[{"content":"Hugo Usage Guide Applies to Hugo v0.168.0 (Extended). Commands use the macOS/Linux shell as examples. Compiled from the official Hugo documentation. Theme-specific private configuration should follow the actual theme repository.\n1. Installation and Version Check macOS (Homebrew):\nbrew install hugo hugo version hugo env On Linux, use the corresponding distribution package or the binary officially released by Hugo. When using SCSS/Sass or certain theme asset pipelines, confirm that the installed version includes the Extended feature.\n2. Creating a Project hugo new project myblog cd myblog git init Typical directory structure:\nmyblog/ ├── archetypes/ # Templates for new articles ├── assets/ # Assets that need to go through the resource pipeline ├── content/ # Markdown content ├── data/ # Data files ├── i18n/ # Theme interface translations ├── layouts/ # Custom templates, can override theme templates ├── static/ # Copied as-is to the site root ├── themes/ # Local themes or Git submodules ├── hugo.toml # Site configuration (YAML and other formats are also supported) └── public/ # Build output (generated after running hugo) Hugo itself does not include a complete blog appearance. If there is no available theme or custom layout, you may see a warning such as found no layout file for \u0026quot;html\u0026quot;.\n3. Using a Ready-Made Theme (Git Submodule) The following uses the Ananke theme from Hugo\u0026rsquo;s official quick start as an example:\ngit submodule add https://github.com/gohugo-ananke/ananke themes/ananke Configure in hugo.toml (do not declare the same TOML key twice):\nbaseURL = \u0026#39;https://example.com/\u0026#39; title = \u0026#39;My Blog\u0026#39; theme = \u0026#39;ananke\u0026#39; Start the preview:\nhugo server -D Different themes vary in menus, homepage, parameters, Hugo version, and asset compilation dependencies. When migrating configuration, prefer the theme\u0026rsquo;s README and example site. Do not copy another theme\u0026rsquo;s [params] block as-is.\nGit Submodule Maintenance Cloning on a new machine:\ngit clone --recurse-submodules \u0026lt;repository URL\u0026gt; Filling in submodules for an existing clone:\ngit submodule sync --recursive git submodule update --init --recursive Updating submodules (will track the configured remote branch; review changes before committing):\ngit submodule update --remote --merge git diff --submodule git add .gitmodules themes/ git commit -m \u0026#39;Update Hugo theme\u0026#39; When migrating a submodule\u0026rsquo;s Git URL: first modify url in .gitmodules, then run git submodule sync --recursive. If the CI network is unstable, you may switch to an accessible Git mirror, but make sure the mirror has the required commit objects; you may also initialize submodules yourself after cloning the main repository.\n4. Creating and Editing Articles hugo new content posts/hello-world.md Example article:\n--- title: \u0026#34;Hello World\u0026#34; date: 2026-10-17T12:00:00+08:00 draft: false description: \u0026#34;Article summary\u0026#34; tags: [\u0026#34;Hugo\u0026#34;, \u0026#34;Blog\u0026#34;] categories: [\u0026#34;Tech\u0026#34;] --- This is the body. ## First-level section **Bold**, *italic*, [external link](https://gohugo.io). Key fields:\nField Purpose title Title date Article time draft true means draft, not included in the default production build description Summary, whether to display it depends on the theme tags, categories Taxonomy, specific page display depends on the theme slug Custom URL tail segment (the actual path is also affected by the permalink configuration) Note: articles with a future date may also be excluded from the default production build; check the date, time zone, and --buildFuture.\nImages and Static Files Site-wide static files go in static/images/logo.png, referenced in articles as:\n![Logo](/images/logo.png) A page bundle can use:\ncontent/posts/hello/ ├── index.md └── cover.jpg Write ![Cover](cover.jpg) in index.md. If you want to use theme image processing, thumbnails, and other features, you still need to follow the page-resource conventions of that theme.\n5. Local Development and Build hugo server # Preview published content hugo server -D # Include drafts hugo server --bind 0.0.0.0 # Allow other devices to connect; mind network access controls hugo # Output to public/ hugo --gc --minify # Common production build hugo -d dist # Output to dist/ Hugo\u0026rsquo;s build command does not automatically clear the output directory before building. If you delete articles, change URLs, or switch languages, old files may remain. It is recommended to clear the artifacts in the CI\u0026rsquo;s temporary build directory before building, rather than blindly cleaning any path.\nrm -rf public hugo --gc --minify Only run the above deletion when you have confirmed that public/ is purely a build artifact with no user data.\n6. Multilingual Sites The following shows the basic configuration for Chinese and English. The supported language menu and switcher depend on the theme:\nbaseURL = \u0026#39;https://example.com/\u0026#39; title = \u0026#39;My Blog\u0026#39; defaultContentLanguage = \u0026#39;zh-cn\u0026#39; defaultContentLanguageInSubdir = false [languages] [languages.zh-cn] languageName = \u0026#39;Simplified Chinese\u0026#39; languageCode = \u0026#39;zh-CN\u0026#39; weight = 1 title = \u0026#39;我的博客\u0026#39; [languages.en] languageName = \u0026#39;English\u0026#39; languageCode = \u0026#39;en-US\u0026#39; weight = 2 title = \u0026#39;My Blog\u0026#39; One way to organize content by language directory:\ncontent/ ├── zh-cn/ │ └── posts/hello.md └── en/ └── posts/hello.md Before using the above language directory layout, combine the multilingual content directory configuration or language mounts to confirm that content is correctly attributed. A simpler approach that needs no extra mounts is using translation filenames in the same directory, such as hello.zh-cn.md and hello.en.md; the default language\u0026rsquo;s URL can also be arranged per the project configuration.\nRecommendation: for sites that already have content/posts/, start with the filename suffix method:\ncontent/posts/ ├── hello.zh-cn.md └── hello.en.md It is best to set a consistent translationKey on translated pages (only needed when the file path cannot directly associate them), to avoid the multilingual menu pointing to the wrong page.\n7. Using HTML in Markdown Hugo uses Goldmark by default. If you see Raw HTML omitted while rendering in the log, raw HTML in Markdown is not being rendered. Only enable this in hugo.toml when you trust the article content:\n[markup.goldmark.renderer] unsafe = true Once enabled, embedded HTML in articles will participate in the output. If the content comes from untrusted contributors, consider the risk of script injection.\n8. Git and Gitea Actions Publishing It is recommended to keep the source repository (including .gitmodules, content/, hugo.toml, etc.) separate from the static publishing repository or branch. A typical CI flow:\npush to source main │ ▼ Pull source and theme submodules │ ▼ Install the specified Hugo version │ ▼ Clean the temporary build output and run hugo --gc --minify │ ▼ Commit the public/ files to the publishing repository\u0026#39;s main or publishing branch │ ▼ Caddy / Nginx serves the static directory You can first verify these commands inside the build container:\ngit submodule sync --recursive git submodule update --init --recursive rm -rf public hugo --gc --minify find public -maxdepth 2 -type f | head Gitea Actions example workflows must be configured individually based on the act_runner\u0026rsquo;s labels, container image, Git authentication, permissions, Hugo install path, and target branch. Do not assume GITHUB_SHA or custom COMMIT_SHA automatically exists in every shell step; with set -u, undefined variables will cause the build to fail directly. To get the source commit value, run inside an already-checked-out Git repository:\nSOURCE_SHA=\u0026#34;$(git rev-parse HEAD)\u0026#34; Use a separate working directory for the target publishing repository, to avoid accidentally deleting source files. Check for non-fast-forward conflicts on the branch before pushing. Do not use unchecked git push --force as a general publishing strategy.\n9. Common Troubleshooting 9.1 found no layout file for \u0026quot;html\u0026quot; The cause is usually that the theme was not loaded correctly, the theme is missing the corresponding template, or the theme name in the config file does not match the themes/ directory.\nls -la themes/ cat .gitmodules hugo config | grep -i theme hugo --logLevel debug Confirm that template files such as layouts/ actually exist inside the theme directory, and check the theme\u0026rsquo;s own usage notes. Do not silence a blank-site warning.\n9.2 Raw HTML omitted Check markup.goldmark.renderer.unsafe as in Section 7. You can also try to replace raw HTML with Markdown or Hugo shortcodes.\n9.3 Git Submodule Directory Is Empty git submodule status --recursive git submodule update --init --recursive If a network error is reported, check the URL, authentication, and DNS/proxy inside the build container in .gitmodules, not only the host network.\n9.4 Page Not Published Check the article\u0026rsquo;s draft, date, expiration time, language, and the target theme\u0026rsquo;s routing. Check:\nhugo list all hugo list drafts hugo list future hugo list published 9.5 CI Build Succeeds But Published Content Does Not Change Check whether public/ contains the expected HTML, whether the publishing branch was updated, whether the web root points to the latest deployment location, and whether the browser/CDN is caching old content. Do not assume it is a Hugo caching problem first.\n10. Recommended Daily Workflow # 1. Pull updates (including submodules) git pull --ff-only git submodule update --init --recursive # 2. Create a new article hugo new content posts/new-post.md # 3. Edit and preview locally hugo server -D # 4. Change draft to false in the article\u0026#39;s front matter # 5. Commit and push (CI builds/publishes automatically) git add content/ git commit -m \u0026#39;Add new post\u0026#39; git push 11. References Hugo Official Documentation Quick Start Command Line Reference Basic Usage Markdown Rendering Configuration Hugo Modules ","permalink":"https://blog.imcaoxuan.cn/en/posts/2026-10-17-hugo-usage-guide/","summary":"\u003ch1 id=\"hugo-usage-guide\"\u003eHugo Usage Guide\u003c/h1\u003e\n\u003cblockquote\u003e\n\u003cp\u003eApplies to Hugo v0.168.0 (Extended). Commands use the macOS/Linux shell as examples. Compiled from the official Hugo documentation. Theme-specific private configuration should follow the actual theme repository.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2 id=\"1-installation-and-version-check\"\u003e1. Installation and Version Check\u003c/h2\u003e\n\u003cp\u003emacOS (Homebrew):\u003c/p\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;\"\u003e\u003ccode class=\"language-bash\" data-lang=\"bash\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003ebrew install hugo\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003ehugo version\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003ehugo env\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cp\u003eOn Linux, use the corresponding distribution package or the binary officially released by Hugo. When using SCSS/Sass or certain theme asset pipelines, confirm that the installed version includes the Extended feature.\u003c/p\u003e","title":"Hugo Usage Guide"},{"content":" On an Armbian machine used as a bypass router, both sing-box and WireGuard are running side by side. The router itself resolves internal domain names fine, yet downstream clients that point at it as their DNS server time out every time. The root cause turned out not to be the DNS matching rules, but rather that the traffic sing-box sends to its upstream DNS was choosing the wrong egress interface.\nAll addresses in this article are rewritten illustrative values, not the original network configuration; the topology relationships and protocol behavior of the private network are preserved.\nTopology and Symptoms Role Illustrative Address Purpose Downstream client 192.168.10.20 DNS client Bypass router LAN 192.168.10.254 / eth0 Address where sing-box DNS listens Bypass router WireGuard 10.77.0.11 / wg0 Tunnel client Internal DNS 10.77.0.1:53 DNS server on the WireGuard peer The topology looks like this:\nClient 192.168.10.20 │ DNS query ▼ Bypass router 192.168.10.254:53 (sing-box DNS inbound) │ Expected: query 10.77.0.1:53 out through wg0 ▼ WireGuard peer DNS 10.77.0.1:53 The internal test domain used is service.home.arpa (illustrative). The observed symptoms:\nThe router itself resolves that domain normally; When a downstream client explicitly sets the router\u0026rsquo;s LAN IP as its DNS server, queries time out consistently; sing-box is listening on UDP 53, and the corresponding inbound routing rules have been confirmed correct. Step 1: Confirm the Inbound Request Arrives Capture the downstream client\u0026rsquo;s DNS traffic on the bypass router:\nsudo tcpdump -i eth0 -nn -K -l \\ \u0026#39;host 192.168.10.20 and udp port 53\u0026#39; You will see requests carrying the same DNS Transaction ID retrying every few seconds, with no matching successful response. This tells you the client did hand the query to the router, but the processing chain never completed.\nCheck the listening port:\nsudo ss -lnup | grep \u0026#39;:53 \u0026#39; This confirms sing-box is listening on UDP 53 at the bypass router\u0026rsquo;s LAN IP.\nStep 2: Observe the LAN and WireGuard Egresses Separately Don\u0026rsquo;t start by dumping all DNS traffic. Open two terminals and watch each path separately:\n# LAN: only this downstream client sudo tcpdump -i eth0 -nn -K -l \u0026#39;host 192.168.10.20 and udp port 53\u0026#39; # WireGuard: only the target DNS server sudo tcpdump -i wg0 -nn -K -l \u0026#39;host 10.77.0.1 and udp port 53\u0026#39; Then issue one explicit query from the downstream client:\nnslookup -type=A service.home.arpa 192.168.10.254 What turned up in this case: the downstream request did arrive on the LAN, but sing-box\u0026rsquo;s new queries to the DNS upstream left from eth0 with the LAN address as the source, instead of leaving from wg0 with the WireGuard IP.\nKey distinction: a DNS rule that \u0026ldquo;picks a particular upstream server\u0026rdquo; and the OS/application decision of \u0026ldquo;which interface to use to reach that server\u0026rdquo; are two separate things. Even when the rule matches correctly, the request can still time out if the actual egress path is wrong.