docker-pi-hole VS crowdsec

Yesterday I deployed the official pi hole docker container on my raspberry pi 3 and set a custom DNS address on my phone addressing to the pi.

More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/

version: "3" # More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/ networks: dns_net: driver: bridge ipam: config: - subnet: 10.2.0.0/24 services: pihole: depends_on: [unbound] container_name: pihole image: pihole/pihole:latest hostname: pihole networks: dns_net: ipv4_address: 10.2.0.100 ports: - "5335:53/tcp" - "5335:53/udp" - "7000:80/tcp" environment: TZ: ${TZ} WEBPASSWORD: ${PWD} FTLCONF_LOCAL_IPV4: ${HOST_IP} # Set to server's LAN IP, used by web block modes. PIHOLE_DNS_: 10.2.0.200 # Upstream DNS server(s) for Pi-hole to forward queries to, separated by a semicolon DNSMASQ_LISTENING: all # "Listen on all interfaces, permit all origins" # Volumes store your data between container upgrades volumes: - /var/lib/docker/volumes/pihole/etc-pihole:/etc/pihole - /var/lib/docker/volumes/pihole/etc-dnsmasq.d:/etc/dnsmasq.d healthcheck: disable: true restart: unless-stopped unbound: # https://github.com/MatthewVance/unbound-docker container_name: unbound image: mvance/unbound:latest hostname: unbound networks: dns_net: ipv4_address: 10.2.0.200 ports: - "${HOST_IP}:53:53/udp" - "${HOST_IP}:53:53/tcp" healthcheck: disable: true restart: unless-stopped

services: pihole: container_name: pihole image: pihole/pihole:latest hostname: pihole # Container hostname (optional) domainname: mynetwork.local # Container domain (optional) mac_address: f7:55:63:b0:68:83 # Random MAC address (optional) networks: virtualnet: # Name of macvlan ipv4_address: 192.168.100.249 # Desired IP for pihole dns: - 127.0.0.1 - 1.1.1.1 ports: - "53:53/tcp" - "53:53/udp" - "67:67/udp" - "80:80/tcp" - "443:443/tcp" volumes: - ./pihole-configs/:/etc/pihole/ - ./dnsmasq.d-configs/:/etc/dnsmasq.d/ # DNSMASQ_USER # https://github.com/pi-hole/docker-pi-hole/issues/963 # https://github.com/pi-hole/docker-pi-hole/blob/master/README.md#upgrade-notes environment: FTLCONF_LOCAL_IPV4: 10.59.0.6 # Desired IP for pihole VIRTUAL_HOST: pihole.mynetwork.local DNSMASQ_USER: root PIHOLE_DNS_: 1.1.1.1;1.0.0.1;2606:4700:4700::1111;2606:4700:4700::1001 restart: unless-stopped # Set container to always restart

I have't yet used the NAS with docker so I don't know how exactly to set it up, but I run my pihole in a container and I just followed the official guide https://github.com/pi-hole/docker-pi-hole

More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/

The Pi-hole documentation addresses the port 53 conflict for Ubuntu and Fedora. See the section “Installing on Ubuntu or Fedora” on this page.

Docker Tag 2023.02.2

Hey we actually built the second part as a product. Its a modern revamp of fail2ban combined with crowdsourcing aspect to deliver an up-to-date blocklist of active threats. You can check it out at https://github.com/crowdsecurity/crowdsec

This tool crowdsec.net is really interesting to mitigate and enact defense systems for different scenarios.

CrowdSec is licensed under MIT open source license, you can find a copy of the text here: “Copyright 2020, CrowdSec SAS (http://crowdsec.net), Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.” That’s all there is to it. Like in the case of Debian, you can do anything you want with it, for free, period. You just need to embed this license when you redistribute the product.

Do I need something like crowdsec, or is WireGuard secure enough on its own?

You could try out https://crowdsec.net. It’s an advanced FOSS framework for detecting a number of different attacks and not limited to just brute force attacks like Fail2Ban as /u/nonself suggests. The basic concept of CrowdSes is that it reads log, detects attacks, mitigates attacks (CrowdSec integrates directly into the Flask application) and shares information about those attacks with everyone else using CrowdSec. Disclaimer: I am head of community at CrowdSec so my opinions may be a little biased :-)

You need to setup reverse proxy. nginx-proxy-manager, swag. There are also more options like caddy, haproxy etc... You can also setup a VPN and or a service like authelia, fail2ban, crowdsec to restrict access to your site.

Release v1.4.1 · crowdsecurity/crowdsec (github.com)

Not what you suggested but have you considered https://crowdsec.net? Not just a collaborative and more advanced version of Fail2Ban but in this case you want it because of the collaborative blocklist; we made an article showing that 92% of attacks was blocked in advanced by ip reputation before any attacks were performed. Disclaimer: I am head of community so I might be a bit biased. It’s still a cool FOSS project though :-)

You need to look into reverse proxy. Most common one is nginx-proxy-manager which has a nice GUI. There is also SWAG. Both can been configured to get free SSL certificates. For security: authelia, fail2ban, crowdsec. I also suggest to configure wireguard, wg-easy. If you have any questions, we are here. Welcome and good luck!

So in that way everybody using CrowdSec are helping each other out. More information at https://crowdsec.net.