestion "an nginx proxy that sees real IPs and then adding iptables rules to filter traffic", one problem will be that iptables will not be able to see the real IPs (particularly if the traffic is encrypted, as cloudflare puts those in a request header cf-connecting-ip)
For unencrypted traffic, I've seen people use something like
iptables --match string --algo bm --icase "cf-connecting-ip: <IP>" -j DROP
But string matching is relatively slow, and this won't work for https traffic :(
Sorry if I completely misunderstood your comment.
After installation web server turned out to be broken and restoring it back to operational status requires cleaning up and reinstallation of sw-nginx package which is provided by Plesk and works well with other Panel integration.