Cloudflare Tunnels and NPM + Crowdsecurity

Arnieno Maraan

— 1 min read
Cloudflare Tunnels and NPM + Crowdsecurity
Photo by FlyD / Unsplash

Architecture of my homelab proxmox cloudflare exposed tunnels,
Client -> Cloudflare Tunnels -> NPM -> Crowdsecurity -> Return


Cloudflare Tunnels and NPM + Crowdsecurity
Porkbun DNS

Prerequisite:
DNS
Cloudflare Account (Free)
Docker
Debian

Install Crowdsecurity Example Docker Compose NPM + Crowdsec Template:
https://github.com/crowdsecurity/example-docker-compose/tree/main/npm

Setting up Cloudflare SSL Certificate
https://gist.github.com/prateekrajgautam/75afbaa9bcda8eb1dfb6b5ceecd25e8c

Dont mind 2.2 its just your ip address, check comment discussion your everything needs

When adding "New Proxy Host" Within NPM, add this additional config within "Advanced" tab

set_real_ip_from 172.35.0.0/24;
real_ip_header CF-Connecting-IP;

Change "172.35.0.0/24" Your Cloudflare Tunnel Private IP, then you are good to go.

After adding everything, check your crowdsec logs

npm/data/logs
tail -f proxy-host-1_access.log

visit your configured website if your own ip is being logs, also you can ban yourself

docker exec crowdsec cscli decisions add --ip <YOURIP>
docker exec crowdsec cscli decisions remove --ip <YOURIP>
Double check your network if you're in lan or vpn

More Detailed Documentation on next post, 5:12AM 3/27/2025 PHT Need to sleep just post these so i wont forget :> Night

Read more