\nStep 3: Bind an Interface for the sing-box DNS Upstream The upstream configuration at the time of the failure looked like this:\n{ \u0026#34;type\u0026#34;: \u0026#34;udp\u0026#34;, \u0026#34;tag\u0026#34;: \u0026#34;internal-dns\u0026#34;, \u0026#34;server\u0026#34;: \u0026#34;10.77.0.1\u0026#34; } After the fix:\n{ \u0026#34;type\u0026#34;: \u0026#34;udp\u0026#34;, \u0026#34;tag\u0026#34;: \u0026#34;internal-dns\u0026#34;, \u0026#34;server\u0026#34;: \u0026#34;10.77.0.1\u0026#34;, \u0026#34;bind_interface\u0026#34;: \u0026#34;wg0\u0026#34; } bind_interface applies to the network dial for that DNS server, making it use the specified interface. In an environment with TUN, policy routing, and WireGuard, this is more explicit than relying on the system\u0026rsquo;s automatic path selection.\nCheck the configuration and restart the service (adjust the path to your own configuration file):\nsudo sing-box check -c /etc/sing-box/config.json sudo systemctl restart sing-box Then query again and capture on wg0:\nsudo tcpdump -i wg0 -nn -K -l \u0026#39;host 10.77.0.1 and udp port 53\u0026#39; You should see the request on wg0 along with its matching response. In this case, adding bind_interface restored normal downstream DNS resolution.\nSide Observation: NXDOMAIN After a Successful A Record During the investigation, another class of symptom came up: an internal name resolves through a CNAME to a single-label hostname, the A query returns an address normally, but a subsequent AAAA query for the final hostname returns NXDOMAIN. This is a separate resolution anomaly that still needs its own investigation — it should not be mistaken for the cause of the downstream query timeouts.\nIf you see something similar, run these separately:\ndig @\u0026lt;DNS server address\u0026gt; service.home.arpa A dig @\u0026lt;DNS server address\u0026gt; service.home.arpa AAAA And check whether the CNAME points at an unexpected single-label name, and whether the local resolver and the upstream DNS return consistent results.\nTroubleshooting Takeaways Capture packets segment by segment along the chain: client → bypass router inbound → upstream egress → upstream response → client response. Verify the actual egress interface and source IP of the packets; the server field in the DNS configuration alone tells you nothing. When you receive the client\u0026rsquo;s request but see no matching response, check the upstream egress first; there is no need to immediately modify routing rules that have already been verified as correct. If tcpdump reports bad udp cksum, it may be the result of NIC checksum offload on locally sent packets; -K disables checksum verification during capture. home.arpa is a special-purpose domain for home networks; do not publish real public domain names, device names, internal addresses, and tunnel topologies as-is on a public blog. Conclusion: the final failure point was that sing-box\u0026rsquo;s upstream UDP queries to the internal DNS were leaving through the LAN interface instead of going over WireGuard. Setting bind_interface: \u0026quot;wg0\u0026quot; on the corresponding DNS upstream server fixed it.\n","permalink":"https://blog.imcaoxuan.cn/en/posts/2026-10-23-troubleshooting-dns-timeouts-on-a-bypass-router-sing-box-upstream-queries-leave-through-the-wrong-network-interface/","summary":"\u003cp\u003e\u003caudio controls preload=\"metadata\" src=\"https://blog-medias.imcaoxuan.cn/2026/10/23/1792745865.mp3\"\u003e\u003c/audio\u003e\nOn an Armbian machine used as a bypass router, both sing-box and WireGuard are running side by side. The router itself resolves internal domain names fine, yet downstream clients that point at it as their DNS server time out every time. The root cause turned out not to be the DNS matching rules, but rather that \u003cstrong\u003ethe traffic sing-box sends to its upstream DNS was choosing the wrong egress interface\u003c/strong\u003e.\u003c/p\u003e","title":"Troubleshooting DNS Timeouts on a Bypass Router: sing-box Upstream Queries Leave Through the Wrong Network Interface"},{"content":"After deploying sing-box TUN on Armbian, I encountered a rather counterintuitive issue: IPv6 ping works, but IPv6 HTTPS connections time out after enabling auto_redirect.\nThe eventual finding was that the problem was not with IPv6 public routing or the proxy node, but rather that the Linux loopback interface lo was missing the ::1/128 address. This article documents the diagnostic process and the fix.\nEnvironment Linux: Armbian, ARM64, 6.18-series kernel sing-box: 1.14.x Network management: Netplan + NetworkManager Transparent proxy: TUN, auto_route: true, auto_redirect: true IPv6: Automatically configured by the upstream; the interface already has a global IPv6 address and an RA default route To protect privacy, this article omits the actual public IP addresses, MAC addresses, router address, domain names, and custom internal routing table numbers. The ULA addresses and test targets in the following examples are for demonstration purposes.\nSymptoms Direct IPv6 HTTPS test:\ncurl --noproxy \u0026#39;*\u0026#39; -6 -v --connect-timeout 5 \\ --resolve \u0026#39;cloudflare.com:443:[2606:4700::6810:85e5]\u0026#39; \\ https://cloudflare.com/ After enabling sing-box:\n* Trying [2606:4700::6810:85e5]:443... * Connection timed out after 5002 milliseconds curl: (28) Connection timed out Comparison test:\nState IPv6 HTTPS sing-box stopped Normal auto_redirect: true Times out auto_redirect: false Normal However, a simple ping -6 test may succeed. ICMP connectivity cannot substitute for a TCP/HTTPS test.\nTroubleshooting Process 1. Rule Out Issues with the IPv6 Address and Default Route ip -6 addr show dev eth0 scope global ip -6 route show default The interface already has a global IPv6 address, and the default route was learned through RA, in a form such as:\ndefault via fe80::... dev eth0 proto ra When NetworkManager manages IPv6, whether RA is functioning correctly should not be determined solely from the value of net.ipv6.conf.eth0.accept_ra; the actual addresses and routes must also be observed.\n2. Find That TCP Does Not Appear Directly on tun0 or eth0 Observe the HTTPS target through packet capture:\nsudo tcpdump -ni tun0 \u0026#39;ip6 and tcp port 443\u0026#39; sudo tcpdump -ni eth0 \u0026#39;ip6 and tcp port 443\u0026#39; With auto_redirect enabled, the expected TCP SYN to the target IPv6 address was not observed. This does not necessarily indicate packet loss: sing-box\u0026rsquo;s nftables rules may first redirect the TCP traffic to a local port.\n3. Inspect the Local REDIRECT in nftables sudo nft -a list table inet sing-box The rules contain content similar to the following:\nmeta l4proto tcp ... queue flags bypass to 100 meta l4proto tcp ... redirect to :23457 return The port shown here is an internal listening port used in this troubleshooting environment; other versions or configurations may use different ports. Check the IPv6 listener:\nsudo ss -6 -lntp \u0026#39;( sport = :23457 )\u0026#39; sing-box is indeed listening on that port.\nContinue capturing traffic on the loopback interface:\nsudo tcpdump -ni lo -vv \u0026#39;tcp port 23457\u0026#39; The key packets observed at this point are similar to the following:\nIP6 2001:db8::1234.4210 \u0026gt; ::1.23457: Flags [S] IP6 2001:db8::1234.4210 \u0026gt; ::1.23457: Flags [S] IP6 2001:db8::1234.4210 \u0026gt; ::1.23457: Flags [S] The 2001:db8::/32 prefix above is a documentation-only example IPv6 prefix, not an actual public address.\nThe SYN packets are continually retransmitted without a SYN-ACK, indicating that the connection has been redirected to the local ::1 address, but the local TCP handshake cannot complete.\n4. Identify the Root Cause: The Loopback Interface Is Missing an IPv6 Address ip -6 addr show dev lo The output is unexpectedly empty. Normally, the loopback interface should have the following:\ninet6 ::1/128 scope host Because ::1/128 is missing, an IPv6 TCP REDIRECT to the local ::1 address cannot establish a connection normally. This matches the repeated SYN packets and the absence of a SYN-ACK.\nFix First, inspect the IPv6 state of lo:\nip link show lo sysctl net.ipv6.conf.lo.disable_ipv6 ip -6 addr show dev lo If IPv6 is disabled:\nsudo sysctl -w net.ipv6.conf.lo.disable_ipv6=0 Ensure that the loopback interface is enabled:\nsudo ip link set lo up If ::1/128 still does not appear, add it manually:\nsudo ip -6 addr add ::1/128 dev lo Verify:\nip -6 addr show dev lo ping -6 -c 2 ::1 curl --noproxy \u0026#39;*\u0026#39; -6 --connect-timeout 5 https://api6.ipify.org The issue can only be considered resolved after confirming that HTTPS also works when auto_redirect: true.\nIf the problem occurs after a reboot, check whether /etc/sysctl.d/ contains a configuration that disables IPv6 on lo. You can explicitly set the following in the sysctl configuration file:\nnet.ipv6.conf.lo.disable_ipv6 = 0 Note that this setting only ensures that IPv6 is not disabled on lo; it does not automatically guarantee that ::1/128 will always exist. If the address disappears again after a reboot, continue investigating the startup order or the service managing lo.\nSummary A successful IPv6 ping does not mean that IPv6 TCP proxying is working; a real HTTPS request must be used for verification. After enabling sing-box auto_redirect, some TCP traffic is redirected by nftables to a local port; capturing only eth0 or tun0 may not reveal the expected target traffic. Confirming the listener with ss and observing SYN retransmissions with tcpdump -i lo were key to identifying the problem. The final point of failure was the absence of the IPv6 loopback address ::1/128 on lo. Temporarily disabling auto_redirect works around the problem, but fixing the loopback interface is the actual solution for this failure. Quick Diagnostic Command Reference ip -6 addr show dev lo sysctl net.ipv6.conf.lo.disable_ipv6 ip -6 route show default sudo nft -a list table inet sing-box sudo ss -6 -lntp \u0026#39;( sport = :23457 )\u0026#39; sudo tcpdump -ni lo \u0026#39;tcp port 23457\u0026#39; Addendum: Downstream Devices Cannot Access the Network After Enabling UFW After resolving the IPv6 loopback issue, I enabled UFW on Armbian and encountered another phenomenon: the Armbian host itself could access the network normally, but downstream devices connecting through it could not access the network normally.\nFirst, inspect the UFW block logs:\nsudo ufw logging medium sudo journalctl -k -f -o cat | grep --line-buffered \u0026#39;UFW BLOCK\u0026#39; The following is a representative sanitized log. The IP addresses use the RFC 5737 documentation example ranges and must not be copied directly into a real network configuration:\n[UFW BLOCK] IN=eth0 OUT= SRC=192.0.2.20 DST=192.0.2.254 PROTO=TCP DPT=9091 SYN [UFW BLOCK] IN=eth0 OUT= SRC=192.0.2.20 DST=192.0.2.254 PROTO=TCP DPT=22703 SYN Here, OUT= is empty and the destination is a local address, so these requests are classified as INPUT (accessing the Armbian host itself) rather than ordinary FORWARD traffic. The earlier direct suspicion of deny routed was therefore incomplete.\nNext, use the following command to identify the listening processes:\nsudo ss -lntup | grep -E \u0026#39;:(9091|22703)\\b\u0026#39; The results show that both TCP ports are being listened on by sing-box, with one bound to the LAN IPv4 address and the other bound to the wildcard address. After allowing the corresponding inbound ports, downstream devices regained network access. It is important to emphasize that this demonstrates the relevance of port reachability to the failure, but the listening results alone do not prove that these ports are TUN ports or serve any particular function. The sing-box configuration should be checked to determine their exact purpose.\nIf a service is intended only for LAN use, UFW can restrict the rule to the actual LAN address and subnet. The following is merely a rule template using the RFC 5737 example subnet; it must be replaced with your actual values:\nsudo ufw allow in on eth0 from 192.0.2.0/24 to 192.0.2.254 port 9091 proto tcp sudo ufw allow in on eth0 from 192.0.2.0/24 to 192.0.2.254 port 22703 proto tcp Security note: It is not recommended to execute ufw allow 22703/tcp directly without source restrictions. If the port is listening on the wildcard address, particular care should be taken to check whether public IPv6 access has been unintentionally exposed. Nor should all routed traffic be changed to be allowed by default on a long-term basis merely to restore downstream network access.\nThe key troubleshooting points from this addendum are: first distinguish INPUT from FORWARD using IN / OUT, then confirm the listening process, and finally allow traffic precisely based on its actual source. The UFW status page also cannot replace nft list ruleset, because sing-box\u0026rsquo;s auto_redirect creates separate nftables rules.\n","permalink":"https://blog.imcaoxuan.cn/en/posts/2026-10-23-ipv6-https-timeouts-after-enabling-sing-box-auto-redirect-on-armbian-troubleshooting-a-missing-loopback-address/","summary":"\u003cp\u003eAfter deploying sing-box TUN on Armbian, I encountered a rather counterintuitive issue: \u003cstrong\u003eIPv6 ping works, but IPv6 HTTPS connections time out after enabling \u003ccode\u003eauto_redirect\u003c/code\u003e\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eThe eventual finding was that the problem was not with IPv6 public routing or the proxy node, but rather that the \u003cstrong\u003eLinux loopback interface \u003ccode\u003elo\u003c/code\u003e was missing the \u003ccode\u003e::1/128\u003c/code\u003e address\u003c/strong\u003e. This article documents the diagnostic process and the fix.\u003c/p\u003e\n\u003ch2 id=\"environment\"\u003eEnvironment\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLinux: Armbian, ARM64, 6.18-series kernel\u003c/li\u003e\n\u003cli\u003esing-box: 1.14.x\u003c/li\u003e\n\u003cli\u003eNetwork management: Netplan + NetworkManager\u003c/li\u003e\n\u003cli\u003eTransparent proxy: TUN, \u003ccode\u003eauto_route: true\u003c/code\u003e, \u003ccode\u003eauto_redirect: true\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eIPv6: Automatically configured by the upstream; the interface already has a global IPv6 address and an RA default route\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eTo protect privacy, this article omits the actual public IP addresses, MAC addresses, router address, domain names, and custom internal routing table numbers. The ULA addresses and test targets in the following examples are for demonstration purposes.\u003c/p\u003e","title":"IPv6 HTTPS Timeouts After Enabling sing-box auto_redirect on Armbian: Troubleshooting a Missing Loopback Address"},{"content":"When running UFW and sing-box TUN simultaneously on a Linux bypass router, an easily misdiagnosed failure may occur: sing-box runs normally on the local machine, but LAN devices cannot access the Internet through the bypass router. Even if the TCP port that was blocked at the time is allowed, the problem may reappear after sing-box is restarted.