Open-source system

CrowdSec for attack protection

Alternative to Cloudflare WAF

Monitors intrusion and brute-force attempts on your website and servers, blocking them automatically.

Available on request: We set it up for you when you ask for it.

Request it + Add to request All systems in IT operations and security

System facts

Alternative to
Cloudflare WAF, Commercial firewalls
Built on
CrowdSec (MIT license)
Hosting
We host it for you in Egypt: Link Datacenter in Egypt or Huawei Cloud, Cairo region
Language
Interface in English
Sign-in
With its own account
Ordering
On its own or in a bundle
Status
Available on request
Price
We send it to you after a short call

What it does for you

It continuously reads logs from your website and servers to detect anyone trying to guess passwords, scanning your site for vulnerabilities, or sending abusive requests, automatically blocking them before they reach anything. It runs on your servers that we host for you in Egypt.

Alternative to

If you are looking for an alternative to Cloudflare for website protection, this replaces parts of:

  • Cloudflare web application firewall (WAF) for blocking intrusion attempts.
  • Commercial firewalls for blocking known attackers.
  • Manual log inspection after an attack occurs.

What you get

  • Log analysis for Nginx and Apache web servers, SSH logins, and many other systems.
  • Known attack scenarios: brute-force password guessing, vulnerability scanning, aggressive scraping, and more from a community-updated hub.
  • Automated remediation at the server firewall level or directly at the web server.
  • CAPTCHA challenges instead of blocking when you want to verify human visitors.
  • Web Application Firewall (WAF): rules deflecting malicious requests and virtual patching for known vulnerabilities until you update software.
  • Shared blocklist: attacker IP addresses detected by other users, blocked before reaching you.
  • Multi-server support: one server detects attacks and decisions apply across all your servers.
  • Allowlists for your IP addresses and partners to prevent accidental blocks.
  • Command-line tools to inspect decisions and unblock addresses.
  • Monitoring metrics covering attacks and decisions.

Built on CrowdSec, an open-source collaborative intrusion detection and prevention engine.

Arabic and hosting in Egypt

  • Arabic: the tool is in English and managed via the command line, designed for your technical team. We send you attack summaries in Arabic as part of monthly operations.
  • Hosting: it runs on your servers inside Egypt, and we position it in front of your systems (infrastructure design).

From ready-made to built for you

  1. 01 As-is detection and blocking of brute-force attempts and vulnerability scans on your server.
  2. 02 Configured for your work scenarios for your systems, blocking on firewall and web server, and allowlists for your IPs.
  3. 03 Customization firewall rules tailored to your application and scenarios specific to your system.
  4. 04 Built for you unified protection across all your servers, with recurring reporting and monitoring integration.

Customization and building from scratch are part of our software and application development service.

Works with

Part of: Internal IT pack

  • IT helpdesk and assets

    GLPI

    Open-source system

    Employee IT support tickets and hardware, monitor, and software asset inventory in one system.

    Alternative to: ServiceNow, Freshservice

    • On request
    • Partial Arabic
    • In Egypt
    Details + Add to request

  • Remote support

    MeshCentral

    Open-source system

    Remotely access employee machines to resolve technical issues and manage endpoints from a single server dashboard.

    Alternative to: TeamViewer, AnyDesk

    • On request
    • English
    • In Egypt
    Details + Add to request

  • Team password manager

    Vaultwarden

    Open-source system

    An encrypted vault for company passwords shared across teams with role permissions, hosted on your server in Egypt.

    Alternative to: 1Password, LastPass, Bitwarden

    • On request
    • Partial Arabic
    • In Egypt
    Details + Add to request

  • Server monitoring

    Beszel

    Open-source system

    Server health and performance metrics on a single dashboard, with alerts on disk space or high CPU load.

    Alternative to: Datadog, New Relic

    • On request
    • Partial Arabic
    • In Egypt
    Details + Add to request

  • Single sign-on

    authentik

    Asas module

    One password and two-factor authentication for all systems; provision a user once across all apps with proper roles.

    Alternative to: Okta, Microsoft Entra ID

    • Demo
    • Full Arabic
    • In Egypt
    Details + Add to request

  • Remote desktop

    RustDesk

    Open-source system

    Fast remote desktop access to assist employees or clients, routed through a connection server you own.

    Alternative to: AnyDesk, TeamViewer

    • On request
    • Partial Arabic
    • In Egypt
    Details + Add to request

Who it is for

Frequently asked questions

Is it an alternative to Cloudflare WAF?

Partially: it covers web application firewalls, attacker blocking, and brute-force protection. It does not match Cloudflare global CDN network in absorbing volumetric DDoS attacks that saturate physical Internet links.

Does it protect against DDoS attacks?

It blocks application-level attacks, such as request floods from known addresses. Volumetric flooding that saturates your Internet pipe requires mitigation at the network provider level.

Will it mistakenly block our legitimate customers?

We add your IP addresses and partner IPs to allowlists, and any block can be revoked immediately.

Does it eliminate the need for software updates?

No. Virtual patching temporarily deflects known exploits, but updating software remains necessary.

Our limits

  • It does not deflect volumetric flooding that saturates the physical line; that belongs at the network provider level.
  • The shared blocklist exchanges attacker IP addresses with the upstream developer service outside Egypt; this can be disabled if your policy requires it.
  • The software is from its developer (CrowdSec); our work is hosting, configuration, operations, and support.

Attack protection: Request it

Request it info@foundationcx.com