Inquiries about the http/3 and crowdsec rule

[dalso0418]

Hello. You're asking a lot of questions!

It's because the project is so good, so please understand.

I have a few more questions.

I currently opened all 443 ports with TCP/UDP, but http3check.When checked on the net, it seems that communication is not possible through http3. http 1.1

I have another question about Crowdsec.
Currently, I can only see the list as below in the basic drawsec rule, but I would like to ask if there is a way to test if things detected in nginx are blocked.

cscli collections list

Thank you.
*This content was written through a translator, so please understand even if there are mistranslations.

[Zoey2936]

https://http3check.net/?host=zoeyvid.de returns HTTP/3 for me, so did you exposed udp in all firewalls?

For crowdsec testing:
docker exec crowdsec cscli decisions add --ip 1.2.3.4 --duration 1m
Use your ip and open the site

[dalso0418]

Thank you for your reply.
but, I am using an unifi router and tcp/udp is open on both 80/443.

[Zoey2936]

http3 on; is set gloablly

[dalso0418]

I see, it was a strange experience.
I was wondering because it was recognized as http3 for a while while changing the settings (there was also a certificate error for a while)

Let me test a few more.

[dalso0418]

I think I found it.
I don't know where it was applied, but it seems to be applied through custom code on the Advanced side.
Please review it.

++There seems to be a problem with the automatically generated header ',"
Adding add_header alt-svc 'h3=":443"; ma=86400'; works fine.

[Zoey2936]

found the error, thanks for the debugging:
more_set_headers "Alt-Svc: h3=':443'; ma=86400";
need to be:
more_set_headers 'Alt-Svc: h3=":443"; ma=86400';

[Zoey2936]

will release a bug fix now

[dalso0418]

I'm glad to hear that it was helpful.

It's a fantastic project :)

[Zoey2936]

please report back if that fix helped

[dalso0418]

It's perfect. It's applied well.

[Zoey2936]

Did crowdsec at least worked?

[dalso0418]

Crowdsec blocking works well with the command you told me.

I was wondering if the cscli collections list above should include a list related to nginx if it is based on the log coming into the nginx proxy manager.

[Zoey2936]

collections has nothing todo with bouncers

[uaysk]

Hello, I looked up the official documentation related to nginx quic and found that the reuseport option was used instead of the quic option.
https://nginx.org/en/docs/quic.html

http {
    log_format quic '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" "$http3"';

    access_log logs/access.log quic;

    server {
        # for better compatibility it's recommended
        # to use the same port for quic and https
        listen 8443 quic reuseport; #The official documentation uses quic and reuseport
        listen 8443 ssl;

        ssl_certificate     certs/example.com.crt;
        ssl_certificate_key certs/example.com.key;

        location / {
            # required for browsers to direct them to quic port
            add_header Alt-Svc 'h3=":8443"; ma=86400';
        }
    }
}

It seems that only the quic option is used in the npm plus configuration file.

server {
  set $forward_scheme http;
  set $server         "localhost";
  set $port           81;

  listen unix:/run/nginx-14.sock;

  listen 0.0.0.0:80;
  listen [::]:80;


  listen 0.0.0.0:443 ssl;
  listen [::]:443 ssl;

  listen 0.0.0.0:443 quic;
  listen [::]:443 quic;

  more_set_headers "Alt-Svc: h3=':443'; ma=86400";

I'm not sure exactly what the reuseport option does. However, it seems to be used with quic in other documents besides the official document.

[Zoey2936]

reuseport is used inside the default.conf, it can and must only be used once

[uaysk]

Thank you for answer

[Zoey2936]

I've found the error, the default.conf is created empty, will be fixed in the next release

[uaysk]

Thank you, I updated docker image and it works fine