\nThis article documents an actually observed cause and a fix pending regression validation. All examples use documentation-reserved addresses and do not correspond to a real network.\nEnvironment and symptoms A Linux bypass router with the LAN interface eth0 and the address 192.0.2.1 (example only). A downstream client, 192.0.2.20, using the bypass router as its IPv4 gateway. The sing-box TUN interface is named tun0, with auto_route and auto_redirect enabled. UFW denies unsolicited inbound traffic by default. The key sing-box configuration is:\n{ \u0026#34;type\u0026#34;: \u0026#34;tun\u0026#34;, \u0026#34;interface_name\u0026#34;: \u0026#34;tun0\u0026#34;, \u0026#34;auto_route\u0026#34;: true, \u0026#34;auto_redirect\u0026#34;: true } Logs during the failure are similar to:\n[UFW BLOCK] IN=eth0 OUT= SRC=192.0.2.20 DST=192.0.2.1 PROTO=TCP DPT=24461 SYN DPT=24461 is only a dynamic port observed during one run, and it should not be hardcoded permanently in UFW. An empty OUT= indicates that the packet is entering the local machine\u0026rsquo;s INPUT path rather than merely traversing the FORWARD path.\nTracing NAT redirection Check the sing-box listeners:\nsudo ss -lntup | grep sing-box Check nftables:\nsudo nft -a list ruleset | grep -n -C 8 -E \u0026#39;redirect|tproxy\u0026#39; In the failure scenario, rules similar to the following can be seen:\nmeta l4proto tcp redirect to :24461 # 内部端口不允许直接连接 tcp dport 24461 ct status ! dnat reject with tcp reset In other words, sing-box first redirects the destination TCP connection to a local listening port, and then UFW\u0026rsquo;s INPUT rules determine whether to allow it. Treating this type of traffic as ordinary FORWARD packets and allowing it will usually not eliminate the observed INPUT block.\nFix approach: Match DNAT connections rather than dynamic ports For an explicitly trusted single downstream client, you can temporarily try:\nsudo iptables -I ufw-before-input 1 \\ -i eth0 \\ -s 192.0.2.20/32 \\ -d 192.0.2.1 \\ -p tcp \\ -m conntrack --ctstate DNAT \\ -j ACCEPT Be sure to replace the example IP address and interface with the actual values. DNAT is a valid virtual state for --ctstate; it is not valid for --ctstatus, which produces the error Bad ctstatus \u0026quot;DNAT\u0026quot;.\nThis rule still has security boundaries: it matches qualifying DNAT TCP connections, not just connections created by sing-box. Therefore, the source and ingress interface should be restricted, and INPUT should not be allowed globally merely as a shortcut.\nValidation Run the following on the downstream device:\ncurl -4 -v --connect-timeout 5 https://www.cloudflare.com/ Observe the rule counters and block logs on the bypass router:\nsudo iptables -L ufw-before-input -n -v --line-numbers sudo journalctl -k --since \u0026#39;10 minutes ago\u0026#39; --grep=\u0026#39;UFW BLOCK\u0026#39; --no-pager Only if the counters increase, Internet connectivity is restored, and things continue to work after sing-box is restarted and the internal port changes can this method be considered suitable for the current deployment.\nPersistence After confirming that validation succeeded, create a backup first:\nsudo cp -a /etc/ufw/before.rules /etc/ufw/before.rules.bak sudo nano /etc/ufw/before.rules In the *filter section, add the following after all chain definitions and before the existing ufw-before-input processing rules:\n-A ufw-before-input -i eth0 -s 192.0.2.20/32 -d 192.0.2.1 -p tcp -m conntrack --ctstate DNAT -j ACCEPT Check and reload:\nsudo iptables-restore --test \u0026lt; /etc/ufw/before.rules sudo ufw reload To roll back, restore the file from the backup and run sudo ufw reload. Temporary test rules can also be removed using iptables -D with exactly the same matching arguments that were used when inserting the rule.\nPrecautions Do not use ufw default allow routed or disable UFW entirely as a long-term solution. This approach primarily addresses INPUT blocking after IPv4 TCP redirection; it is not a universal fix for all UDP, IPv6, or WireGuard failures. Access to other explicitly configured listening ports, such as those for APIs, DNS, or SOCKS, should continue to be restricted by source according to their actual use. Both UFW and sing-box may modify nftables. If the rule match counters increase but connections still fail, also check the hook priorities of other base chains and any subsequent drop rules. References Official sing-box TUN documentation iptables-extensions: conntrack match documentation ","permalink":"https://blog.imcaoxuan.cn/en/posts/2026-10-23-troubleshooting-ufw-and-sing-box-tun-auto-redirect-conflicts/","summary":"\u003cp\u003eWhen running UFW and sing-box TUN simultaneously on a Linux bypass router, an easily misdiagnosed failure may occur: sing-box runs normally on the local machine, but LAN devices cannot access the Internet through the bypass router. Even if the TCP port that was blocked at the time is allowed, the problem may reappear after sing-box is restarted.\u003c/p\u003e\n\u003cp\u003eThis article documents an actually observed cause and a \u003cstrong\u003efix pending regression validation\u003c/strong\u003e. All examples use documentation-reserved addresses and do not correspond to a real network.\u003c/p\u003e","title":"UFW 与 sing-box TUN auto_redirect 冲突：动态端口被拦截的排查"},{"content":"Automatically Banning Malicious IPs on a Debian Server with CrowdSec Public-facing servers face all kinds of automated scanning every single day.\nEven when you never advertise a service address, your SSH port still routinely receives login attempts against usernames like root, admin and test. Web services may get probed for paths such as .env, wp-admin and phpinfo.php.\nMost of these requests come from automated scanners. They may not amount to an actual intrusion, but they generate a huge amount of pointless log noise and widen the exposed attack surface.\nRelying on static firewall rules alone makes it hard to adjust the ban list dynamically based on actual attack behaviour.\nThat\u0026rsquo;s why I chose to try CrowdSec: identify malicious behaviour from server logs, then work with nftables to automatically ban the source of the attack.\nThis article records the process of deploying CrowdSec on Debian 12, and how it decides whether an IP should be banned.\n1. What Is CrowdSec? CrowdSec is an open-source intrusion detection and security response system.\nIt analyses the logs produced by services such as SSH and web servers to detect brute-force attacks, vulnerability scanning and malicious crawlers.\nUnlike a traditional static IP blacklist, CrowdSec mainly decides whether to ban based on behavioural characteristics, and it can also draw on community threat intelligence.\nCrowdSec\u0026rsquo;s work splits into two parts:\nSecurity Engine: reads the logs, identifies attacks and produces ban decisions. Remediation Component (Bouncer): carries out those ban decisions, for example by modifying firewall rules. The two are independent of each other.\nIn other words, installing only the CrowdSec Security Engine will not automatically block network connections.\n1.1 How It Works SSH / Caddy / Nginx | v Application Logs | v CrowdSec Parser | v Detection Scenarios | v Security Alerts | v Decision Profiles | v Local API | v Firewall Bouncer | v nftables | v Block IP By decoupling log analysis from firewall enforcement, CrowdSec works just as well on a single server as it does across a fleet of machines, where a central API dispatches ban decisions to many hosts.\n1.2 CrowdSec vs Fail2ban Fail2ban is a common automatic banning tool on Linux.\nBoth can detect SSH brute-force attempts from logs, but the design philosophies differ.\nFeature CrowdSec Fail2ban SSH brute-force detection Supported Supported Web attack detection Supported Supported, usually needs a matching filter Community threat intelligence Supported Usually needs extra integration Distributed deployment Native support Usually requires your own integration Ban mechanism Bouncer Action Detection rules Parser + Scenario Filter + Jail Configuration complexity Relatively high Relatively low If all you need is to ban IPs that fail SSH logins, Fail2ban is already good enough.\nIf you want to protect multiple web services, SSH and other network services at once, CrowdSec\u0026rsquo;s modular architecture leaves more room to scale.\n2. Deployment Environment This article uses the following environment:\nItem Configuration Operating system Debian 12 Bookworm CrowdSec 1.8.x Firewall nftables Installation method APT Detection targets SSH, Caddy, Nginx Ban mechanism Firewall Bouncer I use a native installation rather than Docker.\nThe main reason is that CrowdSec needs to read the host\u0026rsquo;s systemd journal and, through the Bouncer, operate the system firewall. A native install avoids extra permission, network and mount configuration.\n3. Installing CrowdSec 3.1 Add the Official APT Repository First install the dependencies:\nsudo apt update sudo apt install -y \\ debian-archive-keyring \\ ca-certificates \\ curl \\ gnupg Create the keyring directory:\nsudo install -d -m 0755 /etc/apt/keyrings Import the signing key for the CrowdSec repository:\ncurl -fsSL \\ https://packagecloud.io/crowdsec/crowdsec/gpgkey | sudo gpg --dearmor \\ -o /etc/apt/keyrings/crowdsec.gpg Add the repository:\necho \\ \u0026#34;deb [signed-by=/etc/apt/keyrings/crowdsec.gpg] https://packagecloud.io/crowdsec/crowdsec/any any main\u0026#34; | sudo tee /etc/apt/sources.list.d/crowdsec.list Refresh the APT cache:\nsudo apt update Check where the package comes from:\napt-cache policy crowdsec Once you\u0026rsquo;ve confirmed you\u0026rsquo;re using the official repository, install it:\nsudo apt install -y crowdsec Check the version:\nsudo cscli version Look at the service:\nsudo systemctl status crowdsec 3.2 Install the Firewall Bouncer CrowdSec itself handles detection but does not enforce firewall bans directly.\nSo you need to install a Firewall Bouncer as well.\nThis article uses nftables:\nsudo apt install -y \\ crowdsec-firewall-bouncer-nftables Enable the service at boot:\nsudo systemctl enable --now \\ crowdsec-firewall-bouncer Check its status:\nsudo systemctl status \\ crowdsec-firewall-bouncer Check that the Bouncer has registered with CrowdSec:\nsudo cscli bouncers list Normally you should see:\nName Valid Type firewall-bouncer true crowdsec-firewall-bouncer The name is just an example — the real one may carry an auto-generated suffix from the installation.\nThe Bouncer configuration file is usually located at:\n/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml The parts worth paying attention to are:\nmode: nftables api_url: http://127.0.0.1:8080/ It also contains the API key.\nThe APT install normally handles API registration automatically, so overwriting the entire configuration file is not recommended.\n4. Configuring SSH Attack Detection SSH is one of the most common entry points for attacks against public-facing servers.\nEven with password login disabled, you can still receive a large volume of invalid-username probes and public-key authentication attempts.\n4.1 Install the SSH Collection The CrowdSec Hub provides predefined SSH detection rules.\nInstall it:\nsudo cscli collections install \\ crowdsecurity/sshd View it:\nsudo cscli collections list A Collection is a set of Parsers and Scenarios, where:\nThe Parser is responsible for understanding SSH logs. The Scenario is responsible for deciding whether something counts as an attack. 4.2 Configure journald Debian 12 uses systemd by default, so SSH logs can be read straight from journald.\nCheck first:\nsudo journalctl -u ssh.service \\ -n 20 --no-pager If you can see SSH login records, you can configure CrowdSec to read the matching logs.\nCreate the file:\n/etc/crowdsec/acquis.d/ssh.yaml Write:\nsource: journalctl journalctl_filter: - \u0026#34;_SYSTEMD_UNIT=ssh.service\u0026#34; labels: type: syslog Two details matter here.\nFirst, journalctl_filter must match the actual log fields.\nSecond, type: syslog tells CrowdSec to use the corresponding log parsing pipeline — it should not be casually changed to sshd.\nIf the auto-discovered log source installed at setup time already covers SSH, avoid collecting the same data twice.\nValidate the configuration:\nsudo crowdsec -t Restart the service:\nsudo systemctl restart crowdsec Check acquisition:\nsudo cscli metrics show acquisition Once new SSH log events appear, the corresponding source should show up in the acquisition metrics.\n4.3 Verify SSH Log Parsing You can use cscli explain to test the log parser.\nThe example below uses the documentation-reserved IP, so it doesn\u0026rsquo;t expose a real attack source:\nsudo cscli explain \\ --log \u0026#39;Oct 19 18:48:40 server sshd[1234]: Invalid user test from 203.0.113.10 port 51878\u0026#39; \\ --type syslog If parsing succeeds, you should see the corresponding syslog and SSH parsing pipeline.\nNote: cscli explain is a log-parsing diagnostic tool — a single test record like this will not get an IP banned.\n5. Configuring Caddy Log Detection Besides SSH, CrowdSec can also identify malicious HTTP requests from a reverse proxy\u0026rsquo;s access logs.\nCaddy is used as the example here.\n5.1 Install the Caddy Collection sudo cscli collections install \\ crowdsecurity/caddy If you also run Nginx, install this as well:\nsudo cscli collections install \\ crowdsecurity/nginx 5.2 Configure Log Acquisition Suppose Caddy\u0026rsquo;s access logs are stored in:\n/var/log/caddy/ and use JSON format.\nCreate:\n/etc/crowdsec/acquis.d/caddy.yaml Contents:\nfilenames: - /var/log/caddy/*.log labels: type: caddy Restart CrowdSec:\nsudo crowdsec -t sudo systemctl restart crowdsec Check:\nsudo cscli metrics show acquisition If it shows logs being read and parsed, the acquisitor and the parser are working.\nThat said, it does not mean malicious requests have been detected yet.\n5.3 How Does CrowdSec Judge HTTP Attacks? CrowdSec judges based on different Scenarios, asking questions such as:\nWhether sensitive files are being accessed repeatedly in a row. Whether a large number of non-existent paths are being probed. Whether known vulnerability-probing behaviour is present. Whether the HTTP request rate is abnormal. Whether the request matches the behaviour signature of known malicious HTTP clients. For example, requests to these paths:\n/.env /wp-admin/ /phpinfo.php /.git/config These paths show up in automated scans all the time.\nBut a single visit does not necessarily trigger a ban.\nCrowdSec evaluates the rules of the specific Scenario, so that normal traffic isn\u0026rsquo;t misjudged as an attack.\n6. When Does CrowdSec Actually Ban an IP? This is the single most important thing to understand when using CrowdSec.\nCrowdSec does not ban an IP the moment it sees one failed SSH login. It generates alerts and ban decisions once the behaviour meets a Scenario\u0026rsquo;s detection conditions.