# Pangolin + Crowdsec - Recent Guide? **URL:** \ **Category:** General\ **Tags:** pangolin\ **Created:** [May 21, 2026, 9:55am UTC](https://forum.hhf.technology/t/pangolin-crowdsec-recent-guide/4432 "2026-05-21T09:55:54Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![cmj01](https://forum.hhf.technology/user_avatar/forum.hhf.technology/cmj01/32/4979_2.png) [@cmj01](https://forum.hhf.technology/u/cmj01)\ **Post date:** [May 21, 2026, 9:55am UTC](https://forum.hhf.technology/t/pangolin-crowdsec-recent-guide/4432/1 "2026-05-21T09:55:54Z")
Hi everyone, does anyone have a recent guide on getting Crowdsec working with Pangolin? I’m trying to get it configured on Ubuntu 26.04 VPS using docker. However getting confused between nftables and iptables options and also syslog and journalctl. There also seem to multiple different bouncers recommended - ranging from the standard traefik one to this one: [https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin?ref=blog.lrvt.de](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin?ref=blog.lrvt.de) I’ve used the Pangolin supplied installer with the --crowdsec option which does a lot of the work. Not just trying to get everything connected but the community guide on the Pangolin site has a few steps missing I think. I also saw the comment here about not using docker if on a VPS. Can anyone elaborate on why docker route might not be the way to go? I nearly got that working but then broke Pangolin, so I’m back to the docker route again. Many thanks, Mike ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [May 29, 2026, 4:54pm UTC](https://forum.hhf.technology/t/pangolin-crowdsec-recent-guide/4432/2 "2026-05-29T16:54:30Z")
hey mike, you’re on the right track using the official installer with `--crowdsec` — that does most of the heavy lifting (Traefik logging + the **maxlerebourg Traefik plugin** ). ### Quick Answers to Your Questions - **Docker vs Host install** : On a VPS, the **Docker route** (what the installer uses) is usually fine and simpler, especially if your whole stack is Dockerized. The main reason some recommend host install is for the **firewall bouncer** (nftables/iptables), which needs better kernel access. For most people, the **Traefik plugin bouncer** (which the installer sets up) is enough and easier. - **nftables vs iptables** : On Ubuntu 26.04 you should use **nftables**. If you want the firewall bouncer, install the nftables version. - **syslog vs journalctl** : With the Pangolin setup, CrowdSec usually reads **Traefik access logs** directly (via volume mount). You generally don’t need syslog/journalctl unless you want to monitor SSH/auth logs too. ### Troubleshooting Steps 1. **Check current status** 2. **Verify Traefik is logging** Check if the access log is being written: 3. **Check the plugin is applied** Look in your `traefik_config.yml` (or dynamic config) for a middleware like: ### Common Missing Steps The community guide sometimes misses: - Restarting the stack properly after changes (`docker compose down && docker compose up -d`) - Adding more collections (e.g. `crowdsecurity/traefik`, `crowdsecurity/appsec-virtual-patching`) - Setting up the bouncer API key correctly between containers **What exactly is not working right now?** For example: - No decisions/bans appearing? - Traefik plugin errors in logs? - CrowdSec container unhealthy? - Bans not being enforced? Share the output of the commands above (especially `docker logs crowdsec` and `cscli decisions list`) and I (or others) can give you much more targeted help. Happy to walk you through the firewall bouncer setup too if you want deeper protection. hhf ---
**Author:** ![cmj01](https://forum.hhf.technology/user_avatar/forum.hhf.technology/cmj01/32/4979_2.png) [@cmj01](https://forum.hhf.technology/u/cmj01)\ **Post date:** [June 10, 2026, 9:48am UTC](https://forum.hhf.technology/t/pangolin-crowdsec-recent-guide/4432/3 "2026-06-10T09:48:44Z")
Thanks very much for the detailed reply. I’ve managed to get everything up and running using the combined Pangolin + Crowdsec install with everything apart from the bouncer containerised. Very glad I have now that I can see everyone and everything trying to break in. All the best Mike ---
**Author:** ![codewhiz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/codewhiz/32/2365_2.png) [@codewhiz](https://forum.hhf.technology/u/codewhiz)\ **Post date:** [July 12, 2026, 8:32pm UTC](https://forum.hhf.technology/t/pangolin-crowdsec-recent-guide/4432/4 "2026-07-12T20:32:10Z")
Btw I also add this at the end of my ~/.bashrc to avoid typing `docker exec -it crowdsec` again and again. `cscli` will work directly after this ```auto cscli() { # If terminal is interactive (you typing it), use -it for pretty tables. # If it's a pipe or script, drop -t so Docker doesn't throw a TTY error. if [-t 0]; then docker exec -it crowdsec cscli "$@" else docker exec -i crowdsec cscli "$@" fi } ``` ---
**Author:** ![iconoclasthero](https://forum.hhf.technology/user_avatar/forum.hhf.technology/iconoclasthero/32/3766_2.png) [@iconoclasthero](https://forum.hhf.technology/u/iconoclasthero)\ **Post date:** [September 8, 2026, 2:29pm UTC](https://forum.hhf.technology/t/pangolin-crowdsec-recent-guide/4432/5 "2026-09-08T14:29:01Z")
Sorry to jump in this thread, but I haven’t been able to find a way to create a new one. I’ve posted some questions on the discord which have received no response and I’m not sure if anything is currently being supported. I saw this topic on the crowdsec manager github and am in a similar situation: \*\*Link removed: Not allowed to post links to the HHF GitHub\*\* Crowdsec-Manager in multi-server setup Discussion #129 I’d like to know if there’s some way to be able to use the HHF Crowdsec Manager to see what’s going on with the Traefik Crowdsec bouncer(s) on the Pangolin VPS (i.e., which does not have Crowdsec running on it)? The HHF Crowdsec Manager on the “CrowdSec Host Machine” that is running the Crowdsec host engines (LAPI & AppSec) can see what they’re doing, but I don’t know how to inspect to see what’s going on with the VPS bouncer or if that’s even something that it can do. (NB: The “CrowdSec Host Machine” is another machine with the capacity to actually run the CS LAPI and AppSec engines without starving the resource-limited Pangolin VPS of RAM and thus allowing it function acceptably.) In other words, I’m at a point where - The VPS `../docker/pangolin/config/traefik/logs/access.log`is (more or less consistently—issue remain) streaming to the CS Host Machine - HHF CrowdSec Manager on the CS Host Machine is showing alerts and decisions - The VPS Traefik can get a healthcheck back on the LAPI - The VPS Traefik seem to be able to connect to the AppSec engine So it _seems_ like it should be enforcing the decisions, but I don’t really know how to verify that. Thanks!