← Directory

CrowdSec Cloudflare Bouncer

CrowdSec Cloudflare Bouncer is a Cloudflare bouncer that syncs ban decisions from your CrowdSec agent to Cloudflare's firewall, blocking malicious IP…

  • Security
CrowdSec Cloudflare Bouncer is a Cloudflare bouncer that syncs ban decisions from your CrowdSec agent to Cloudflare's firewall, blocking malicious IP addresses, countries, and autonomous system numbers across all users, accounts, and zones, giving homelab users running Cloudflare network-level intrusion blocking at the edge without touching their own servers.

Platform availability

Available on 1 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm (not listed)
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

19/100 Low

Maintained
0GitHub repository is archived
Popular
3659 GitHub stars
Easy to install
351 install platform, install notes, Docker image
Light to run
No data

Based on 3 of 4 factors.

Availability: platform listings confirmed today, links checked 9 days ago

GitHub stars
59
Open issues
11
Last commit
2025-04-06
Latest release
v0.3.0
License
MIT
Activity
stale

Checked 5 days ago - source: GitHub (crowdsecurity/cs-cloudflare-bouncer)

Resources & Compatibility

ARM (e.g. Raspberry Pi) is supported.

Checked 15 days ago - source: Docker Hub image tags and published docs

First-install notes

  • Install, then replace the tokens Run sudo ./install.sh, then create the config file by putting real tokens in place of <TOKEN1> and <TOKEN2>. If the angle-bracket placeholders stay in the command, the bouncer can't be set up. source
  • Check the generated settings file The config is saved at /etc/crowdsec/bouncers/crowdsec-cloudflare-worker-bouncer.yaml, which is a YAML (plain-text) file that controls the bouncer. If it is blank or has a formatting mistake, the service can fail to start. source
  • Choose how it keeps running For normal use, start it with sudo systemctl start crowdsec-cloudflare-worker-bouncer so the system service manager keeps it running automatically. The -S command is a manual mode that stops when you close the terminal. source
  • Maintenance status The project's GitHub repository has been archived: the app is stable but no further updates are expected, so pin a specific version if you need one. source

Fetched 9 days ago - each note links to its source

Alternatives (3)

  • Fail2ban - Fail2ban is a daemon that monitors log files and automatically bans hosts that cause multiple authentication failures, using firewall rules…
  • IPBanPro - IPBan is a FREE and open source application that allows auto banning ip addresses from failed login attempts.
  • defensia-agent

Checked yesterday - source: AlternativeTo

Common questions

Can CrowdSec with a Cloudflare bouncer still help if I only expose services through Cloudflare Tunnels?

Yes, a Cloudflare bouncer can help block bad IPs at the edge. The Reddit discussion notes this can be useful when only Cloudflare Tunnels are exposed.

Why might crowdsec-cloudflare-bouncer fail while other CrowdSec parts work?

A reported cause is a well-known Cloudflare rate limiting issue. The user's logs reflected that rate-limiting problem.

What token mistake can prevent the Cloudflare bouncer from being set up?

Replace the <TOKEN1> and <TOKEN2> placeholders with real tokens after running the install script. If the angle-bracket placeholders remain, the bouncer cannot be set up.

Where is the generated Cloudflare bouncer configuration, and what can stop the service from starting?

The config is saved at /etc/crowdsec/bouncers/crowdsec-cloudflare-worker-bouncer.yaml as a plain-text YAML file. A blank file or a formatting mistake can prevent the service from starting.

Where does the current official Cloudflare worker bouncer store CrowdSec decisions?

It stores CrowdSec decisions in Workers KV. The worker is placed on selected Cloudflare routes.

Answers sourced from doc.crowdsec.net, mylinux.work, www.reddit.com, www.reddit.com

Community

Collected 14 days ago - public community threads