\n6.1 The Leaky Bucket Algorithm Many CrowdSec Scenarios use the Leaky Bucket algorithm.\nYou can think of each IP as an individual bucket:\nEvery qualifying attack event adds one unit to the bucket. The bucket leaks continuously at a configured rate. If events accumulate faster than they leak, the bucket overflows and an attack alert is triggered. For example, a hypothetical rule:\ntype: leaky capacity: 5 leakspeed: \u0026#34;10s\u0026#34; This means:\nThe bucket has a capacity of 5. One event leaks out every 10 seconds. An overflow is triggered when accumulated events exceed the capacity. If an attacker keeps trying to log in over a short period, a ban may be triggered.\nIf attempts happen only once every few minutes, the events may have leaked away before reaching the threshold.\nThis is also why some IPs that scanned through multiple usernames in a row were not banned immediately.\n6.2 Inspect the Real Detection Thresholds Don\u0026rsquo;t guess at CrowdSec\u0026rsquo;s default thresholds from memory.\nDifferent Scenarios, Hub versions and local custom rules may use different parameters.\nInspect the SSH brute-force rule:\nsudo cscli scenarios inspect \\ crowdsecurity/ssh-bf You can also read the installed rule file directly:\ncat /etc/crowdsec/scenarios/ssh-bf.yaml Focus on:\ncapacity: leakspeed: groupby: distinct: Where:\ncapacity determines the bucket size. leakspeed determines how fast events decay. groupby usually groups by source IP. distinct prevents repeated events from being counted over and over. So CrowdSec should not be reduced to \u0026ldquo;5 failures within 10 minutes and you get banned.\u0026rdquo;\nThe real trigger condition is defined by the Scenario\u0026rsquo;s complete rule set.\n6.3 How Long Does the Ban Last? After producing an Alert, CrowdSec uses a Profile to decide whether to generate a ban Decision.\nCheck it:\ncat /etc/crowdsec/profiles.yaml A common IP ban policy looks like this:\nname: default_ip_remediation filters: - Alert.Remediation == true \u0026amp;\u0026amp; Alert.GetScope() == \u0026#34;Ip\u0026#34; decisions: - type: ban duration: 4h on_success: break Where:\nduration: 4h means the ban lasts 4 hours.\nThe Profile that is actually installed may contain other conditions or policies, so check the full configuration before editing — and avoid defining a rule with the same name twice.\n6.4 From Alert to an Actual Ban Even after a Scenario has fired, several further conditions must be met:\nThe detection scenario produces an Alert. The Profile converts the Alert into a Decision. The Firewall Bouncer pulls the Decision. nftables adds the source IP to the ban set. An actual firewall rule matches that source IP. If any one of these steps fails, you can end up in a situation where CrowdSec shows attack alerts but the network connections are not actually blocked.\n7. Verifying That Automatic Bans Work A successful installation does not mean the whole ban chain has been verified.\nIt makes sense to split this into two parts: first verify firewall enforcement, then verify attack detection.\n7.1 Check the Bouncer sudo cscli bouncers list Confirm that:\nThe Bouncer is registered. API authentication is valid. It has been pulling Decisions recently. 7.2 Create a Test Ban Using an RFC 5737 documentation example IP:\nsudo cscli decisions add \\ --ip 203.0.113.10 \\ --type ban \\ --duration 5m \\ --reason manual-test List the decisions:\nsudo cscli decisions list Then check nftables:\nsudo nft list ruleset | grep -i crowdsec Confirm that the banned IP has entered the corresponding set:\nsudo nft list ruleset | grep \u0026#39;203.0.113.10\u0026#39; If you can see the test IP, and the set is referenced by an effective firewall rule, the Bouncer has synced the ban decision to the firewall.\nRelease it once the test is done:\nsudo cscli decisions delete \\ --ip 203.0.113.10 Note that 203.0.113.10 is a documentation test address: it\u0026rsquo;s fine for verifying decision sync, but not for testing whether a real network connection gets blocked.\n7.3 Look at Real Attack Alerts sudo cscli alerts list View the ban decisions:\nsudo cscli decisions list View Scenario metrics:\nsudo cscli metrics show scenarios If a Scenario\u0026rsquo;s Overflow counter increases, the attack detection rule has fired.\nBut whether a ban was actually produced has to be judged together with the Profile, Simulation and Decision.\nCheck the Simulation status:\nsudo cscli simulation status If a Scenario is in simulation mode, it may only produce detection results without enforcing the ban.\n7.4 Avoid Locking Out Your Own Management IP When testing bans on a public-facing server, the most important thing is not to lock out your only way in.\nRecommendations:\nHave the cloud provider\u0026rsquo;s console ready in advance. Never directly ban the egress IP of your current SSH client. Set up the necessary AllowList for trusted, fixed management addresses. Confirm nftables rule priority before changing any policy. Use another controlled device for real connection tests. 8. Does CrowdSec Look at Old Logs? By default, CrowdSec mainly focuses on real-time log analysis, and it does not guarantee that it will automatically scan all historical logs from before the installation at startup.\nFor example, before CrowdSec was deployed, the SSH log may already contain several hundred failed login attempts.\nThose events will not all turn into current ban decisions merely because CrowdSec was installed.\n8.1 Normal Operation Situation Handling Newly generated SSH logs Real-time detection Newly generated Caddy logs Real-time detection Historical logs from before installation Usually not backfilled automatically Need to re-analyse old logs Use Replay Mode The actual starting point for reading may still depend on the data source and its configuration.\n8.2 Export Historical SSH Logs For example, export the past 24 hours:\nsudo journalctl -u ssh.service \\ --since \u0026#34;24 hours ago\u0026#34; \\ --output=short \\ --no-pager \\ \u0026gt; /tmp/ssh-history.log CrowdSec can analyse existing log files through Replay Mode.\nIt replays events according to the original timestamps in the log, and judges whether the detection threshold was reached at that time.\nBe aware, however, that Replay may submit alerts to the API, so you shouldn\u0026rsquo;t casually replay large amounts of historical attack logs directly on a production environment.\nA safer approach is to use a separate configuration and a test environment, so that real ban decisions aren\u0026rsquo;t affected.\nOfficial documentation:\nhttps://docs.crowdsec.net/u/user_guides/replay_mode/\n9. Day-to-Day Management CrowdSec provides the cscli command-line tool, and most routine maintenance can be done from the terminal.\n9.1 Check Service Status systemctl status crowdsec systemctl status crowdsec-firewall-bouncer 9.2 Check Log Acquisition sudo cscli metrics show acquisition 9.3 Check Parser Metrics sudo cscli metrics show parsers 9.4 Check Scenario Metrics sudo cscli metrics show scenarios 9.5 View Banned IPs sudo cscli decisions list 9.6 Ban Manually sudo cscli decisions add \\ --ip 203.0.113.10 \\ --duration 4h \\ --reason manual-ban 9.7 Unban Manually sudo cscli decisions delete \\ --ip 203.0.113.10 9.8 View CrowdSec Logs sudo journalctl -u crowdsec -f View the Bouncer logs:\nsudo journalctl \\ -u crowdsec-firewall-bouncer -f 9.9 Update the Rules Rules from the CrowdSec Hub can be updated independently:\nsudo cscli hub update sudo cscli hub upgrade Updating detection rules is not the same as upgrading the CrowdSec software itself. The software update is still managed through APT.\n10. Frequently Asked Questions CrowdSec Is Running but Nothing Is Being Banned First check log acquisition:\nsudo cscli metrics show acquisition Then check the parsers:\nsudo cscli metrics show parsers Then check:\nsudo cscli metrics show scenarios sudo cscli alerts list sudo cscli decisions list Finally check the Bouncer and nftables:\nsudo cscli bouncers list sudo nft list ruleset The correct troubleshooting order is:\nLog Acquisition ↓ Parser ↓ Scenario ↓ Alert ↓ Decision ↓ Bouncer ↓ Firewall Don\u0026rsquo;t rush to change the ban thresholds before you\u0026rsquo;ve confirmed that the logs are actually being read.\nWhy Are There Lots of Attack Logs but No Bans? Because the number of log lines isn\u0026rsquo;t the same as the number of events that meet the detection conditions.\nSome logs may not have been parsed correctly, and some may simply not match the Scenario\u0026rsquo;s filter.\nAlso, even if the same IP fails to log in many times, if the interval between two events is long enough, the Leaky Bucket may never overflow.\nIt Says I\u0026rsquo;ve Been Banned, but I Can Still Get In Possible causes include:\nThe Bouncer hasn\u0026rsquo;t synced the Decision yet. The nftables rule isn\u0026rsquo;t hooked into the point where traffic actually passes. The firewall rules are in the wrong order. IPv4 and IPv6 aren\u0026rsquo;t both covered. The traffic actually goes through a reverse proxy, so the IP in the log isn\u0026rsquo;t the real client address. The blocked connection and the connection you\u0026rsquo;re testing with come from different sources. So cscli decisions list only proves that CrowdSec produced a decision — on its own it cannot prove that the network layer blocked the traffic.\nDoes CrowdSec Automatically Unban? Yes.\nOnce a ban Decision expires, the Bouncer should sync the firewall set and remove the corresponding IP.\nHowever, if the same IP is also blocked by some other firewall rule, CrowdSec unbanning it will not automatically remove those independent rules.\n11. Conclusion The real value of CrowdSec isn\u0026rsquo;t just automatic IP banning — it\u0026rsquo;s splitting log parsing, behaviour detection and ban enforcement into independent components.\nThat lets you start from the most basic SSH brute-force protection and expand step by step to web services, reverse proxies and centralised multi-server protection.\nIn a real deployment, there are three things worth understanding:\nFirst, CrowdSec does not ban based on a fixed number of failures. It uses Scenarios to judge whether behaviour is abnormal, and many rules use the Leaky Bucket algorithm, so both the frequency and the duration of an attack affect the detection result.\nSecond, successful detection is not the same as a successful ban. Alerts, Decisions, Bouncers and firewall rules are different stages — when troubleshooting, confirm them layer by layer.\nThird, CrowdSec suits continuous monitoring of newly generated security events. If you need to analyse historical attacks, Replay Mode is available, but you should avoid letting historical alerts accidentally affect production bans.\nFor servers already running Debian, systemd, Caddy or Nginx, CrowdSec together with nftables is an automated security-protection option worth considering.\nIt cannot replace timely software updates, secure configuration, SSH public-key authentication and the principle of least privilege — but it can cut down a large volume of repetitive automated scanning and brute-force requests.\nReferences CrowdSec Official Website CrowdSec Official Documentation Linux Installation Guide Firewall Bouncer How Scenarios Detect Replay Mode CrowdSec GitHub ","permalink":"https://blog.imcaoxuan.cn/en/posts/2026-10-19-automatically-banning-malicious-ips-on-a-debian-server-with-crowdsec/","summary":"\u003ch1 id=\"automatically-banning-malicious-ips-on-a-debian-server-with-crowdsec\"\u003eAutomatically Banning Malicious IPs on a Debian Server with CrowdSec\u003c/h1\u003e\n\u003cp\u003ePublic-facing servers face all kinds of automated scanning every single day.\u003c/p\u003e\n\u003cp\u003eEven when you never advertise a service address, your SSH port still routinely receives login attempts against usernames like \u003ccode\u003eroot\u003c/code\u003e, \u003ccode\u003eadmin\u003c/code\u003e and \u003ccode\u003etest\u003c/code\u003e. Web services may get probed for paths such as \u003ccode\u003e.env\u003c/code\u003e, \u003ccode\u003ewp-admin\u003c/code\u003e and \u003ccode\u003ephpinfo.php\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eMost of these requests come from automated scanners. They may not amount to an actual intrusion, but they generate a huge amount of pointless log noise and widen the exposed attack surface.\u003c/p\u003e","title":"Automatically Banning Malicious IPs on a Debian Server with CrowdSec"},{"content":"\nThe history of China\u0026rsquo;s straw burning ban policy is, in effect, a microcosm of the country\u0026rsquo;s agricultural modernization, rural energy transition, environmental governance, and the evolution of grassroots administrative practice.\nThe most important historical conclusion is this: large-scale straw burning was not a problem that existed in China throughout history, nor did the prohibition begin only in recent years. The modern straw burning ban system was gradually established in the 1990s, took the form of a nationwide management regulation in 1999, was visibly strengthened around 2008, and was further incorporated into the air pollution prevention and control system after 2013.\nWhat is more worth studying is the shift between the policy\u0026rsquo;s governance objectives and the way it has been implemented:\nThe original focus was public safety. The priority was the risk of burning near airports, railways, and highways, with air pollution as a secondary concern. The focus later shifted toward regional air quality management. Straw burning became more closely linked, in policy terms, to urban smog and PM2.5 control. Later still, the scope of grassroots enforcement expanded and enforcement methods were intensified. Some localities adopted blanket bans, grid-based patrols, and accountability mechanisms, which produced a tension between policy costs and farmers\u0026rsquo; production needs. The core of the policy debate is not whether burning causes pollution, but how far the prohibition should go, and who should bear the economic cost of disposing of straw. I. Historical Timeline: How the Straw Burning Ban Took Shape Step by Step Before the 1980s\nStraw was an agricultural resource with real uses\nIt was mainly used as cooking and heating fuel, livestock fodder, bedding in animal pens, composting material, and construction material. Open-field burning existed, but large amounts of straw were not without uses.\nLate 1980s — 1990s\nLarge-scale concentrated burning became a social problem\nAgricultural mechanization, the shift in rural household fuels, rising grain output, and the transfer of agricultural labor left some regions with concentrated straw surpluses. Burning gradually became the fastest way to clear fields.