VPS Security Guide · 2026

CrowdSec VPS Guide 2026: Install a Crowdsourced IPS on Your Linux Server

By CloudPicked Review Team  ·  Last updated: October 2026  ·  Facts verified from crowdsec.net and docs.crowdsec.net

A VPS exposed to the internet is scanned and attacked within minutes of going live — SSH brute-force, port scanning, web exploits, and DDoS botnets are constant threats every server owner faces. Traditional tools like Fail2ban only see attacks hitting your machine. CrowdSec takes a different approach.

CrowdSec is an open-source IDS/IPS that leverages crowdsourced threat intelligence — 70,000+ servers worldwide share malicious IP data, giving you a community blocklist that is 7–60 days ahead of other vendors. And the core engine is completely free.

What is CrowdSec?

CrowdSec is an open-source Security Engine (version v1.8 as of 2026) that detects and blocks malicious behavior on servers. Unlike Fail2ban, it uses Crowdsourced Threat Intelligence — when your server detects a malicious IP, that data is contributed to the community and returned as a continuously updated community blocklist that every CrowdSec user receives automatically.

Core Architecture

CrowdSec is made up of four main components:

1. Log Processor — reads logs from defined sources (SSH, Nginx, Apache, etc.) and analyzes patterns against scenarios
2. AppSec (WAF) — filters malicious HTTP requests; supports web exploit and bot detection
3. Local API (LAPI) — the broker between the Log Processor and Remediation Components
4. Remediation Components (Bouncers) — enforce decisions: block IPs at the firewall, Nginx, or reverse proxy level

CrowdSec vs Fail2ban: Direct Comparison

Fail2ban remains a solid tool, but CrowdSec offers significant advantages in 2026:

Data as of October 2026 — verified from docs.crowdsec.net

Performance Statistics (verified from crowdsec.net)

From a real-world case study: Nicolas Iung, Head of CERT at Crédit Mutuel: "CrowdSec blocked 66.6 million attempts compared to Palo Alto's 11 million in the same period — with zero false positives."

Install CrowdSec on Ubuntu/Debian VPS

The following steps work on Ubuntu 22.04/24.04 LTS and Debian 11/12:

Step 1: Add the Repository

curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash

Step 2: Install CrowdSec

sudo apt update
sudo apt install crowdsec -y

After installation, CrowdSec detects your OS and automatically adds appropriate collections such as crowdsecurity/linux and crowdsecurity/nginx if Nginx is installed.

Step 3: Check Status

sudo systemctl status crowdsec
sudo cscli metrics

Step 4: View Installed Collections

sudo cscli collections list

Install additional collections as needed:

sudo cscli collections install crowdsecurity/nginx
sudo cscli collections install crowdsecurity/apache2
sudo cscli collections install crowdsecurity/sshd

Configure the Firewall Bouncer (cs-firewall-bouncer)

The Firewall Bouncer is a Remediation Component that blocks flagged IPs by injecting rules directly into iptables or nftables:

Install Firewall Bouncer

sudo apt install crowdsec-firewall-bouncer-iptables -y

Or for nftables (recommended on Ubuntu 22.04+):

sudo apt install crowdsec-firewall-bouncer-nftables -y

Verify the Bouncer

sudo cscli bouncers list

Output should show cs-firewall-bouncer with status valid.

Test That the Bouncer Is Working

sudo cscli decisions list

This shows currently banned IPs. If the community blocklist loaded successfully you'll see thousands of entries.

Configure the Nginx Bouncer (Layer 7)

The Nginx Bouncer operates at the HTTP layer — it can respond with a 403 Forbidden, CAPTCHA challenge, or redirect instead of just silently dropping packets at the firewall level.

Install Nginx Bouncer

sudo apt install crowdsec-nginx-bouncer -y

Configure /etc/crowdsec/bouncers/crowdsec-nginx-bouncer.conf

API_KEY=<your-api-key>  # get it from: sudo cscli bouncers list
API_URL=http://127.0.0.1:8080

Add Directives to Your Nginx Server Block

server {
    # ...
    lua_package_path "/usr/local/share/lua/5.1/?.lua;;";
    access_by_lua_file /usr/lib/crowdsec/lua/nginx/access.lua;
    # ...
}

Then reload Nginx:

sudo nginx -t && sudo systemctl reload nginx

Essential cscli Commands

cscli is the primary CLI tool for managing all aspects of CrowdSec:

CrowdSec Console — Free Web Dashboard

The CrowdSec Console (app.crowdsec.net) is a web dashboard that lets you:

• View alerts and decisions in real time
• Manage multiple Security Engines from one place
• Receive notifications when attack volume surges
• View Prometheus metrics in a visualized format

Connect your Security Engine to the Console:

sudo cscli console enroll <enrollment-key-from-console>
sudo systemctl restart crowdsec

The Console Community tier is free with no limit on the number of enrolled Security Engines.

Pricing and Premium Plans (verified from crowdsec.net/pricing — October 2026)

For individual VPS owners and startups, the free Security Engine + Community Blocklist provides solid day-to-day protection. Premium tiers are designed for organizations that need threat intelligence weeks ahead of the community blocklist.

Who Should Use CrowdSec?

Works great with:

• VPS running Nginx/Apache + WordPress
• Servers with SSH exposed publicly
• Self-hosted services (Gitea, Nextcloud, Mattermost)
• Shared hosting running WHM/cPanel (native support)
• Docker container deployments
• Kubernetes clusters

May not be necessary if:

• You use managed shared hosting where the provider handles security (e.g., AsiaGB, Ruk-Com Cloud with CPGuard/Imunify360)
• You have Cloudflare WAF in front of your origin and do not run the origin server directly

Frequently Asked Questions