# CrowdSec Traefik Bouncer

CrowdSec Traefik Bouncer is a self-hosted CrowdSec bouncer for Traefik that protects services by blocking malicious client IPs. It is open source and self-hosted, installable on Docker Hub and Unraid.

Canonical page: https://ourlocalhost.com/app/670/crowdsec-traefik-bouncer

## Description

CrowdSec Traefik Bouncer is a self-hosted CrowdSec bouncer for Traefik that protects services by blocking malicious client IPs. It uses Traefik's ForwardAuth middleware to query CrowdSec with each client IP, returning HTTP 403 for banned clients and allowing other requests to continue.

## Platform availability

Available on 1 of 9 platforms: Unraid.

## Health score

23/100 (Low), based on 3 of 4 factors.
- Maintained: 0 (last commit 1476 days ago)
- Popular: 50 (332 GitHub stars)
- Easy to install: 35 (1 install platform, install notes, Docker image)

## Links

- GitHub: https://github.com/fbonalair/traefik-crowdsec-bouncer
- Docker Hub: https://hub.docker.com/r/fbonalair/traefik-crowdsec-bouncer
- Unraid: https://ca.unraid.net/apps/crowdsec-traefik-bouncer-0o99y5t0nhe4v9?q=crowdsec-traefik-bouncer
- Official website: https://docs.ibracorp.io

## Common questions

### What connectivity is required when hosting the fbonalair Traefik bouncer container?

The bouncer must be able to reach CrowdSec and must also be reachable by Traefik.

### Do older guides that mention ForwardAuth or cloudFlareIPs still match current Traefik bouncer setup?

No, the source notes that ForwardAuth is gone and there are no more cloudFlareIPs entries in Traefik config files.

### Should the bouncer use streaming mode for better performance?

Streaming mode is recommended for performance, with decisions updated every 60 seconds by default.

### Should a CrowdSec bouncer be installed on every downstream web server instead of only Traefik?

It should usually run on the internet-facing main entrance, such as Traefik, rather than on every downstream web server. A router or firewall agent can be used if supported.

## Alternatives

- Cloudflare: Protects websites with front-end proxy, dynamic DNS, CDN, and firewall; blocks DDoS and targeted attacks, optimizes traffic, and analyzes t…
- CrowdSec: CrowdSec is a free, open-source IDS/IPS and WAF that detects malicious behavior by analyzing server logs and HTTP requests, then blocks off…
- Fail2ban: Fail2ban is a daemon that monitors log files and automatically bans hosts that cause multiple authentication failures, using firewall rules…
- IPBanPro: IPBan is a FREE and open source application that allows auto banning ip addresses from failed login attempts.
- defensia-agent

---
Source: Our Local Host (https://ourlocalhost.com/app/670/crowdsec-traefik-bouncer), the self-hosted and open-source app directory.