\n1999 — 2000\nA nationwide burning ban management system was established\nIn 1999, six ministries jointly issued the Administrative Measures for the Prohibition of Straw Burning and Comprehensive Utilization; in 2000 the Air Pollution Prevention and Control Law was revised to make clear the ban on open-field straw burning in specific zones.\n2008\nOlympic air quality assurance pushed the ban forward\nBeijing, Tianjin, and several surrounding provinces implemented strict burning bans during key periods, and the management scope of cities and key zones was expanded.\n2013 — 2017\nBinding with PM2.5 and air pollution prevention and control\nThe Action Plan for Air Pollution Prevention and Control was rolled out in full. In 2015 the Air Pollution Prevention and Control Law was revised, requiring provincial-level people\u0026rsquo;s governments to delineate burning ban zones and specifying the relevant legal liabilities.\n2018 to present\nGranular grassroots regulation coexists with policy controversy\nGrid-based regulation, satellite fire-point monitoring, and the comprehensive utilization of straw have continued to advance. Some regions have also explored zoned and time-phased burning management.\nThe phases above are anchored in national-level policy milestones, and do not assume that every province moved in lockstep each year.\nII. 1949 — 1980s: Why Did Farmers Rarely Need to Burn Straw at Scale in the Past? To explain today\u0026rsquo;s burning ban policy, one historical change must be understood first:\nStraw has gradually shifted from a resource for production and daily life into, in some regions, an agricultural by-product that must be disposed of at a cost.\n1. Traditional rural society had a relatively complete straw utilization system In the old smallholder economy, straw had many practical uses.\nUse Typical rural practice Household fuel Using wheat straw, rice straw, and corn stalks for cooking and heating Livestock feed Straw chopped and fed to ruminants such as cattle and sheep Agricultural fertilizer Composting, retting, bedding in pens, direct return to fields Household materials Weaving straw mats, making straw rope, roof covering Agricultural support Ground cover, moisture retention, partial erosion control This does not mean burning was absent in the past. Farmers also burned crop stubble and weeds, or used plant ash to supplement some mineral nutrients.\nYet in an era of material scarcity, straw had value as both fuel and a production input, and was not generally treated as waste.\n2. The changes after the 1980s were decisive As the rural economy developed, several changes piled up:\nFirst, the rural energy mix changed. Coal, liquefied petroleum gas, electricity, and later natural gas gradually replaced direct straw burning, reducing the household demand for fuel.\nSecond, agricultural production was mechanized. Combine harvesters raised harvesting efficiency and at the same time left large amounts of straw concentrated in the field within a short window.\nThird, farmers\u0026rsquo; incomes and employment structure changed. Rural labor shifted toward non-agricultural industries, raising the opportunity cost of collecting, drying, transporting, and storing straw.\nFourth, the cropping system has strict time requirements. In particular, in rice–wheat and wheat–corn rotation areas, the gap between harvest and the next planting can be very short.\nFarmers therefore faced an economic choice:\nThe field had to be cleared quickly, but straw could not be sold, hauling it away cost money, and leaving it in the field could interfere with sowing.\nOpen-field burning thus became the cheapest and fastest disposal method in some areas.\n3. Historical documents confirm the shift In June 2000, at the National Working Conference on Straw Burning Prohibition and Comprehensive Utilization, Xie Zhenhua, head of the State Environmental Protection Administration, offered a set of estimates for that moment:\nThe country produced about 650 million tons of crop straw each year. About 50% was used for fertilizer and feed. About 30% was used for fuel and industrial raw material. About 20% was not effectively utilized. In some economically developed areas and the outskirts of large cities, the surplus ratio reached as high as 70% — 80%. These numbers reflect the government\u0026rsquo;s estimate of straw resource utilization at that time and should not be read as current data.\nFrom this, an important conclusion follows:\nThe problem of large-scale straw burning in modern China is, to a large extent, the result of rising agricultural productivity, the decline of traditional rural resource-use systems, and the failure of new mechanized collection-and-storage and resource-based utilization systems to be built in step.\nIII. The 1990s: Straw Burning Prohibition Begins to Be Institutionalized 1. Early governance was not driven solely by environmental concerns In the 1990s, the government had already taken notice of straw burning, and an important reason was traffic safety.\nConcentrated burning can cause local smoke density to rise sharply in a short time, directly threatening:\nVisibility for civil aircraft during takeoff and landing; Highway vehicle safety; Railway traffic safety; The safety of high-voltage transmission lines, forests, and related infrastructure. Straw burning prohibition therefore has an obvious public-safety governance background.\n2. 1999: the first landmark nationwide management document On 12 April 1999, the State Environmental Protection Administration, jointly with the Ministry of Agriculture, the Ministry of Finance, the Ministry of Railways, the Ministry of Transportation, and the General Administration of Civil Aviation of China, issued:\nAdministrative Measures for the Prohibition of Straw Burning and Comprehensive Utilization (Huan Fa [1999] No. 98).\nThis document is one of the most important original sources for studying the history of modern straw burning prohibition in China.\nIt is especially worth noting that the 1999 measures did not simply order a blanket ban on burning across all farmland in the country.\nArticle 4 defined priority burning ban zones:\nPriority Burning Ban Range Defined in 1999 15 km Within a 15 km radius of an airport center\n2 km Within 2 km of each side of an expressway or railway\n1 km Within 1 km of each side of a national or provincial highway\nThe range also covered areas near high-voltage transmission lines, other zones lawfully designated by local governments, and allowed adjustments to the distances according to natural and climatic conditions.\nSource: Huan Fa [1999] No. 98, Article 4.\nThis shows that the earliest institutional design mainly adopted priority-zone prohibition + local zoned management + promotion of comprehensive utilization, rather than a uniform nationwide burning ban across all farmland.\nAnother historical detail deserves particular attention: Article 8 of the 1999 measures allowed a fine of no more than 20 yuan to be imposed on the direct responsible person for illegal burning within the ban zone. This reflects a clear difference between the management regime of the time and the penalty levels that came later.\nThe original document is available here: Ministry of Ecology and Environment: 1999 Administrative Measures for the Prohibition of Straw Burning and Comprehensive Utilization.\nIV. 2000 — 2007: From Sectoral Management to an Explicit Statutory Ban The 2000 revision of the Air Pollution Prevention and Control Law of the People\u0026rsquo;s Republic of China, in Article 41, formally incorporated the straw burning ban into the legal system for air pollution prevention and control.\nIts focus remained:\nDensely populated areas; The vicinity of airports; The vicinity of major transportation arteries; Other burning ban zones designated by the local people\u0026rsquo;s government. During this period, the straw burning ban gradually shifted from specialized management by the environmental protection department to a standing task that local governments were required to undertake.\nBut the effect of the ban was unstable.\nA 2008 document from the Ministry of Environmental Protection reviewed the fire points monitored by satellite in May — June 2007:\nProvince Fire points monitored in May — June 2007 Henan 1,013 Jiangsu 592 Anhui 577 Shandong 357 Hebei 280 Source: Ministry of Environmental Protection, Huan Fa [2008] No. 22. These are satellite fire-point counts for a specific monitoring period and are not equivalent to the total number of burning incidents for the year.\nThis shows that, by 2007, although the burning ban system had been in place for years, burning was still widespread in major agricultural producing areas such as the Huang-Huai-Hai region.\nIn Henan, Anhui, and Jiangsu in particular, after the summer harvest farmers had to rapidly organize the next crop, and concentrated burning had a strongly seasonal character.\nV. 2008: Why Was the Beijing Olympics a Key Turning Point? 2008 was a very clear turning point in the history of the straw burning ban policy.\nOn 21 April 2008, the Ministry of Environmental Protection issued the Notice on Further Strengthening Straw Burning Prohibition (Huan Fa [2008] No. 22).\nThe document made clear that, in order to protect air quality in the Olympic host cities:\nFrom early May to the end of September 2008, nine provinces and municipalities — Beijing, Tianjin, Hebei, Henan, Shandong, Shanxi, Anhui, Jiangsu, and Liaoning — were designated priority burning ban zones, and a full ban was implemented.\nThis is markedly different from the priority-zone prohibition of 1999.\n1. The governance scope expanded significantly The 1999 approach was mainly to protect key locations such as airports, highways, and railways.\nIn 2008, the cross-regional transport of air pollution began to more visibly shape policy design.\nThe smoke from a field in Henan or Hebei does not necessarily only affect the vicinity of the field. Given suitable meteorological conditions, pollutants can cross administrative boundaries and affect regional air quality.\nThe 2008 ban management therefore already embodied the idea of regional joint prevention and control.\n2. The administrative accountability mechanism was further strengthened The 2008 policy stressed that local governments bear overall responsibility for straw burning prohibition in their jurisdictions, and incorporated burning ban performance into environmental protection target assessments.\nIt also strengthened:\nDedicated inspection and supervision; Satellite remote-sensing fire-point monitoring; Investigation and handling of illegal activities; Assessment and accountability for the implementation of burning ban work. This meant that straw burning was no longer purely a matter of farmers\u0026rsquo; production behavior; it also became a matter of local governments\u0026rsquo; environmental governance performance.\n3. In 2008, comprehensive utilization policies were also issued In the same year, the General Office of the State Council issued the Opinions on Accelerating the Comprehensive Utilization of Crop Straw (Guo Ban Fa [2008] No. 105).\nIt emphasized converting straw into a resource, raising utilization levels, and promoting technologies such as mechanized return to fields, feed use, and energy use.\nFrom the standpoint of institutional design, 2008 in fact contained two parallel policy tracks: strengthening the constraints of the ban, and developing alternative uses.\nThe real problem is that administrative prohibition can be implemented quickly, whereas the straw utilization industry, machinery and equipment, and collection-and-transport networks generally take longer to build.\nThis time lag is an important reason why contradictions have recurred since.\nVI. 2013 — 2017: Smog Governance Reshaped the Policy Positioning of the Straw Burning Ban 1. The 2013 Action Plan for Air Pollution Prevention and Control In 2013, China entered a more intensive stage of air pollution governance.\nIn September 2013, the State Council issued the Air Pollution Prevention and Control Action Plan (Guo Fa [2013] No. 37), commonly known as the \u0026ldquo;Ten Articles on Air.\u0026rdquo;\nIt elevated PM2.5 and other fine particulate pollution, as well as regional air quality issues, to an important place in national environmental governance.\nIn the same year, the relevant national departments pushed forward straw comprehensive utilization and burning prohibition work. In its winter 2013 air pollution prevention and control notice, the Ministry of Environmental Protection even set the strict requirement of \u0026ldquo;not a single fire, not a wisp of smoke.\u0026rdquo;\nHowever, a distinction must be made: such work requirements are not equivalent to every piece of farmland in the country being uniformly placed under a burning ban by law.\n2. Satellite monitoring made the straw burning ban assessable Satellite remote-sensing monitoring had already been used before 2008. According to a later response from the Ministry of Environmental Protection, from 2009 a regularized daily fire-point satellite monitoring and public reporting mechanism was set up for the summer and autumn harvest seasons nationwide; in 2014 this was further strengthened with monthly reports, fire-point intensity rankings, and information disclosure.\nIt had a significant impact on the way local governments operated.\nIn the past, in-field burning was a dispersed agricultural activity, and higher-level departments found it hard to continuously track what was happening in every locality.\nSatellite remote sensing made fire points locatable, aggregable, and comparable.\nThe shift in administrative logic\nFarmers burn straw in the field\nSatellite monitoring detects fire points; localities verify\nStatistics, notifications, and rankings by administrative region\nLocal governments strengthen responsibility allocation, inspection, and assessment\nThis system has an obvious advantage: it improves the efficiency of detecting environmental violations.\nBut it also carries a potential problem: if assessment depends excessively on the number of fire points, localities may pay more attention to \u0026ldquo;no fire points appearing\u0026rdquo; than to whether straw is actually being disposed of effectively.\nThe latter is an analysis based on administrative incentive mechanisms and does not in itself prove that such distortions exist in every locality.\n3. Actual monitoring data show a clear change According to data disclosed by the Ministry of Environmental Protection in 2015:\nThe 2013 figure is calculated from the officially published 2014 figure of 5,034, a year-on-year decrease of 2,844.\nYear-on-year decline from 2013 to 2014\n36.3% The statistics use the satellite remote-sensing and verification methodology of the time. The reduction in monitored fire points is not, on its own, sufficient to prove that the decline is entirely attributable to the burning ban policy, nor does it directly translate into a calculable improvement in PM2.5.