diff --git a/src/pages/manage/reverse-proxy/access-logs.mdx b/src/pages/manage/reverse-proxy/access-logs.mdx index d7dda10d..e167bfb1 100644 --- a/src/pages/manage/reverse-proxy/access-logs.mdx +++ b/src/pages/manage/reverse-proxy/access-logs.mdx @@ -59,7 +59,7 @@ Denied L4 connections (blocked by access restrictions) are logged immediately wi ### Deny reasons -The following deny reasons can appear for both HTTP and L4 services: +The following deny reasons can appear for both HTTP and L4 services, except the `appsec_*` reasons, which are HTTP-only since AppSec does not inspect L4 traffic: | Reason | Description | |--------|-------------| diff --git a/src/pages/manage/reverse-proxy/authentication.mdx b/src/pages/manage/reverse-proxy/authentication.mdx index 8beae784..2f3d21aa 100644 --- a/src/pages/manage/reverse-proxy/authentication.mdx +++ b/src/pages/manage/reverse-proxy/authentication.mdx @@ -276,7 +276,7 @@ What gets mirrored is the request envelope, the client's headers, and the reques Credentials are withheld from the engine the same way they are withheld from backends. The proxy's session cookie, the values of any header-auth headers, the OIDC `session_token`, and the `password` / `pin` fields of the proxy's own login form are replaced with a placeholder before mirroring, whether they arrive in the body, the query string, a cookie, or a header. Only the credential value is replaced, so the surrounding form, query, and cookie jar stay fully inspectable. Everything else the client sent is mirrored as-is, since that is what the rules match on. -AppSec is only available when the proxy cluster has an AppSec endpoint configured, which is independent of IP reputation: a cluster can have one, both, or neither. If the cluster does not support AppSec, the option will not appear in the Access Control tab. It is currently available for self-hosted and bring-your-own-proxy deployments; support on NetBird Cloud clusters is coming. For setup, see the [CrowdSec setup guide](/selfhosted/maintenance/crowdsec#appsec-waf-request-inspection). +AppSec is only available when the proxy cluster has an AppSec endpoint configured, which is independent of IP reputation: a cluster can have one, both, or neither. If the cluster does not support AppSec, the option will not appear in the Access Control tab. It is currently available for self-hosted and bring-your-own-proxy deployments; support on NetBird Cloud clusters is coming. For setup, see the [CrowdSec setup guide](/selfhosted/maintenance/crowdsec#app-sec-waf-request-inspection). @@ -377,7 +377,7 @@ To remove NetBird-Only Access, reopen the modal and click **Remove**. The servic - Set the **CrowdSec IP Reputation** dropdown to **Enforce** or **Observe**. 6. To enable CrowdSec AppSec request inspection (when available, HTTP services only): - Set the **CrowdSec AppSec (WAF)** dropdown to **Enforce** or **Observe**. -6. Click **Save** (or **Save Changes** when editing). +7. Click **Save** (or **Save Changes** when editing). Access restrictions apply immediately to new connections. Existing connections that were established before the restriction was added are not affected until they reconnect. diff --git a/src/pages/selfhosted/maintenance/crowdsec.mdx b/src/pages/selfhosted/maintenance/crowdsec.mdx index a9ea4942..61fc36ee 100644 --- a/src/pages/selfhosted/maintenance/crowdsec.mdx +++ b/src/pages/selfhosted/maintenance/crowdsec.mdx @@ -8,7 +8,7 @@ export const description = 'Enable CrowdSec IP reputation blocking and AppSec (W [CrowdSec](https://www.crowdsec.net) is an open-source security engine that combines local detection with a crowdsourced threat feed. Agents installed across the CrowdSec community share decisions about malicious IPs, and that shared intelligence is redistributed as blocklists that any CrowdSec instance can consume. NetBird Proxy integrates with CrowdSec to check every incoming client IP against a local decision cache and block connections from flagged addresses before they reach your services. For background on the wider CrowdSec platform, see the [CrowdSec documentation](https://docs.crowdsec.net). -This page covers how the integration works and how to operate it. For full setup instructions, see [Step 7: Enable CrowdSec IP reputation](/selfhosted/migration/enable-reverse-proxy#step-7-optional-enable-crowdsec-ip-reputation) in