Deploy CrowdSec + eBPF to Stop High‑Volume DDoS on Bare Metal

CrowdSec is an open-source, collaborative intrusion-prevention engine that protects servers, containers, and bare-metal machines from a wide range of attacks. By combining behavioural analysis with eBPF (extended Berkeley Packet Filter) programs, it can filter malicious traffic directly in the kernel. This is crucial when facing high-volume DDoS attacks that would otherwise overwhelm traditional userspace firewalls.

Why Use eBPF with CrowdSec on Bare-Metal Servers?

• Kernel-level filtering: eBPF runs inside the Linux kernel, dropping packets before they reach the network stack and reducing CPU and memory usage.
• Low latency: Decisions are made in-kernel, so legitimate traffic experiences virtually no additional delay.
• Dynamic updates: CrowdSec shares threat intelligence continuously; new eBPF rules can be injected without restarting services.
• Scalability: Bare-metal servers with high-throughput NICs can handle millions of packets per second when tuned correctly.

Prerequisites

1. A recent Linux distribution (Ubuntu 22.04 LTS, Debian 12, AlmaLinux 9, Rocky 9, or RHEL 9).
2. Root or sudo access.
3. A network interface that receives public traffic (e.g., eth0).
4. Basic familiarity with systemd and firewall concepts.

Step 1 – Install CrowdSec

Debian / Ubuntu

# Update package index
sudo apt update

# Install required dependencies
sudo apt install -y curl gnupg2 lsb-release

# Add CrowdSec repository
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash

# Install CrowdSec core
sudo apt install -y crowdsec

# Verify the service is running
sudo systemctl status crowdsec

AlmaLinux / Rocky / RHEL

# Install required tools
sudo dnf install -y curl gnupg2

# Add CrowdSec repository
sudo dnf install -y https://packagecloud.io/crowdsec/crowdsec/packages/el/9/crowdsec-release-1-1.el9.noarch.rpm/download

# Install CrowdSec core
sudo dnf install -y crowdsec

# Verify the service is running
sudo systemctl status crowdsec

Step 2 – Enable the eBPF Bouncer

CrowdSec uses "bouncers" to enforce decisions. The eBPF bouncer translates decisions into kernel-level filters.

Install the eBPF bouncer (common to all Linux distros)

# Install the bouncer package
sudo crowdsec-cli bouncers install ebpf

# Load the eBPF program (requires root)
sudo /usr/lib/crowdsec/bouncers/ebpf/crowdsec-ebpf-bouncer load

# Enable and start the bouncer service
sudo systemctl enable crowdsec-ebpf-bouncer
sudo systemctl start crowdsec-ebpf-bouncer

Explanation of the commands:

• crowdsec-cli bouncers install ebpf downloads the pre-compiled eBPF program and its helper daemon.
• The load command attaches the program to the default network interface (usually eth0). Specify a different interface if needed.
• Enabling the service ensures the bouncer starts on boot and stays in sync with the CrowdSec engine.

Step 3 – Configure eBPF Filters for DDoS Mitigation

CrowdSec ships with parsers and scenarios that detect volumetric attacks such as SYN floods and HTTP GET floods. Enable the relevant scenarios and map them to eBPF actions.

Enable DDoS scenarios

# List available scenarios
sudo cscli scenarios list

# Install common DDoS scenarios
sudo cscli scenarios install crowdsecurity/http-bad-useragents
sudo cscli scenarios install crowdsecurity/ssh-bf
sudo cscli scenarios install crowdsecurity/syn-flood

# Reload CrowdSec to apply changes
sudo systemctl reload crowdsec

Map decisions to eBPF actions

Create /etc/crowdsec/bouncers/ebpf.yaml with the following content:

# /etc/crowdsec/bouncers/ebpf.yaml
ebpf:
  # Name of the eBPF map that holds blocked IPs
  map_name: crowdsec_blocklist

  # Decision types that will be translated to eBPF drops
  decisions:
    - type: ban
      # Optional: apply only to IPv4 addresses
      scope: ip

After saving, restart the bouncer:

sudo systemctl restart crowdsec-ebpf-bouncer

Step 4 – Tune Kernel Parameters for High-Throughput DDoS

Even with eBPF, the kernel’s networking stack must handle large bursts. Adjust the following sysctl settings.

Debian / Ubuntu

sudo tee /etc/sysctl.d/99-crowdsec-ddos.conf >> /dev/null <<EOF
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 50000
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_fin_timeout = 15
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_rmem = 4096 87380 6291456
net.ipv4.tcp_wmem = 4096 65536 6291456
net.ipv4.tcp_congestion_control = bbr
EOF

# Apply immediately
sudo sysctl --system

AlmaLinux / Rocky / RHEL

sudo tee /etc/sysctl.d/99-crowdsec-ddos.conf >> /dev/null <<EOF
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 50000
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_fin_timeout = 15
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_rmem = 4096 87380 6291456
net.ipv4.tcp_wmem = 4096 65536 6291456
net.ipv4.tcp_congestion_control = bbr
EOF

sudo sysctl --system

Step 5 – Verify the Deployment

Confirm that the eBPF program is active and that CrowdSec decisions appear in the kernel map.

Check the eBPF map

# List blocked IPs (requires root)
sudo bpftool map dump pinned /sys/fs/bpf/crowdsec_blocklist

If the map is empty, generate a test decision:

# Simulate a ban for 1.2.3.4 (valid for 1 hour)
sudo cscli decisions add --ip 1.2.3.4 --duration 1h --reason "test-ban"

Run bpftool map dump again; the IP should now appear.

Generate traffic to confirm filtering

From another host, attempt a simple TCP connection to your server’s public IP. If the IP is banned, the SYN packet will be dropped, and the client will see a timeout.

Step 6 – Ongoing Maintenance and Community Contributions

• Regular updates: Keep CrowdSec and its scenarios up-to-date with sudo cscli update and the OS package manager.
• Monitor logs: /var/log/crowdsec.log records decisions and any errors from the eBPF bouncer.
• Contribute: If you develop a custom parser for a specific application, submit it to the CrowdSec hub to help the community.
• Backup configurations: Store ebpf.yaml and any custom scenario files in a version-controlled repository.

Conclusion

Deploying CrowdSec with eBPF on a bare-metal server delivers a lightweight yet powerful defence against high-volume DDoS attacks. Running the filtering logic inside the kernel minimizes the performance impact on legitimate traffic while leveraging CrowdSec’s collaborative threat intelligence. Follow the steps above to install, configure, and tune the system for your environment, and keep the software updated to stay ahead of emerging threats.