\n4. 2015 revision of the Air Pollution Prevention and Control Law The Air Pollution Prevention and Control Law revised in 2015 and implemented from 2016 further clarified:\nArticle 76: encourages and supports the resource-based utilization of straw, and the building of a collection–storage–transportation and utilization service system. Article 77: requires provincial-level people\u0026rsquo;s governments to delineate zones where open-field burning is prohibited. Article 119: sets out administrative penalties for illegal burning. Among them, Article 119, for straw burning in the open field under the circumstances it specifies, set a fine range of 500 — 2,000 yuan. Its exact application still needs to be assessed in light of the location of the violation and the legal provisions in force at the time.\nCompared with the 1999 management measures\u0026rsquo; fines of up to 20 yuan, legal constraints have clearly been strengthened.\nVII. 2018 — 2024: Comprehensive Burning Bans, Grid Management, and Grassroots Governance Contradictions In 2018, the State Council issued the Three-Year Action Plan to Win the Battle for Blue Skies.\nThe document specifically required:\nStrengthening local governments\u0026rsquo; principal responsibility for the burning ban; Establishing a grid-based regulatory system in key zones; Conducting dedicated inspection during the summer and autumn harvest periods; Northeast China to formulate dedicated plans for concentrated burning; Combining blocking and channeling, so that by 2020 the national comprehensive utilization rate of straw would reach 85%. Note: the document also explicitly required the Northeast to strengthen scientifically ordered channeling, which shows that the central-level policy has not always advocated an undifferentiated ban on all burning.\n1. Why did some localities adopt stricter comprehensive burning bans? Three factors can explain it.\nAdministrative enforcement cost: Zone- and time-phased management requires analysis of geography, meteorological conditions, burning scale, and pollution dispersion, and is administratively complex.\nAccountability pressure: For grassroots administrators, a blanket prohibition on all in-field fire points is often easier to operate than demonstrating that a particular burn\u0026rsquo;s risk is controllable.\nInsufficient agricultural alternatives: When straw collection-and-storage and comprehensive utilization are not yet fully covered, the burning ban becomes a policy tool that can be implemented immediately.\nThese factors together pushed some localities toward comprehensive burning bans, grid inspection, and fixed-point duty.\nA distinction should be made, however: the delineation of local burning ban zones, inspection management, and administrative penalties each need to comply with their own legal basis and statutory authority. Grassland-level slogans should not be read as nationwide unified law.\n2. The contradiction is especially visible in Northeast China The Northeast is one of the most typical regions in the country.\nCompared with the Huang-Huai-Hai summer-harvest region, the Northeast also faces cold winters, late spring soil thaw, slow straw decomposition in some cases, and large field areas.\nStraw return to fields has real value for protecting soil and adding organic matter, but if machinery operations, straw volume, soil moisture, and tillage systems are not matched, it can also affect the next sowing and seedling emergence.\nA 2024 Ban Yue Tan report described the real dilemmas faced in some parts of the Northeast, including the high cost of removing straw from fields, the insufficient decomposition of straw returned to fields, and the heavy investment in grassroots inspection.\nSuch reports reflect the real difficulties of local governance, but the fact that individual farmers have observed changes in pests and diseases does not, on its own, prove that straw return generally aggravates pests and diseases.\n3. The contradiction can be summed up as four kinds of cost Type of cost Main bearer Typical problem Air pollution and health damage Rural and urban residents Open-field burning releases smoke and dust, forming regional pollution Straw disposal cost Farmers, cooperatives Crushing, baling, transport, and return to fields require investment Grassroots regulatory cost Local government Inspection, duty posts, verification, and law enforcement consume resources Resource-based industry cost Enterprises and public finance Collection–storage–transport networks, production equipment, and stable markets The substance of the policy conflict is this: a burning ban can lower some social environmental cost, but it does not automatically remove the cost of disposing of straw; instead, that cost must be borne in other ways.\nIf the downstream disposal methods are not economical, the burning ban may have to be sustained over the long term by intensive administrative supervision.\nVIII. 2025: Policy Begins to Explicitly Correct the \u0026ldquo;One-Size-Fits-All\u0026rdquo; Problem 2025 is another important turning point in the history of China\u0026rsquo;s straw burning ban policy.\nThe 2025 Central Document No. 1, the Opinions of the CPC Central Committee and the State Council on Further Deepening Rural Reform and Steadily Promoting Comprehensive Rural Revitalization, explicitly stated:\nSupport the comprehensive utilization of straw, precisely delineate burning ban zones, and implement burning ban control requirements in accordance with the law.\nThe most noteworthy part here is not \u0026ldquo;support straw utilization\u0026rdquo; — that has been policy for years — but rather the precise delineation of burning ban zones.\nThis means that at the national policy level, there is now a clearer requirement to balance the air environment, agricultural production, and governance costs, and to avoid replacing scientific management with a sweeping ban on all burning.\nTwo representative local policy changes Jilin: from a comprehensive burning ban to planned burns\nA public response issued in 2025 by the Department of Ecology and Environment of Jilin Province confirmed: since 2018 the locality had implemented different regimes including \u0026ldquo;two-zone\u0026rdquo; control and a comprehensive burning ban, and in autumn 2023 readjusted to planned burns of straw and stubble.\nIn 2024, it was further specified that, on the basis of prioritizing comprehensive utilization, planned burns would be organized for some of the remaining straw and for plots where mechanized operations are difficult, under appropriate conditions.\nHunan: implements classified management of burning ban zones and limited burning zones\nIn June 2025, Hunan Province issued the Plan for the Delineation of Straw Burning Ban Zones and Limited Burning Zones, emphasizing zoned, categorized, graded, and time-phased management based on geographic conditions, pollution dispersion characteristics, and farmland conditions.\nThe plan explicitly proposes preventing a simplistic \u0026ldquo;one-size-fits-all\u0026rdquo; approach, but this does not mean that within the limited burning zones burning is allowed unconditionally at any time.\nThese local policy changes show that there is no fully synchronized and uniform straw burning management model across the country.\nIn fact, the priority-zone approach of 1999, the comprehensive burning ban practiced in some localities later, and the precise zoned delineation required in 2025 form a clear trajectory of policy evolution.\nIX. 2026: The Eco-Environmental Code Formally Changes the Legal Framework As of October 2026, this is the most recent milestone that cannot be ignored in studying the history of straw burning prohibition.\nOn 12 March 2026, the National People\u0026rsquo;s Congress passed the Eco-Environmental Code of the People\u0026rsquo;s Republic of China, which took effect on 15 August 2026. Laws including the original Air Pollution Prevention and Control Law were simultaneously repealed, with their relevant systems being taken over and adjusted by the Code.\nArticle 246 of the Code explicitly provides that local governments should scientifically and precisely strengthen the organization, guidance, and management of straw and similar burning, and clearly defines the burning ban requirements in densely populated areas, around airports, near major transportation arteries, and in other zones and at the times designated by people\u0026rsquo;s governments at or above the provincial level.\nArticle 1,131 provides that burning conduct that meets the elements of the offense may be punished with a fine of 500 — 2,000 yuan.\nThe explanatory statement by the responsible official of the Legislative Affairs Commission of the NPC Standing Committee is especially important on this revision: in response to the past problem of oversimplification and \u0026ldquo;one-size-fits-all\u0026rdquo; approaches, while clarifying the prohibition of burning in priority zones, it requires that the delineation of burning bans in other zones be more standardized.\nComparison of legal philosophies across three periods Period Main legal and policy approach 1999 — 2007 Priority-zone prohibition, local zoned management, encourage comprehensive utilization 2008 — 2024 Regional air quality assessment strengthened; some localities implement comprehensive bans 2025 — 2026 Precise zoned delineation, control in accordance with the law, tailored exploration of limited and planned burning In August 2026, Jilin issued a new comprehensive utilization policy, clearly designating some roads, airport surroundings, and areas near woodlands as burning ban zones, with other zones under limited burning management, alongside straw return and off-field utilization measures. This is a concrete example of the new legal framework being implemented locally.\nIt must be emphasized that the 2026 policy adjustment is not a nationwide restoration of free burning. Being outside a particular burning ban zone does not mean one may light a fire unconditionally; one also has to comply with the locally established rules on timing, organization and management, and fire safety.\nX. Is There a Scientific Basis for the Straw Burning Ban? This question requires separate judgments about environmental pollution, agricultural production, and governance costs.\n1. Open-field straw burning does produce significant air pollution During combustion, straw emits PM2.5, carbon monoxide, nitrogen oxides, volatile organic compounds, and black carbon, among other pollutants.\nA 2015 study published in Atmospheric Environment conducted field measurements of in-field straw burning in eastern China and confirmed that open-field burning of different crop residues releases particulate matter and a range of gaseous pollutants.\nThat does not, however, imply that all of China\u0026rsquo;s smog is mainly caused by straw burning.\nAs an example of quantitative research:\nSimulated contribution of straw burning in Hebei to PM2.5 in Beijing–Tianjin–Hebei Based on 2014 emission inventories and atmospheric modeling\nAverage contribution in June\n4.2% Average contribution in October\n5.5% The study also found that, on specific pollution days, the simulated contribution of straw burning in Hebei to the daily average PM2.5 concentration in Beijing could reach up to 25.7%.\nThis is the modeled result of Hebei\u0026rsquo;s burning source for a specific year, month, and pollution day in the Beijing–Tianjin–Hebei region. It is not a national average contribution, nor does it represent all heavy-pollution weather.\nThis shows that straw burning is usually not the most important pollution source in every season, but during harvest periods, when large-scale concentrated burning coincides with unfavorable meteorological conditions, it can indeed become an important driver of regional air pollution.\n2. Burning is not entirely without an agricultural role Traditionally, farmers used burning to clear fields for clear practical reasons.\nBurning can quickly remove surface residue and, under some conditions, reduce some weed seeds and pest vectors. The ash also retains some mineral components such as potassium and calcium.\nAt the same time, however, combustion loses large amounts of organic carbon and some nutrients, releases pollutants, and can damage the surface soil environment.\nBy contrast, scientific return-to-field can increase soil organic matter inputs, but the decomposition process, pest and disease risk, and sowing outcomes all depend on specific soil, climate, and operating conditions.\nBoth extreme claims are therefore inaccurate:\n\u0026ldquo;Burning straw does no harm to the environment or land at all.\u0026rdquo; \u0026ldquo;Returning all straw to the field is necessarily better than any other disposal method, everywhere.\u0026rdquo; Reviews of relevant research from agricultural science institutions have clearly discussed the long-term soil benefits of straw return, as well as the applicability issues such as slow decomposition, pests and diseases, and impacts on crop growth.\nXI. What Has the Burning Ban Actually Changed Economically? An easily overlooked point: the straw burning ban does not only affect the air. It also changes farm operating costs, which in turn affect land transfer and mechanization investment.\nA 2026 study published in the Journal of Agricultural Economics, using a panel of rural households from 2009 to 2015, analyzed differences in the timing of strict burning bans across provinces.\nThe study found that, within its identification conditions and sample scope, the burning ban promoted land transfer within villages: more productive farmers expanded their operating area, while less efficient farmers tended to withdraw from part of the land. The study estimated that, at the sample village level, total agricultural output and productivity rose by about 5% and 3% respectively.\nThe study also found that in villages near biomass power plants, the land transfer and production adjustments after the ban were more pronounced.\nThis points to a more complex conclusion:\nThe burning ban policy may simultaneously push scale-oriented agriculture forward, while placing a relatively greater burden on small farmers who lack capital, machinery, and labor capacity.\nThe 5% and 3% figures above are estimates from a specific sample and econometric model. They should not be taken as the definite effect of the burning ban policy nationwide across all years, nor directly equated with increases in individual farmers\u0026rsquo; incomes.