Hello,

I'm trying to protect my (downstream) nginx reverse proxy with crowdsec with the crowdsec-nginx-bouncer installed
Which blocks Outlook 2024 lts access over https from an external ip very quick because of 401 and 403 replies

On the reserve proxy:

$ sudo cscli alerts list
╭─────┬───────────────────┬──────────────────────────────────┬─────────┬───────────────┬───────────┬──────────────────────┬──────────╮
│  ID │       value       │              reason              │ country │       as      │ decisions │      created_at      │   kind   │
├─────┼───────────────────┼──────────────────────────────────┼─────────┼───────────────┼───────────┼──────────────────────┼──────────┤
│ 208 │ Ip:<ETERNAL-IP>   │ LePresidente/http-generic-403-bf │ NL      │ 1136 KPN B.V. │ ban:1     │ 2026-10-27T15:07:42Z │ crowdsec │
│ 207 │ Ip:<ETERNAL-IP>   │ LePresidente/http-generic-401-bf │ NL      │ 1136 KPN B.V. │ ban:1     │ 2026-10-27T15:07:55Z │ crowdsec │
╰─────┴───────────────────┴──────────────────────────────────┴─────────┴───────────────┴───────────┴──────────────────────┴──────────╯

$ sudo cscli alerts inspect 208

################################################################################################

 - ID           : 208
 - Date         : 2026-10-27T15:08:14Z
 - Machine      : 80711084c81449658f6d53191ff5b572FN6azJh8fjI2tpVh
 - Simulation   : false
 - Remediation  : true
 - Kind         : crowdsec
 - Reason       : LePresidente/http-generic-403-bf
 - Events Count : 9
 - Scope:Value  : Ip:<ETERNAL-IP>   
 - Country      : NL
 - AS           : KPN B.V.
 - Begin        : 2026-10-27T15:07:42Z
 - End          : 2026-10-27T15:08:13Z
 - UUID         : 7f8136c1-7410-4f83-80ca-4c28bf34ff5c

╭──────────────────────────────────────────────────────────────────────────╮
│ Active Decisions                                                         │
├─────────┬───────────────────┬────────┬────────────┬──────────────────────┤
│    ID   │    scope:value    │ action │ expiration │      created_at      │
├─────────┼───────────────────┼────────┼────────────┼──────────────────────┤
│ 1320096 │ Ip:<ETERNAL-IP>   │ ban    │ 3h20m30s   │ 2026-10-27T15:08:14Z │
╰─────────┴───────────────────┴────────┴────────────┴──────────────────────╯

 - Context  :
╭────────────┬──────────────────────────────────────────────────────────────╮
│     Key    │                             Value                            │
├────────────┼──────────────────────────────────────────────────────────────┤
│ method     │ POST                                                         │
│ status     │ 403                                                          │
│ target_uri │ /autodiscover/autodiscover.xml                               │
│ target_uri │ /mapi/emsmdb/?MailboxId=6d61726b-4068-6176-616b-2e6e01000000 │
│            │ @domian                                                      │
│ target_uri │ /mapi/emsmdb/?MailboxId=68617661-6b2e-6e6c-0000-000001000000 │
│            │ @domian                                                      │
│ user_agent │ Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook    │
│            │ 16.0.17932; Pro)                                             │
╰────────────┴──────────────────────────────────────────────────────────────╯

On the (debian) grommunio mailserver:

# tail /var/log/nginx/nginx-autodiscover-access.log
<INTERNAL-IP> - - [27/Oct/2026:16:14:53 +0100] "POST /autodiscover/autodiscover.xml HTTP/2.0" 401 14 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<INTERNAL-IP> - user@domain [27/Oct/2026:16:14:53 +0100] "POST /autodiscover/autodiscover.xml HTTP/2.0" 200 2390 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<INTERNAL-IP> - user@domain [27/Oct/2026:16:15:22 +0100] "POST /autodiscover/autodiscover.xml HTTP/2.0" 200 3229 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<INTERNAL-IP> - - [27/Oct/2026:16:15:24 +0100] "GET /autodiscover/autodiscover.json/v1.0/user@domain?Protocol=REST&RedirectCount=1 HTTP/1.1" 200 28 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<INTERNAL-IP> - - [27/Oct/2026:16:15:28 +0100] "GET /autodiscover/autodiscover.json/v1.0/user@domain?Protocol=AutodiscoverV1&RedirectCount=1 HTTP/1.1" 200 89 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<INTERNAL-IP> - user@domain [27/Oct/2026:16:15:31 +0100] "POST /autodiscover/autodiscover.xml HTTP/2.0" 200 2390 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<INTERNAL-IP> - user@domain [27/Oct/2026:16:16:58 +0100] "POST /autodiscover/autodiscover.xml HTTP/2.0" 200 3229 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<EXTERNAL-IP>> - - [27/Oct/2026:16:17:44 +0100] "POST /autodiscover/autodiscover.xml HTTP/2.0" 401 14 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<EXTERNAL-IP>> - - [27/Oct/2026:16:17:44 +0100] "POST /autodiscover/autodiscover.xml HTTP/2.0" 401 14 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<EXTERNAL-IP>> - user@domain [27/Oct/2026:16:17:46 +0100] "POST /autodiscover/autodiscover.xml HTTP/2.0" 200 2390 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"

