Lab 3: Protect Traefik with the CrowdSec bouncer

What you will learn in this TP

• Declare the plugin
• Wire the middleware
• Block an address
• Trust the right proxy

Introduction #

What you will learn in this section

• Declare the plugin
• Wire the middleware
• Block an address
• Trust the right proxy

Context. Your site goes through Traefik. You want to return a 403 error to banned addresses.

Prerequisites: lab 1, Internet access to download the plugin  ·  Estimated time: 50 min

Setup #

Guided steps, with their solution.

1. 1. The files

   Why? The key is shared: CrowdSec declares it (BOUNCER_KEY_traefik), Traefik uses it.

   In a new folder:

2. 2. The middleware

   Generate the dynamic configuration and start.

3. 3. Block

   Ban your own address as seen by Traefik, then lift the ban.

4. 4. The real IP trap

   Simulate a client behind a proxy with X-Forwarded-For.

Difficulty level : ●●○○○ (2/5)