# CrowdSec Cloudflare Bouncer

CrowdSec Cloudflare Bouncer is a Cloudflare bouncer that syncs ban decisions from your CrowdSec agent to Cloudflare's firewall, blocking malicious IP addresses, countries, and autonomous system numbers across all. It is open source and self-hosted, installable on Docker Hub and Unraid.

Canonical page: https://ourlocalhost.com/app/1047/crowdsec-cloudflare-bouncer

## Description

CrowdSec Cloudflare Bouncer is a Cloudflare bouncer that syncs ban decisions from your CrowdSec agent to Cloudflare's firewall, blocking malicious IP addresses, countries, and autonomous system numbers across all users, accounts, and zones, giving homelab users running Cloudflare network-level intrusion blocking at the edge without touching their own servers.

## Platform availability

Available on 1 of 9 platforms: Unraid.

## Health score

19/100 (Low), based on 3 of 4 factors.
- Maintained: 0 (GitHub repository is archived)
- Popular: 36 (59 GitHub stars)
- Easy to install: 35 (1 install platform, install notes, Docker image)

## Links

- Docker Hub: https://hub.docker.com/r/crowdsecurity/cloudflare-bouncer
- Unraid: https://ca.unraid.net/apps/crowdsec-cloudflare-bouncer-0n7b7ul1o697zt?q=crowdsec-cloudflare-bouncer
- Documentation: https://docs.crowdsec.net/docs/bouncers/cloudflare
- GitHub: https://github.com/crowdsecurity/cs-cloudflare-bouncer

## Common questions

### Can CrowdSec with a Cloudflare bouncer still help if I only expose services through Cloudflare Tunnels?

Yes, a Cloudflare bouncer can help block bad IPs at the edge. The Reddit discussion notes this can be useful when only Cloudflare Tunnels are exposed.

### Why might crowdsec-cloudflare-bouncer fail while other CrowdSec parts work?

A reported cause is a well-known Cloudflare rate limiting issue. The user's logs reflected that rate-limiting problem.

### What token mistake can prevent the Cloudflare bouncer from being set up?

Replace the <TOKEN1> and <TOKEN2> placeholders with real tokens after running the install script. If the angle-bracket placeholders remain, the bouncer cannot be set up.

### Where is the generated Cloudflare bouncer configuration, and what can stop the service from starting?

The config is saved at /etc/crowdsec/bouncers/crowdsec-cloudflare-worker-bouncer.yaml as a plain-text YAML file. A blank file or a formatting mistake can prevent the service from starting.

### Where does the current official Cloudflare worker bouncer store CrowdSec decisions?

It stores CrowdSec decisions in Workers KV. The worker is placed on selected Cloudflare routes.

## Alternatives

- Fail2ban: Fail2ban is a daemon that monitors log files and automatically bans hosts that cause multiple authentication failures, using firewall rules…
- IPBanPro: IPBan is a FREE and open source application that allows auto banning ip addresses from failed login attempts.
- defensia-agent

---
Source: Our Local Host (https://ourlocalhost.com/app/1047/crowdsec-cloudflare-bouncer), the self-hosted and open-source app directory.