Large CrowdSec deployments can fill an ipset long before the host runs out of RAM. The kernel set may show hundreds of thousands of elements while its configured maxelem remains at the default. Increasing the CrowdSec bouncer setting alone does not enlarge an already-created set.
Inspect the live set first
ipset list -name
ipset list crowdsec-blacklists-0 | grep -E 'Header:|Number of entries:|Size in memory:|References:'
grep '^ipset_size:' /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
free -h
Compare the number of entries to the set’s maxelem and check the actual bouncer logs for failed additions. Never infer an ipset capacity issue from HTTP traffic alone. A set with 500,000 entries and maxelem 524288 is genuinely close to its cap.
Understand the safe replacement process
Older ipset versions do not offer an in-place resize operation. A safe change creates a replacement set with the same family, type and timeout semantics, loads the existing entries while retaining their remaining timeouts, and uses ipset swap. This atomically exchanges the kernel set names while iptables rules continue to reference the production name. New decisions arriving between snapshot and swap require reconciliation.
# Back up the existing set before any maintenance
ipset save crowdsec-blacklists-0 > /root/crowdsec-blacklists-0.backup
# Inspect the CREATE header before building a larger temporary set
head -n 1 /root/crowdsec-blacklists-0.backup
Do not paste a generic restore/swap sequence into production without checking timeout preservation, memory headroom and iptables references. A rollback copy must exist before migration. On busy servers, a short synchronization window or scripted reconciliation prevents missed decisions.
Keep the new limit across restarts
After the kernel replacement is verified, set ipset_size: 4194304 in the bouncer configuration. Confirm the new value using ipset list and verify the actual iptables DROP rule. Use crowdsec-firewall-bouncer -t or the service’s configured validation command before a planned restart.
iptables -S | grep 'crowdsec-blacklists-0'
ipset list crowdsec-blacklists-0 | grep -E 'maxelem|Number of entries:'
systemctl is-active crowdsec-firewall-bouncer
Finally, remember that the bouncer’s timeout is independent of maxelem. Very long CrowdSec decisions can exceed the kernel ipset timeout limit; that warning must be investigated separately from capacity. Monitor both occupancy and insertion failures.