# tail /var/log/nginx/nginx-ews-access.log
<INTERNAL-IP> - user@domain [27/Oct/2026:16:16:11 +0100] "POST /EWS/Exchange.asmx HTTP/2.0" 200 1146 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<INTERNAL-IP> - user@domain7/Oct/2026:16:16:58 +0100] "POST /EWS/Exchange.asmx HTTP/2.0" 200 882 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<EXTERNAL-IP> - - [27/Oct/2:16:17:43 +0100] "POST /EWS/Exchange.asmx HTTP/1.1" 401 14 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<EXTERNAL-IP> - user@domain [27/Oct/2026:16:17:44 +0100] "POST /EWS/Exchange.asmx HTTP/1.1" 200 1495 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<EXTERNAL-IP> - user@domain7/Oct/2026:16:17:44 +0100] "POST /EWS/Exchange.asmx HTTP/2.0" 200 739 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<EXTERNAL-IP> - user@domain7/Oct/2026:16:17:50 +0100] "POST /EWS/Exchange.asmx HTTP/2.0" 200 1410 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<INTERNAL-IP> - user@domain7/Oct/2026:16:18:04 +0100] "POST /EWS/Exchange.asmx HTTP/2.0" 200 882 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<EXTERNAL-IP> - user@domain7/Oct/2026:16:18:42 +0100] "POST /EWS/Exchange.asmx HTTP/2.0" 200 882 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<EXTERNAL-IP> - user@domain7/Oct/2026:16:18:52 +0100] "POST /EWS/Exchange.asmx HTTP/2.0" 200 1146 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"
<EXTERNAL-IP> - user@domain7/Oct/2026:16:19:46 +0100] "POST /EWS/Exchange.asmx HTTP/2.0" 200 882 "-" "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.17932; Pro)"

tail /var/log/nginx/nginx-oab-access.log
<INTERNAL-IP> - - [27/Oct/2026:16:16:32 +0100] "HEAD /OAB/1793113994.lzx HTTP/2.0" 401 0 "-" "Microsoft BITS/7.8"
<INTERNAL-IP> - - [27/Oct/2026:16:16:34 +0100] "HEAD /OAB/1793113994.lzx HTTP/2.0" 401 0 "-" "Microsoft BITS/7.8"
<INTERNAL-IP> - user@domain [27/Oct/2026:16:16:34 +0100] "HEAD /OAB/1793113994.lzx HTTP/2.0" 200 0 "-" "Microsoft BITS/7.8"
<INTERNAL-IP> - - [27/Oct/2026:16:16:34 +0100] "GET /OAB/1793113994.lzx HTTP/2.0" 401 14 "-" "Microsoft BITS/7.8"
<INTERNAL-IP> - user@domain [27/Oct/2026:16:16:34 +0100] "GET /OAB/1793113994.lzx HTTP/2.0" 200 446 "-" "Microsoft BITS/7.8"
<EXTERNAL-IP> - - [27/Oct/2026:16:17:47 +0100] "HEAD /OAB/oab.xml HTTP/2.0" 401 0 "-" "Microsoft BITS/7.8"
<EXTERNAL-IP> - - [27/Oct/2026:16:17:49 +0100] "HEAD /OAB/oab.xml HTTP/2.0" 401 0 "-" "Microsoft BITS/7.8"
<EXTERNAL-IP> - user@domain [27/Oct/2026:16:17:49 +0100] "HEAD /OAB/oab.xml HTTP/2.0" 200 0 "-" "Microsoft BITS/7.8"
<EXTERNAL-IP> - - [27/Oct/2026:16:17:49 +0100] "GET /OAB/oab.xml HTTP/2.0" 401 14 "-" "Microsoft BITS/7.8"
<EXTERNAL-IP> - user@domain [27/Oct/2026:16:17:49 +0100] "GET /OAB/oab.xml HTTP/2.0" 200 448 "-" "Microsoft BITS/7.8"

What catches my eye is the username is missing sometimes (<EXTERNAL-IP> - - or <INTERNAL-IP> - -) which results in a 401 or 403 response.

I don't think it is because of the downstream reverse proxy:
I changed my internal DNS reservation to point directly to the mailserver and than it happens too.

Note: without crowdsec it works like a charm..

Before whitelisting /OAB , /EWS and /autodiscover locations;
Does anybody know a probable cause or solution?