Crowdsec not showing blocks in logs after update to 25.1

[julsssark]

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• [ X] I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• [X ] I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• [ X] The title contains the plugin to which this issue belongs

Describe the bug
Crowdsec was working fine under 24.7.12. After upgrading to 25.1, Crowdsec block rules are not showing up in my firewall syslog nor are they showing up in the live view. Crowdsec and firewall bouncer status both have a green check. I just saw an Alert that an IP was banned a few hours ago. Perhaps the blocks are still happening but they are just not being reported/captured by the logs?

To Reproduce
Steps to reproduce the behavior:

1. Confirm Crowdsec is running under 24.7.12 and blocks are visible in the live view.
2. Upgrade to 25.1
3. Check live view and note that Crowdsec blocks are no longer being reported

Expected behavior
Syslogs and live view should display the Crowdsec rule/name for the Crowdsec blocked traffic

OPNsense 25.1 (amd64)
Protectli FW4B

[Monviech]

I saw this in my rules.debug log today, maybe related

> #debug:Unable to convert address, see from for details
> # block in log quick inet from "$crowdsec_blacklists" to {any} tag crowdsec label "26f03fe91d0ddd12bcd5b3afdab61031" # CrowdSec (IPv4)
> #debug:Unable to convert address, see from for details
> # block in log quick inet6 from "$crowdsec6_blacklists" to {any} tag crowdsec label "bac4a0aff3ee62fcf2921b0f0011628d" # CrowdSec (IPv6)

[AdSchellevis]

likely fixed with the removal of the dollar sign in front of the from

plugins/security/crowdsec/src/etc/inc/plugins.inc.d/crowdsec.inc

Line 55 in 49467c3

'from' => '$crowdsec_blacklists', # $ to reference an alias

plugins/security/crowdsec/src/etc/inc/plugins.inc.d/crowdsec.inc

Line 71 in 49467c3

'from' => '$crowdsec6_blacklists', # $ to reference an alias

[cookiemonsteruk]

Nice find @Monviech @AdSchellevis
Only trouble with the Crowdsec plugin is that to my knowledge, the crowdsec team might not be alerted to these reports.
They might not be automatically alerted.
I'm tagging @mmetc @buixor . Hopefully that will help.

[TommyC81]

Having the same issue.

[julsssark]

As someone else suggested on the OPNsense forum, a workaround is to create a manual firewall rule on the WAN interface that blocks the CrowdSec list (i.e., re-create the auto-generated floating CrowdSec rule on your WAN interface).

[mmetc]

This works too, until the PR is merged and released

# sed -E -i .bak 's/\$(crowdsec6?_blacklists)/<\1>/' /usr/local/etc/inc/plugins.inc.d/crowdsec.inc

[julsssark]

@mmetc Thank you for creating the PR! I applied your command line fix and CrowdSec is happy again