diff --git a/modules/clan/gw-router/crowdsec.nix b/modules/clan/gw-router/crowdsec.nix
new file mode 100644
index 0000000..f706b07
--- /dev/null
+++ b/modules/clan/gw-router/crowdsec.nix
@@ -0,0 +1,59 @@
+{ config, ... }:
+let
+
+in
+{
+  roles.default.perInstance = break{ settings, ... }: {
+    nixosModule =
+      { config, ... }:
+      let
+      in
+      {
+        clan.core.vars.generators.gw-router = {
+          prompts.pppoe-username = {
+            description = "PPPoE username (from the ISP)";
+            type = "hidden";
+          };
+          prompts.pppoe-password = {
+            description = "PPPoE password (from the ISP)";
+            type = "hidden";
+          };
+          files."pppoe-username".secret = true;
+          files."pppoe-password".secret = true;
+          script = ''
+            user="$(cat "$prompts"/pppoe-username)"
+            pass="$(cat "$prompts"/pppoe-password)"
+            printf 'user "%s"\n' "$user" > "$out"/pppoe-username
+            printf '"%s" * "%s"\n' "$user" "$pass" > "$out"/pppoe-password
+          '';
+        };
+
+        services.pppd = {
+          enable = true;
+          peers.wan = {
+            autostart = true;
+            config = ''
+              plugin pppoe.so ${pppInterface}
+              ifname ppp0
+              file ${creds.files."pppoe-username".path}
+              noipdefault
+              defaultroute
+              noauth
+              hide-password
+              persist
+              maxfail 0
+              holdoff 5
+              lcp-echo-interval 15
+              lcp-echo-failure 3
+              +ipv6
+              mtu 1492
+              mru 1492
+            '';
+          };
+        };
+
+        environment.etc."ppp/chap-secrets".source = creds.files."pppoe-password".path;
+        environment.etc."ppp/pap-secrets".source = creds.files."pppoe-password".path;
+      };
+  };
+}
diff --git a/modules/clan/gw-router/default.nix b/modules/clan/gw-router/default.nix
index f91b8ef..c16c929 100644
--- a/modules/clan/gw-router/default.nix
+++ b/modules/clan/gw-router/default.nix
@@ -301,5 +301,8 @@
       };
   };
 
-  imports = [ ./pppoe.nix ];
+  imports = [
+    ./pppoe.nix
+    ./crowdsec.nix
+  ];
 }