Crowdsec not starting (found solution from legacy series post)

[Amodin]

Referencing this post: https://forum.opnsense.org/index.php?topic=47580.0

I was trying to get a GeoIP exception list to work, which I can't seem to get to work, and restarted the Crowdsec service to restart from the Dashboard Services.  When I did that, Crowdsec refused to start, even after rebooting the OPN machine.

Following that post, I found it odd that I had to disable the ruleset to get it started. 

1.Has there been a workaround planned or in place that I am missing, and...
2.Has anyone had any luck with creating an exception list by DNS names?  I even asked Grok about solutions, which was to put my alias in a network group alias and replace my rule with that group.  It told me that IPs were preferred, but domain names sometimes have multiple providers/IPs and that's going to be more time consuming.  It's just easier to disable GeoIP, get what I want, then re-enable it. Not a great solution, and yes my rule is above the GeoIP rule.

[tangofan]

According to the docs at https://docs.opnsense.org/manual/aliases.html you can indeed use fully-qualified domain names in aliases, though I haven't tried that myself.

I am not what the Crowdsec service has to do with your GeoIP problem and I can't really comment as to what's going on with CrowdSec, so I'll focus on the GeoIP problem.

Re. exceptions lists and changes to firewall rules: The firewall is stateful, so if you change certain rules (or aliases which affect rules) you might need to reset its state at Firewall: Diagnostics: States on the action tab. For good measure I usually click both button there.

Also your problem might be solved by setting your GeoIP firewall rule as an inbound rule on the WAN interface only and not on any of the LAN interfaces and VLANs. That way all your own actions, e.g. using a website in a blocked country still should work. (Don't forget to reset the firewall state after making the change.) If that doesn't help, you'll need to explain in greater detail, what scenario are you trying to cover with GeoIP and show your firewall rules.

[Amodin]

Yeah, I read that too which is what's perplexing and filtering doesn't seem to be consistent, because I have multiple DNS names in my exception alias, and one of them is this domain we are at, lol.  But others simply won't go through.  The only thing I can figure is what I saw in the referenced post about Crowdsec hosting in Ireland which I tend to receive a lot of port scanning and it's on my GeoIP blocklist. I confirmed it's GeoIP blocking, because I can disable the rule and everything is accessible.

I even forced the tables to update after making the changes in SSH, and it didn't update.

I'll double check the rule I have in place, as I believe that I have my Interface set to 'any' and see how that impacts my exceptions.