Two years ago I moved a client's edge servers from fail2ban to CrowdSec, expecting a slog through YAML. Instead it just quietly worked, and every new box I've touched since gets CrowdSec on it by default. I'm an infra guy, not a security vendor, so here's my crowdsec vs fail2ban verdict without the marketing spin.
What each one actually is
fail2ban is a regex jail. It watches logs, counts failed SSH attempts, and when an IP crosses the line it drops an iptables rule for ten minutes. Tiny, simple, boring to run. I've had it on servers with barely 128 MB of RAM free and never noticed it was there.
CrowdSec does that same local job but adds one thing fail2ban physically can't: a shared blocklist. When a scanner pokes my VPS, every other CrowdSec user sees that IP as known-bad too. My servers now learn from attacks that never even reached them. That single feature is what broke my habit of reaching for fail2ban.
Where crowdsec vs fail2ban actually differs
The honest truth is both will stop an SSH brute force cold. The real difference is reaction time and learning curve. fail2ban only ever sees logs from the one host it lives on, so a fresh box has a blind first ten minutes while it figures out who's knocking. CrowdSec's community list usually knows the IP before it arrives.
The flip side: CrowdSec is not set-and-forget. Its config is YAML parsers and scenarios, not regex jails, and you will read the error docs at least twice before your first nginx bouncer behaves the way you want. For a lone box that just wants the door slammed on SSH, fail2ban is still the right answer and nobody should feel bad about it.
The smart move I landed on
I run both, and they coexist fine as long as only one owns a given firewall chain. fail2ban keeps its narrow SSH jail on the legacy boxes, CrowdSec handles everything else - web traffic, community blocklists, anything multi-host. You want CrowdSec the moment you have more than one server, or you're done watching the same botnet rotate through your logs every morning.
The rest of the stack matters too. Blocking IPs is only half the job; you also want eyes on what actually runs inside your hosts and a backup you can prove works. If you'd rather not assemble all of that yourself one compose file at a time, I packaged CrowdSec, Wazuh, and restic into three ready-to-run stacks in the SMB Security Pack - https://symshah.gumroad.com/l/smb-security-pack - $15 one-time, free updates after.
FAQ
Should I replace fail2ban with CrowdSec? Only if you have more than one host or want the shared blocklist. For a single small box, fail2ban's simplicity wins.
Can fail2ban and CrowdSec run together? Yes, but make sure only one of them owns any given firewall chain or they'll clobber each other.
Is CrowdSec hard to set up? Steeper than fail2ban - YAML parsers and scenarios take a few hours to get comfortable with, but the shared threat intel is worth it across multiple servers.
Top comments (0)