Protek.

Pulls attacker decisions from CrowdSec and pushes them to the router, so bans happen at the network edge — with a NOC dashboard over all of it.

Why I built it

CrowdSec on a single server only protects that server. Protek moves the ban to the network edge: when an attacker trips a CrowdSec scenario anywhere, it lands on the MikroTik router’s firewall and is dropped before it reaches anything behind it.

How it works

1. CrowdSec flags an IP — a scenario fires on any server running CrowdSec.
2. Protek updates the router — the decision is reconciled into an address list on the router’s firewall.
3. The edge drops the traffic — before it reaches anything behind the router.

What it does

• Fans out to more than one firewall — MikroTik, pfSense, OPNsense, iptables/ipset and Cloudflare.
• Federation — pull decisions from several CrowdSec instances, merge them, and score how strongly the sources agree.
• Threat intel on every attacker — ASN, GeoIP, WHOIS, rDNS, CrowdSec CTI, Tor-exit and VPN detection.
• A NOC dashboard — live block feed, attack-origin map, scenarios, sync status, audit log, and two-factor login.

Engineering decisions

• A pure, tested diff engine — each cycle it decides what to add to and remove from the router’s address list, pushes the change in batches, and only ever touches entries it created.
• Dry-run by default and self-healing — nothing is pushed until you say so, and drift on the router is corrected on the next cycle.