Troubleshooting

Connection issues

Cannot connect to MikroTik

Error: dial tcp: connection refused

The bouncer cannot reach the MikroTik API port.

1. Verify the API service is enabled

   /ip/service/print where name=api

2. Check the port matches your configuration (default: 8728, TLS: 8729)

3. Verify firewall rules allow access from the bouncer’s IP

4. If using Docker, ensure the container can reach the router network

Authentication failed

Error: cannot log in

Wrong username or password.

1. Verify credentials in your configuration file

2. Check the user exists and has the correct group

   /user/print where name=crowdsec

3. Verify the user’s group has required policies: api, read, write

4. Check allowed address restrictions on the user account

TLS certificate errors

Error: x509: certificate signed by unknown authority

TLS verification failed.

1. For self-signed certificates, set the CA path:

   crowdsec:
     ca_cert_path: "/path/to/ca.pem"

2. Verify the certificate is valid and not expired

3. Check the hostname matches the certificate’s CN or SAN

CrowdSec LAPI issues

Cannot connect to LAPI

Error: connection to CrowdSec LAPI failed

The bouncer cannot reach the CrowdSec Local API.

1. Verify the LAPI URL

   curl http://localhost:8080/v1/decisions

2. Check the bouncer API key

   cscli bouncers list

3. If CrowdSec runs in Docker, ensure network connectivity between containers

No decisions received

Bouncer starts but no IPs are banned

The bouncer connects successfully but the address list stays empty.

Possible causes:

1. No active decisions — check with cscli decisions list
2. Origin filtering too restrictive — check crowdsec.origins config
3. Scenario filtering excludes all — check crowdsec.scenarios_containing / crowdsec.scenarios_not_containing
4. CrowdSec engine not detecting threats — check CrowdSec logs

Firewall rule issues

Rules not created

Address list has entries but no firewall rules

IPs are added to the address list but no firewall rules exist.

1. Check filter and raw are enabled

   firewall:
     filter:
       enabled: true
     raw:
       enabled: true

2. Look for errors in logs

   journalctl -u cs-routeros-bouncer -f

3. Verify the user has write policy for firewall operations

Rules in wrong position

Firewall rules appear at the bottom

Rules may be placed after existing rules.

1. Verify rule_placement: "top" in configuration

2. Check for dynamic rules at position 0 (the bouncer skips these and places after)

3. Inspect positions manually

   /ip/firewall/filter print
   /ip/firewall/raw print

Performance issues

High CPU during reconciliation

Router CPU spikes during bouncer startup

This is expected during initial reconciliation with large address lists.

Performance benchmarks:

List size	Time	CPU peak
~1,500 IPs (local)	~9 s	~14%
~25,000 IPs (full CAPI)	~2 min 50 s	~23%

To reduce impact:

1. Filter synced decisions with origins:

   crowdsec:
     origins: ["crowdsec", "cscli"]

2. Schedule bouncer restarts during low-traffic periods
3. CPU impact is temporary — only during reconciliation

Logging and debugging

Debug logging

logging:
  level: "debug"

Or via environment variable:

LOG_LEVEL=debug cs-routeros-bouncer run -c config.yml

Health check

curl http://localhost:2112/health

Metrics

curl http://localhost:2112/metrics

Router state

# View address list entries
/ip/firewall/address-list print where list=crowdsec-banned

# Count entries
/ip/firewall/address-list print count-only where list=crowdsec-banned

# View bouncer firewall rules
/ip/firewall/filter print where comment~"crowdsec-bouncer"
/ip/firewall/raw print where comment~"crowdsec-bouncer"

Docker-specific issues

Container cannot reach router

Connection timeout from Docker container

Docker networking may prevent the container from reaching the router.

1. Use host networking in Docker Compose:

   services:
     cs-routeros-bouncer:
       network_mode: host

2. Or ensure the Docker network can route to the router’s IP

3. Check DNS resolution if using hostnames

Permission denied for config file

Error: permission denied reading config

The container user cannot read the mounted config file.

1. Check file permissions: chmod 644 config.yml

2. If using Docker secrets, ensure the secret is properly mounted

3. Or use environment variables instead of a config file