Firewall Proxmox x Crowdsec

[Parzival_XIX]

Hello Proxmox Community,

I'm working on implementing a comprehensive security solution for my Proxmox VE 9 environment that combines the native Proxmox firewall with CrowdSec's collaborative threat intelligence. I'd like to share my planned architecture and gather feedback from experienced users.

Current Environment​

• Proxmox VE 9 (nftables-based native firewall enabled)
• Multiple LXC containers and VMs running various services
• Currently using nftables for custom firewall rules

Project Goals​

My objective is to create a layered security approach where:

1. Proxmox native firewall handles traditional perimeter defense with stateful packet filtering, network isolation, and micro-segmentation between VMs/containers
2. CrowdSec provides behavioral analysis, collaborative threat intelligence, and automated blocking of malicious actors

Proposed Architecture​

Option A: CrowdSec on Proxmox Host​

Install CrowdSec directly on the Proxmox host with the nftables bouncer, creating a centralized LAPI server that protects the hypervisor and all VMs/containers at the network level. Deploy lightweight CrowdSec agents on individual LXC/VMs to parse local logs (Apache, SSH, etc.) and report suspicious IPs back to the central LAPI.

Advantages:

• Centralized management and dashboard
• Single point for bouncer rules (blocks at hypervisor level)
• Protects Proxmox infrastructure itself
• Minimal overhead on guest systems

Concerns:

• Potential impact on host stability
• Integration complexity with Proxmox datacenter firewall

Option B: Dedicated LXC Container​

Create a privileged LXC container specifically for CrowdSec with the nftables bouncer, then configure agent-only installations on other containers/VMs that report to this central instance.

Advantages:

• Isolation from host system
• Easier backup/restore and migration
• Can leverage Proxmox Helper-Scripts for simplified deployment

Concerns:

• How to effectively integrate bouncer rules with Proxmox firewall at datacenter level?
• Network topology considerations for agent-to-LAPI communication

Technical Questions​

1. nftables Integration: Since Proxmox 9 uses the new proxmox-firewall service exclusively with nftables, how can I ensure CrowdSec's nftables bouncer doesn't conflict with Proxmox's managed tables? My understanding is that CrowdSec creates separate crowdsec and crowdsec6 tables with priority -10, but I'd appreciate confirmation from anyone running this setup.
2. Datacenter Firewall Integration: Is there a way to integrate CrowdSec decisions with the Proxmox datacenter firewall so blocked IPs are reflected across all VMs/containers automatically? The Proxmox API supports IP sets - could this be leveraged?
3. Performance Impact: For those running CrowdSec on Proxmox hosts, have you noticed any performance degradation, especially with the bouncer actively updating nftables rules?
4. Log Collection: What's the recommended approach for collecting logs from multiple LXC/VMs to the central CrowdSec instance? NFS share, rsyslog forwarding, or agent-based collection?

Expected Benefits​

• Collaborative defense: Automatic protection against IPs flagged by the global CrowdSec community
• Behavioral detection: Identify brute force, port scans, and exploitation attempts that static firewall rules might miss
• Reduced manual intervention: Automated blocking and unblocking based on threat intelligence
• Centralized visibility: Single dashboard for security events across the entire infrastructure

Implementation Plan​

1. Test deployment in LXC container on isolated VLAN
2. Configure nftables bouncer and verify no conflicts with proxmox-firewall
3. Install agents on test VMs and validate log parsing
4. Monitor performance and rule propagation
5. Gradually expand to production systems

Has anyone implemented a similar architecture? I'd greatly appreciate insights on:

• Best practices for CrowdSec placement (host vs. container)
• Integration strategies with Proxmox native firewall
• Common pitfalls to avoid
• Performance tuning recommendations

Looking forward to your expertise and suggestions!

System Specs:

• Proxmox VE 9.x
• nftables enabled
• Mix of LXC containers and KVM VMs

 

[johns86]

Hey, saw this and it's basically what we're about to try too, so keen to know how you got on. Did you end up going with host-level CrowdSec or the dedicated LXC route?


Main thing I'm curious about is if you manage to get CrowdSec decisions actually pushed into a Proxmox IPSet/datacenter firewall automatically, or is it just running as its own separate nftables layer alongside proxmox-firewall? We want to run it centrally on the node and then attach the blocklist to specific VMs rather than blanket-blocking everything, so any tips on how you handled that would be great.


Also if you got far enough, any issues with the CrowdSec bouncer's tables fighting with proxmox-firewall's own rules, and did you notice any perf hit on the host once it's actively updating rules under load?


Cheers, would really appreciate hearing how it went even if you ended up parking it.