Secure Your Server: CrowdSec + UFW Botnet Defense Guide

Running a website or application server in India exposes you to legitimate traffic and a variety of malicious bots. While a basic firewall can block obvious port scans, attackers now use distributed IP ranges that change faster than static rules. CrowdSec, an open-source, community-driven intrusion-prevention engine, paired with UFW (Uncomplicated Firewall), offers a lightweight solution that automatically bans suspicious IPs and shares those bans with the wider CrowdSec network.

Why Combine CrowdSec with UFW?

• Real-time threat intelligence – CrowdSec parses logs, detects attack patterns, and adds offending IPs to a local ban list.
• Community-driven blocking – Banned IPs are shared with other CrowdSec users, helping to stop attacks at their source.
• UFW simplicity – UFW provides an easy front-end for iptables, allowing you to apply CrowdSec’s bans without writing complex rules.
• Low resource footprint – Both tools run comfortably on a 1 vCPU, 1 GB RAM VPS, common for many Indian developers.

Installing CrowdSec and UFW

Debian / Ubuntu (apt)

# Refresh package metadata
sudo apt update

# Install UFW if it is not already present
sudo apt install -y ufw

# Add CrowdSec’s official repository
sudo apt install -y curl gnupg
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash

# Install the CrowdSec engine
sudo apt install -y crowdsec

# Install the UFW bouncer that connects CrowdSec to UFW
sudo apt install -y crowdsec-firewall-bouncer-ufw

AlmaLinux / Rocky Linux / RHEL (dnf)

# Refresh package metadata
sudo dnf makecache

# Enable EPEL to get UFW
sudo dnf install -y epel-release
sudo dnf install -y ufw

# Add CrowdSec’s official repository
sudo dnf install -y curl
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.rpm.sh | sudo bash

# Install the CrowdSec engine
sudo dnf install -y crowdsec

# Install the UFW bouncer
sudo dnf install -y crowdsec-firewall-bouncer-ufw

Command explanations

• apt update / dnf makecache refreshes the local package index.
• apt install -y ufw / dnf install -y ufw installs the uncomplicated firewall utility.
• The curl … script.deb.sh or script.rpm.sh command adds CrowdSec’s official repository to your system.
• apt install -y crowdsec / dnf install -y crowdsec pulls the CrowdSec engine, which includes parsers, collectors, and the decision engine.
• crowdsec-firewall-bouncer-ufw installs a small daemon that reads CrowdSec’s ban list and translates it into UFW rules.

Securing UFW with a Baseline Policy

Before CrowdSec injects dynamic rules, set a strict default policy that allows only the services you actually need.

Baseline configuration (both OS families)

# Optional: enable UFW logging for troubleshooting
sudo ufw logging on

# Default policy: deny all incoming traffic
sudo ufw default deny incoming

# Default policy: allow all outgoing traffic
sudo ufw default allow outgoing

# Allow SSH (change 22 if you use a custom port)
sudo ufw allow 22/tcp

# Allow HTTP and HTTPS if you host a website
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Activate the firewall
sudo ufw enable

After these commands, ufw status verbose will display a minimal rule set. CrowdSec will later insert temporary deny rules for offending IPs without altering this baseline.

Configuring CrowdSec Collections and Scenarios

CrowdSec uses collections – groups of parsers and scenarios – to match specific log formats. For a typical web server, the http-logs collection is essential.

Debian / Ubuntu

# Install the HTTP logs collection
sudo apt install -y crowdsec-http

# Verify that the collection is active
sudo cscli collections list

AlmaLinux / Rocky Linux / RHEL

# Install the HTTP logs collection
sudo dnf install -y crowdsec-http

# Verify that the collection is active
sudo cscli collections list

The cscli collections list command shows which parsers and scenarios are loaded. By default, the http-bad-bots and http-sqli scenarios monitor /var/log/nginx/access.log (or Apache’s log if that is your server).

Custom log paths

When your web server writes logs to a non-standard location, create a custom acquisition file:

sudo mkdir -p /etc/crowdsec/acquisitions.d
sudo tee /etc/crowdsec/acquisitions.d/custom-http.yaml > /dev/null <<EOF
source: file
filename: /opt/myapp/logs/access.log
labels:
  type: http
EOF

Then reload CrowdSec:

sudo systemctl restart crowdsec

Connecting CrowdSec to UFW via the Bouncer

The bouncer daemon reads CrowdSec’s decision store (a SQLite database by default) and creates temporary UFW rules that block offending IPs for a configurable duration.

Set ban duration (both OS families)

# Open the bouncer configuration
sudo nano /etc/crowdsec/bouncers/ufw.yaml

Set ban_duration in seconds. For a six-hour ban:

ban_duration: 21600

Save the file and restart the bouncer:

sudo systemctl restart crowdsec-firewall-bouncer-ufw

Verify that bans are applied

# Add a test decision (replace 1.2.3.4 with a test IP)
sudo cscli decisions add --ip 1.2.3.4 --duration 1h --reason "test block"

# List active UFW rules
sudo ufw status numbered

You should see a rule similar to DENY IN from 1.2.3.4 near the top. The rule is automatically removed after the configured ban_duration expires.

Monitoring, Updating, and Fine-Tuning

• View recent decisions – sudo cscli decisions list shows which IPs are currently blocked and why.
• Check parser health – sudo cscli metrics reports log ingestion rates and any parsing errors.
• Update collections – sudo cscli hub update pulls new scenarios and community signatures.
• Whitelist trusted sources – If a legitimate service (e.g., a CDN edge node) is blocked, add it to the whitelist:

sudo cscli decisions add --ip 203.0.113.45 --type whitelist --duration forever --reason "Trusted CDN"

After adding or removing decisions, reload the bouncer:

sudo systemctl restart crowdsec-firewall-bouncer-ufw

Conclusion

Pairing CrowdSec’s community-driven, log-based detection with UFW’s simple rule management delivers a dynamic defense that adapts to new botnet activity without imposing significant overhead on a modest VPS. The steps above cover installation on Debian/Ubuntu and AlmaLinux-based distributions, baseline firewall hardening, collection configuration, and ongoing monitoring. By keeping the CrowdSec hub updated and fine-tuning the rules, you reduce unwanted traffic, protect your applications, and contribute to a safer web environment in India.