Testing (Banning and Un-banning IP addresses)

Testing banning and un-banning of IP Addresses.

To verify that the CrowdSec bouncer is correctly intercepting and remediating (blocking) traffic, you should perform a manual "Decision" injection. This simulates a real-world ban without having to actually attack your own infrastructure.

1. The Smoke Test (Manual Ban)

The most direct method is to manually ban your own IP (preferably from a device on a different network, like a mobile phone on LTE, to avoid locking yourself out of your management console).

On your Docker host, run:

# Replace '1.2.3.4' with your external mobile IP or a test VM IP
docker exec crowdsec cscli decisions add --ip 1.2.3.4 --reason "manual verification"

2. Verification of the Ban

Once the decision is added, attempt to access any service protected by the crowdsec-bouncer@file middleware from that banned IP.

Expected Behavior: You should receive an HTTP 403 Forbidden (default) or a connection rejection.
Bouncer Check: Check the bouncer logs to see the interception in real-time:
```
docker logs -f crowdsec-bouncer
```
You should see a log entry indicating a "GET" request was "Forbidden" for the banned IP.

3. Reviewing Decisions

To see all currently active bans in the CrowdSec database, use the CLI:

docker exec crowdsec cscli decisions list

4. Reverting the Test (Unbanning)

Once you have confirmed the block is working, remove the decision to restore access:

docker exec crowdsec cscli decisions delete --ip 1.2.3.4

5. Advanced: Testing the "Log-to-Block" Pipeline

If you want to ensure CrowdSec is actually "reading" your Traefik logs and auto-banning based on behavior (e.g., path traversal), you can simulate a mild attack from a non-critical machine:

# Attempt to access a sensitive file multiple times
curl -I "https://whoami.fullmetaled.com/.env"
curl -I "https://whoami.fullmetaled.com/etc/passwd"

After a few attempts, CrowdSec’s http-cve or traefik collections should detect the pattern and automatically issue a ban. You can verify this by running cscli decisions list again.