the Enable Reverse Proxy guide. +This page covers how the integration works and how to operate it. For full setup instructions, see [Step 7: Enable CrowdSec IP reputation](/selfhosted/migration/enable-reverse-proxy#step-7-optional-enable-crowd-sec-ip-reputation) in the Enable Reverse Proxy guide. If you're running the [quickstart script](/selfhosted/selfhosted-quickstart) for a fresh installation, it offers to enable CrowdSec automatically when you choose the built-in Traefik option and enable the proxy. @@ -114,7 +114,9 @@ appsec_configs: - crowdsecurity/appsec-default labels: type: appsec -``` Setting the URL makes the proxy advertise the `supports_appsec` capability, which is what lets a service select an AppSec mode. Nothing is inspected until a service opts in. +``` + +Setting the URL makes the proxy advertise the `supports_appsec` capability, which is what lets a service select an AppSec mode. Nothing is inspected until a service opts in. Confirm the proxy picked it up: @@ -170,7 +172,7 @@ Enrollment is optional. The bouncer continues to sync the community blocklist wi ## Configuring services -Once CrowdSec is enabled on the proxy, the **CrowdSec IP Reputation** dropdown appears in the Access Control tab of each reverse proxy service, and the **CrowdSec AppSec (WAF)** dropdown appears when the AppSec endpoint is configured too. Set each to **Enforce** or **Observe** per service. A good rollout is AppSec in **Observe** with IP reputation in **Enforce**: out-of-band rules still produce ban decisions that the reputation check enforces, while you review the access logs for false positives. See [reverse proxy authentication](/manage/reverse-proxy/authentication#crowdsec-ip-reputation) for configuration steps and [access logs](/manage/reverse-proxy/access-logs) for the verdict fields that appear in event logs. +Once CrowdSec is enabled on the proxy, the **CrowdSec IP Reputation** dropdown appears in the Access Control tab of each reverse proxy service, and the **CrowdSec AppSec (WAF)** dropdown appears when the AppSec endpoint is configured too. Set each to **Enforce** or **Observe** per service. A good rollout is AppSec in **Observe** with IP reputation in **Enforce**: out-of-band rules still produce ban decisions that the reputation check enforces, while you review the access logs for false positives. See [reverse proxy authentication](/manage/reverse-proxy/authentication#crowd-sec-ip-reputation) for configuration steps and [access logs](/manage/reverse-proxy/access-logs) for the verdict fields that appear in event logs. ## Testing the integration diff --git a/src/pages/selfhosted/migration/enable-reverse-proxy.mdx b/src/pages/selfhosted/migration/enable-reverse-proxy.mdx index 202edaf7..d567bae2 100644 --- a/src/pages/selfhosted/migration/enable-reverse-proxy.mdx +++ b/src/pages/selfhosted/migration/enable-reverse-proxy.mdx @@ -408,7 +408,7 @@ docker compose up -d proxy docker compose logs proxy | grep -i appsec ``` -You should see `CrowdSec AppSec inspection available at http://crowdsec:7422/`. AppSec then appears as a per-service option under **Access Control** alongside IP reputation, off by default. For custom rules, tuning, and testing, see [AppSec (WAF) request inspection](/selfhosted/maintenance/crowdsec#appsec-waf-request-inspection). +You should see `CrowdSec AppSec inspection available at http://crowdsec:7422/`. AppSec then appears as a per-service option under **Access Control** alongside IP reputation, off by default. For custom rules, tuning, and testing, see [AppSec (WAF) request inspection](/selfhosted/maintenance/crowdsec#app-sec-waf-request-inspection). Start with **observe** rather than **enforce**. Inspection is synchronous and enforce mode fails closed, so a misconfigured or unreachable engine would deny requests to every service that enforces it. @@ -689,7 +689,7 @@ The proxy is configured entirely through environment variables (each one maps to ### IP reputation (CrowdSec) -See [Step 7: Enable CrowdSec IP reputation](#step-7-optional-enable-crowdsec-ip-reputation) for the full setup. +See [Step 7: Enable CrowdSec IP reputation](#step-7-optional-enable-crowd-sec-ip-reputation) for the full setup. | Variable | Required | Description | Default | |----------|----------|-------------|---------|