\nWhat level has nationwide straw comprehensive utilization reached? According to data published by the Ministry of Agriculture and Rural Affairs, in 2024:\nTotal straw volume\n870 million tons Collectable volume\n730 million tons Comprehensive utilization rate of collectable straw\nOver 88% The statistical scope is the comprehensive utilization rate of collectable straw, not the direct utilization ratio of total straw output.\nAfter years of development, China has formed a utilization pattern dominated by fertilizer and feed use, supplemented by energy, substrate, and material uses.\nBut comprehensive utilization rate is not the only metric that should be assessed. It is also necessary to consider disposal cost, the quality of actual utilization, long-term soil benefits, and whether the related industries can be sustained without persistent high subsidies.\nXII. Comprehensive Assessment: What Does This History Reflect? From the perspective of public policy history, China\u0026rsquo;s straw burning ban has undergone three notable shifts.\n1. From a resource utilization issue to an environmental governance issue In the early days, the government was more concerned with how to use straw. After the 1990s, the pollution and public safety risks of concentrated open-field burning became increasingly prominent, and the burning ban gradually became an independent and important policy goal.\nA 1998 news item is particularly representative.\nA People\u0026rsquo;s Daily report dated 19 May 1998 described how, because farmers near Chengdu Shuangliu Airport burned straw, dense smoke forced the airport to close three times within 24 hours, with 17 flights delayed, returning, or diverting. The report also noted that similar incidents had occurred at the airport for three consecutive years since 1996.\nSuch incidents specifically explain why the earliest nationwide management regulation in 1999 placed particular stress on burning bans around airports and major transportation arteries.\n2. From addressing specific pollution to assessing the entire administrative region In 1999, the focus was mainly on priority-zone control.\nIn 2008, broader joint prevention and control requirements emerged.\nAfter 2013, monitoring, rankings, target assessments, and grassroots accountability mechanisms kept being reinforced.\nWhen a public governance issue is converted into an assessable indicator, it can indeed improve implementation efficiency, but it also creates the risk of oversimplification.\nThe history of the straw burning ban therefore has typical value for administrative management research: a reasonable policy objective does not guarantee that every implementation method is reasonable.\n3. From pure prohibition to gradually revisiting agricultural economic realities Straw is an inevitable by-product of crop production.\nFarmers do not stop producing straw because of an administrative ban; only when return-to-field, collection-and-storage, or other utilization methods are feasible in actual production will the economic motivation for open-field burning continue to decline.\nThis is also the deeper cause behind the greater emphasis on precise zoned delineation, scientific management, and comprehensive utilization in the 2025 — 2026 policies.\nFrom international experience, the United States, the United Kingdom, Canada, and other countries have also used permits, smoke management plans, and zone- and time-specific restrictions to manage agricultural burning. They have not simply chosen between a complete ban and complete deregulation.\nFinal Conclusion Looking at nearly 30 years of China\u0026rsquo;s straw burning ban history together, the following judgments emerge:\nFirst, the ban did not emerge out of thin air. It has a real basis in pollution prevention and public safety, especially the 1990s cases of airports affected by straw burning smoke.\nSecond, the strengthening of the ban\u0026rsquo;s reach happened in stages. In 1999 a nationwide priority-zone management system was established; in 2008 a comprehensive burning ban was reinforced during the Olympics; after 2013 the assessment system was further strengthened within the air pollution prevention and control framework, with significant variation in local implementation.\nThird, a comprehensive ban and a reasonable ban are not the same thing. Strict control over high-risk zones is well grounded, but requiring that no farmland be burned under any conditions requires equal consideration of agricultural production, governance costs, alternative technologies, and legal authorization.\nFourth, the 2025 — 2026 policy adjustments have substantive historical significance. They do not negate the earlier objectives of the ban; rather, while keeping the environmental protection and public safety constraints, they begin to more clearly address the long-standing problem of enforcement rigidity.\nUltimately, the core of this history can be summed up as follows:\nChina\u0026rsquo;s straw burning ban policy has evolved from \u0026ldquo;prohibition in priority zones,\u0026rdquo; to \u0026ldquo;comprehensive burning bans in some areas,\u0026rdquo; and then to \u0026ldquo;precise delineation in accordance with the law, with comprehensive utilization as the priority and scientifically ordered control.\u0026rdquo; What it reflects is not only a shift in environmental policy, but also a process in which administrative management has gradually adapted to the realities of agricultural production.\nIf this research is to be taken further, I believe the most worthwhile subject for a separate study is the period 2008 — 2015: how central policy, local legislation, satellite fire-point assessment, and grassroots burning ban enforcement interacted with each other. This is the key period for understanding why some localities moved from the original zoned control toward comprehensive burning bans, and why policy was later readjusted.\n","permalink":"https://blog.imcaoxuan.cn/en/posts/2026-10-17-the-history-of-china-s-straw-burning-ban-policy-from-traditional-farming-to-modern-environmental-governance/","summary":"\u003cp\u003e\u003caudio controls preload=\"metadata\" src=\"https://blog-medias.imcaoxuan.cn/2026/10/18/content-2042193189632222180_202610181638_453671238992294_453671238992295.mp3\"\u003e\u003c/audio\u003e\u003c/p\u003e\n\u003cp\u003eThe history of China\u0026rsquo;s straw burning ban policy is, in effect, a microcosm of the country\u0026rsquo;s agricultural modernization, rural energy transition, environmental governance, and the evolution of grassroots administrative practice.\u003c/p\u003e\n\u003cp\u003eThe most important historical conclusion is this: large-scale straw burning was not a problem that existed in China throughout history, nor did the prohibition begin only in recent years. The modern straw burning ban system was gradually established in the 1990s, took the form of a nationwide management regulation in 1999, was visibly strengthened around 2008, and was further incorporated into the air pollution prevention and control system after 2013.\u003c/p\u003e","title":"The History of China's Straw Burning Ban Policy: From Traditional Farming to Modern Environmental Governance"},{"content":"In 1999, China established a straw burning ban management system centered on priority zones: areas around airports, near major transportation arteries, and densely populated regions became the priority targets. By the 2010s, however, some provinces had begun to enforce strict burning bans across their entire administrative regions.\nWhy did a policy that originally focused on priority-zone management gradually move toward comprehensive burning bans in some localities?\nThe answer is not simply \u0026ldquo;smog has gotten worse.\u0026rdquo; A review of policy documents from 2008 to 2015 shows that the expansion of the ban\u0026rsquo;s scope, the strengthening of local accountability, the spread of satellite remote sensing, and the combination of fiscal subsidies and administrative assessment together reshaped how straw burning was governed.\nOne thing especially deserves attention: Jiangsu already proposed in 2009 the goal of achieving a province-wide ban on open-field straw burning by the end of 2012. Therefore, treating the comprehensive ban as a policy that only emerged after the 2013 smog-control push does not fit the historical record. 12\nThis article focuses on the institutional evolution during 2008 — 2015, and distinguishes between the original policy text, local practice, and the resulting governance incentives.\nI. 2008 — 2015: How did the burning ban policy cascade into place layer by layer? Modern straw burning prohibition was not carried out by a single department on its own; it unfolded through a cascading governance structure:\nRelevant national departments set policy goals for environmental governance, comprehensive utilization, and responsibility implementation. Provincial governments and local legislatures defined ban zones, local institutions, fiscal support, and assessment methods. City and county governments divided responsibility areas, arranged subsidy funds, organized patrols, and verified burning fire points. Townships, village groups, and agricultural operators directly faced the practical tasks of clearing fields, mechanized return to fields, straw collection and storage, and on-site management. This structure is not fundamentally different from other public policy implementation models, but straw burning has several particular features: it occurs in highly dispersed locations, is concentrated mainly during the farming season, and yet a portion of its fire points can be detected by satellite.\nThis gradually turned it from a dispersed agricultural production activity into an administrative object that could be counted, notified, and ranked.\nII. 2008: The Olympics Assurance Pushed Large-Scale Strict Bans On 21 April 2008, the former Ministry of Environmental Protection issued the Notice on Further Strengthening Straw Burning Prohibition (Huan Fa [2008] No. 22). 1\nThe document not only required that the jurisdictions of municipalities directly under the central government, provincial capitals, and sub-provincial cities be fully included in the burning ban scope, but also specifically stated that, to ensure air quality during the Olympics, from early May to the end of September 2008, nine provinces and municipalities — Beijing, Tianjin, Hebei, Henan, Shandong, Shanxi, Anhui, Jiangsu, and Liaoning — were designated priority burning ban zones and implemented comprehensive burning bans.\nThe document also required satellite remote-sensing monitoring of straw burning, and the organization of dedicated supervision and notifications of the situation.\nWhat did this change mean? The 1999 Administrative Measures for the Prohibition of Straw Burning and Comprehensive Utilization emphasized key areas such as airports and roads, with a strong public-safety and local pollution-control character. The 2008 Olympics assurance, by contrast, placed more stress on regional air quality: pollution emissions from different provinces can affect urban air quality through atmospheric transport.\nAs a result, larger-scale, longer-duration unified bans gained a practical precedent.\nBut it must be made clear that the temporary comprehensive burning ban required for the 2008 Olympics did not mean that the entire country permanently moved to a province-wide ban from that year on. Whether long-term comprehensive burning bans were later established depends on local legislation and specific policies.\nIII. Jiangsu: A Province-Wide Ban Goal Was Already Set in 2009 Jiangsu is an important case for studying the institutional expansion of the straw burning ban.\nOn 20 May 2009, the Standing Committee of the Jiangsu Provincial People\u0026rsquo;s Congress passed the Decision on Promoting the Comprehensive Utilization of Crop Straw. The decision initially defined the following priority burning ban zones: 23\nZone type Burning ban scope defined at the time Nanjing The entire administrative region Other cities with districts 30 km around the built-up urban area County seats and similar areas 5 km around the built-up area Airports 20 km around the airport Expressways, national/provincial highways, and railways 5 km on each side Other zones Designated by district/city or county (city) governments based on actual conditions More importantly, this decision required localities to gradually expand the burning ban zones, achieving a province-wide ban on open-field straw burning by the end of 2012. The Jiangsu Province Comprehensive Utilization of Crop Straw Plan (2010 — 2015), released the same year, reiterated this timeline. 23\nThis shows that, at least in Jiangsu, the province-wide ban was not merely a grassroots slogan but had a clear provincial institutional and planning basis.\nWhy did Jiangsu expand the scope of control relatively early? This is closely related to Jiangsu\u0026rsquo;s economic geography and agricultural production characteristics.\nOn one hand, cities, populated areas, transportation arteries, and airports are densely distributed. When burning ban protection zones were set around these areas, the actual farmland covered could already be quite extensive.\nOn the other hand, rice–wheat rotation is widespread in Jiangsu, and there is time pressure between harvest and the next sowing; farmers need to deal quickly with large amounts of straw left in the field.\nJiangsu therefore did not just prohibit burning on its own; it tried to combine burning bans, mechanized return to fields, fiscal subsidies, and straw collection and storage.\nA 2014 notice from the Ministry of Environmental Protection showed that Jiangsu had earmarked a special subsidy fund of 520 million yuan for mechanized straw return-to-field operations, with local matching funds of 170 million yuan, and the per-mu subsidy standard had been raised from 10 yuan to 20 yuan. At the same time, Jiangsu used satellite remote sensing, ground patrols, and PM2.5 automated monitoring, and explored the use of drones and helicopters for inspection. 4\nThis model embodies two policy directions: using management measures to suppress burning, and using fiscal funds to lower the cost to farmers of adopting alternative disposal methods.\nThe truly difficult problem is that the cost of straw disposal varies across regions and households, and a uniform subsidy standard may not cover all actual expenditures.\nIV. Anhui: In 2014, Satellite Fire Points Were Tied to Fiscal Subsidies If Jiangsu represents the institutional expansion of the spatial scope of the burning ban, Anhui\u0026rsquo;s 2014 practice clearly demonstrates an even more important change: burning fire points began to directly affect the fiscal subsidy funds a local government could receive.