CrowdSec Bans Almost All Requests #1646

New Issue

MrUnknownDE · 2026-04-05T19:38:17+02:00

MrUnknownDE commented

2026-04-05 19:38:17 +02:00

Originally created by @LukeGus on 4/3/2025

Hello! So I set up Pangolin via Docker using the default installer, so nothing unusual. It was working great for a long time, using several Newt servers, and I was loving it. Until I decided to delete ~100 docker images off a server using Portainer (aka I made a lot of requests to a single resource), and since then, many of the resources I try to access simply just show this error when trying to access them.

About 10% of my resources still work, and the ones that do work are very random, with nothing unusual about them. Looking at the logs for all Docker containers, they look good, except for CrowdSec, which appears to be banning almost all requests made to it for whatever reason. I believe this was caused by CrowdSec not liking it after I made many requests to that single agent, causing it to ban almost all requests to it. Here is a truncated version of the logs. These liens just get repeated every time I try to access my websites.

time="2025-04-03T04:07:22Z" level=info msg="172.18.0.4 - [Thu, 03 Apr 2025 04:07:22 UTC] \"GET /v1/decisions?ip=my-ip&banned=true HTTP/1.1 200 262.609163ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \""
time="2025-04-03T04:07:43Z" level=info msg="172.18.0.4 - [Thu, 03 Apr 2025 04:07:43 UTC] \"GET /v1/decisions?ip=my-ip&banned=true HTTP/1.1 200 246.485035ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \""
time="2025-04-03T04:08:03Z" level=info msg="172.18.0.4 - [Thu, 03 Apr 2025 04:08:03 UTC] \"GET /v1/decisions?ip=my-ip&banned=true HTTP/1.1 200 233.115019ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \""

I tried remaking a few resources, and that did not work. I tried restarting containers individually and also the entire server running pangolin and it did not help. The only thing I have not tried was recreating an agent, but since this happens on all agents, I doubt that's the issue. Any help appreciated!!!

Edit:
I have noticed that if I disconnect from my VPN (the VPN is hosted on the same server as Pangolin) then I can no longer even access any resource including the default pangolin site. The error is "You don't have authorization to view this page." This same issue goes for all devices, not just the desktop.

*Originally created by @LukeGus on 4/3/2025* Hello! So I set up Pangolin via Docker using the default installer, so nothing unusual. It was working great for a long time, using several Newt servers, and I was loving it. Until I decided to delete ~100 docker images off a server using Portainer (aka I made a lot of requests to a single resource), and since then, many of the resources I try to access simply just show this error when trying to access them. ![Image](https://github.com/user-attachments/assets/31a1b38a-86bb-491b-84a0-3ee4f1a93c42) About 10% of my resources still work, and the ones that do work are very random, with nothing unusual about them. Looking at the logs for all Docker containers, they look good, except for CrowdSec, which appears to be banning almost all requests made to it for whatever reason. I believe this was caused by CrowdSec not liking it after I made many requests to that single agent, causing it to ban almost all requests to it. Here is a truncated version of the logs. These liens just get repeated every time I try to access my websites. ``` time="2025-04-03T04:07:22Z" level=info msg="172.18.0.4 - [Thu, 03 Apr 2025 04:07:22 UTC] \"GET /v1/decisions?ip=my-ip&banned=true HTTP/1.1 200 262.609163ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" time="2025-04-03T04:07:43Z" level=info msg="172.18.0.4 - [Thu, 03 Apr 2025 04:07:43 UTC] \"GET /v1/decisions?ip=my-ip&banned=true HTTP/1.1 200 246.485035ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" time="2025-04-03T04:08:03Z" level=info msg="172.18.0.4 - [Thu, 03 Apr 2025 04:08:03 UTC] \"GET /v1/decisions?ip=my-ip&banned=true HTTP/1.1 200 233.115019ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" ``` I tried remaking a few resources, and that did not work. I tried restarting containers individually and also the entire server running pangolin and it did not help. The only thing I have not tried was recreating an agent, but since this happens on all agents, I doubt that's the issue. Any help appreciated!!! Edit: I have noticed that if I disconnect from my VPN (the VPN is hosted on the same server as Pangolin) then I can no longer even access any resource including the default pangolin site. The error is "You don't have authorization to view this page." This same issue goes for all devices, not just the desktop.

MrUnknownDE closed this issue

2026-04-05 19:38:17 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1646