\nThe summer straw burning ban work report issued by the Ministry of Environmental Protection in September 2014 records: 4\nAnhui\u0026rsquo;s provincial finance newly arranged 1.145 billion yuan in subsidy funds to support mechanized straw return-to-field and other comprehensive utilization projects in the main producing areas. On a county basis, 5% of the provincial subsidy funds would be deducted for each burning fire point found in a priority zone. 2% would be deducted for each fire point in non-priority zones. Fire points by city and province-administered county were published daily, and rankings were broadcast on weekly television news. After that year\u0026rsquo;s summer harvest, the principal leaders of the three lowest-ranked cities — Bengbu, Huaibei, and Chuzhou — explained the situation on television news. Note: the 5% and 2% were Anhui\u0026rsquo;s deduction rules for relevant local subsidy funds at the time, not fines on individual farmers, nor nationwide rules.\nWhy is this a key turning point? Originally, when a fire burned on a particular field, it mainly involved the actor on site, nearby residents, and the relevant regulatory authorities.\nBut once fire points became linked to fiscal subsidies, public rankings, and administrative accountability, a single fire point could affect the policy assessment and funding arrangements of an entire county.\nThis created stronger administrative incentives:\nThe fewer fire points, the smaller the risk a locality faced in terms of fiscal subsidies and administrative assessment; conversely, a fire point being detected could trigger additional inspections and accountability.\nThis helps explain why some localities tended to expand patrols and raise prevention intensity.\nBut this system also carries potential risks: if assessment relies excessively on the number of fire points, administrators may pay more attention to whether there are \u0026ldquo;any fire points at all\u0026rdquo; than to whether straw is being dealt with in an economic, environmentally sound, and sustainable way.\nThis is an analysis of the incentive mechanism; these rules alone do not justify a sweeping claim that there was widespread unlawful enforcement or improper punishment at the time.\nV. 2013 — 2015: The Burning Ban Became Further Tied to Government Performance Assessment On 14 May 2013, the National Development and Reform Commission, the Ministry of Agriculture, and the Ministry of Environmental Protection jointly issued the Notice on Strengthening the Comprehensive Utilization and Burning Prohibition of Crop Straw (Fa Gai Huan Zi [2013] No. 930). 5\nThe document set out three requirements that deserve attention.\n1. Clarifying local responsibility Local governments bear overall responsibility for the comprehensive utilization of straw in their administrative regions; the principal government leader is the first responsible person; and a target responsibility system needs to be established to assign responsibility to the relevant departments.\n2. Creating a \u0026ldquo;reverse-pressure mechanism\u0026rdquo; The document required linking the burning ban to project approval, total air-pollutant emission reduction assessment, and rural environmental protection target responsibility assessment.\n3. Strengthening satellite monitoring and grassroots supervision The document proposed building a burning ban supervision information system based on a satellite application platform, while promoting the construction of straw crushing, benching, return-to-field, and collection-and-storage-and-transport systems.\nIn 2014, the implementation assessment of the Air Pollution Prevention and Control Action Plan further incorporated straw burning prohibition work. The Ministry of Environmental Protection confirmed this change both in its official 2014 report and in its 2016 reply to a suggestion from a National People\u0026rsquo;s Congress deputy. 46\nAt this point, the straw burning ban was no longer merely an issue of agricultural production and environmental protection; it more directly entered the performance assessment system of local governments.\nWhy did stricter management approaches become easier to appear? From the standpoint of enforcement cost, precisely distinguishing between burning ban zones and non-ban zones, individual plots, special time periods, and management conditions requires more detailed investigation and management capabilities.\nBy contrast, using a simple, unified comprehensive burning ban rule is often easier to publicize, inspect, and hold people accountable for.\nComparison item Precise zoned management Simple comprehensive burning ban Rule complexity Higher Lower Plot and time-period determination Requires specific judgment Relatively simple to judge Agricultural production flexibility Relatively higher Relatively lower Grassroots communication cost May be higher Initially may be lower Environmental risk management More dependent on technical and execution capacity More emphasis on comprehensive pre-emptive prevention This administrative incentive helps explain the drivers behind the expansion of management scope in some localities, but administrative convenience itself cannot replace the legal basis for defining burning ban zones and imposing penalties in accordance with the law.\nMore importantly, simply tightening regulation cannot resolve the final destination of straw.\nIn June 2015, in its reply to a National People\u0026rsquo;s Congress deputy\u0026rsquo;s suggestion, the Ministry of Environmental Protection explicitly pointed out that the straw burning ban faced problems such as the difficulty of evidence collection, the difficulty of imposing penalties, and insufficient grassroots enforcement capacity. In some localities, grassroots personnel carried out 24-hour rotating inspections during the busy farming season, and still could not detect and stop all illegal burning in time. The reply attributed an important cause to: the outlets for large amounts of surplus straw had not yet been effectively resolved in a timely manner. 7\nThis is a very important official judgment: the responsible authorities at the time already recognized that inspection and penalties alone cannot fundamentally solve the problem.\nVI. Hubei: A Province-Wide Burning Ban Formally Implemented in 2015 On 1 February 2015, the Third Session of the 12th Hubei Provincial People\u0026rsquo;s Congress passed the Decision on the Open-Field Burning Prohibition and Comprehensive Utilization of Crop Straw. The document stipulated: from 1 May 2015, open-field straw burning is prohibited throughout the administrative region of Hubei Province. 8\nThe decision also required localities to improve prevention-and-control mechanisms, advance comprehensive utilization, and implement the burning ban through publicity, village rules and covenants, and responsibility allocation.\nInterestingly, the draft amendment explanation published by the Hubei Provincial People\u0026rsquo;s Congress also recorded differing views from the legislative discussion. 9\nAt the time, most representatives agreed with the timeline for the comprehensive ban and the goal of striving for a comprehensive utilization rate of straw of 95% or above by 2020, but some representatives raised the question of whether the implementation timeline and goals could be further considered.\nIn the end, the legislature still chose to implement a province-wide ban starting from 1 May 2015.\nThis shows that the formation of local comprehensive bans was not entirely without discussion. Policymakers also had to choose between air quality, agricultural production cycles, comprehensive utilization capacity, and timing of implementation.\nVII. 2014 — 2015: Did the Number of Fire Points Actually Decrease? According to the Ministry of Environmental Protection\u0026rsquo;s summer notices in two consecutive years, during the monitoring window from 20 May to 31 July: 410\nYear Nationwide satellite-monitored straw burning fire points 2014 2,119 2015 1,158 In 2015, the number decreased by 961 year-on-year, a decline of 45.35%.\nThe change was more pronounced in some provinces:\nProvince Summer 2014 Summer 2015 Year-on-year change Anhui 644 32 -95.0% Hubei 79 14 -82.3% Henan 815 512 -37.2% Hebei 106 196 +84.9% Anhui and Hubei saw sharp declines, while Hebei clearly increased.\nThese official data show that, under the corresponding monitoring conditions, the number of detected straw burning fire points nationwide during the summer did decrease significantly, but the regional variation was very large.\nWhy can\u0026rsquo;t the number of fire points alone be used to evaluate the full effect? First, satellite fire points are not a complete record of all burning activity.\nCloud cover may obscure fire points. Smaller-scale, shorter-duration events may go uncaptured. Thermal anomalies still require ground verification to rule out misidentification. One fire point does not equal one household, nor can it be directly converted into burned area or pollution emissions. Second, changes in fire points are also influenced by weather, planted area, harvest progress, mechanization level, enforcement intensity, and policy incentives.\nFinally, even if fire points drop in a given area, that does not directly imply that local PM2.5 concentrations fell by the same percentage year-on-year.\nTherefore, to evaluate the effect of the burning ban, it is ideal to also combine air-quality monitoring, agricultural production costs, the actual volume of straw disposed of, and governance expenditure.\nVIII. Changes in Jiangsu\u0026rsquo;s Policy Timeline: Institutional Requirements and Real-World Implementation Are Not the Same Jiangsu\u0026rsquo;s 2009 provincial people\u0026rsquo;s congress decision and the plan released afterwards both set the goal of a province-wide ban on open-field straw burning by the end of 2012. 23\nBut on 20 December 2014, the Jiangsu Provincial Government\u0026rsquo;s Opinions on Comprehensively Promoting the Comprehensive Utilization of Crop Straw set new staged goals: 11\nBy 2015, the comprehensive utilization rate of straw to reach 90%, and open-field burning to be basically eliminated. By 2017, the comprehensive utilization rate of straw to rise to over 95%, achieving the goal of a comprehensive ban on open-field straw burning. This shift deserves attention.\nIt does not directly prove that all previous localities failed to enforce the policy, but it shows that making an institutional arrangement for a province-wide ban does not mean that sufficient alternative disposal capacity has actually been built up in reality.\nStraw collection, benching, transport, storage, processing, and sales involve machinery and equipment, rural labor, seasonal logistics, and industrial markets. None of these can be built up immediately simply by issuing an administrative order.\nThe time lag between policy requirements and technical and industrial capacity is key to understanding why the straw burning ban has been repeatedly controversial.\nIX. Is the Burning Ban Actually Solving Pollution or Just Shifting Costs? These two questions should not be confused.\nFirst, open-field burning does produce air pollution and public safety risks. Strict control in densely populated areas, near airports, and along major transportation arteries has a clear public-interest basis.\nSecond, the reality that straw needs to be dealt with does not disappear because of a ban. In the absence of market-based collection and storage and economically viable alternatives, farmers must shoulder the costs of mechanized return to fields, benching, transport, or other field-clearance work.\nFinally, regulation itself also has costs. Satellite monitoring, grassroots inspection, duty, notification, and on-site verification all require public resources.\nThe costs borne by different parties can be roughly divided as follows:\nCost Possible bearers Main manifestations Burning pollution and public-safety damage Residents, transport users, and society Smoke and dust, health risks, reduced visibility Straw disposal costs Farmers, cooperatives, agribusinesses Crushing, return-to-field, benching, transport, storage Regulation and enforcement costs Governments at all levels Monitoring, inspection, verification, law enforcement Investment in resource-based utilization Enterprises, cooperatives, and public finance Collection-and-storage-and-transport networks, processing facilities, subsidies A burning ban may reduce the social cost caused by pollution, but it does not automatically remove the cost of straw disposal.\nA 2016 paper in Resources Science, Analysis of Farmers\u0026rsquo; Straw Disposal Behavior in Jiangsu, Zhejiang, and Anhui, surveyed 473 farmer households. The study found that burning-ban subsidies, farmer awareness, technical guidance on return-to-field, and the presence of straw purchasing stations nearby were all significantly associated with choices to burn, return straw to fields, or sell straw. 12\nThis means whether the policy can be effective over the long term depends both on regulatory intensity and on whether alternative disposal methods are actually feasible.\nIn November 2015, the NDRC and three other departments further issued the Notice on Further Accelerating the Comprehensive Utilization and Burning Prohibition of Crop Straw, emphasizing \u0026ldquo;combining blocking with channeling, with channeling as the main approach\u0026rdquo;, and setting the goal of striving for a national comprehensive utilization rate of straw of 85% or more by 2020. 13\nThis is not a denial of the burning ban; rather, it makes clear that administrative prohibition needs to work alongside agricultural technology, collection-and-storage systems, and market demand.\nX. What Does the 2008 — 2015 History Actually Show? Looking at the key milestones together, the trajectory of policy change is very clear.\nTime Key change Historical significance 2008 Comprehensive bans in nine provinces and municipalities during the Olympics An important precedent for large-scale unified strict control 2009 Jiangsu sets a province-wide burning ban target by the end of 2012 Province-wide bans begin to be institutionalized at the local level 2013 National document emphasizes government responsibility and reverse-pressure mechanism Burning ban further combined with administrative assessment 2014 Anhui ties fire points to deduction of fiscal subsidies Monitoring indicators directly affect local fiscal incentives 2014 Burning ban incorporated into the assessment of the Air Pollution Prevention and Control Action Plan Environmental governance performance further strengthened 2015 Hubei passes a province-wide burning ban decision Province-wide bans institutionalized in more regions 2015 State further strengthens comprehensive utilization and collection-and-storage policies More clearly addresses the limits of relying on the ban alone The most important change in this history is not that people only discovered in 2008 that straw burning pollutes the air, but that what was originally a dispersed agricultural production activity was gradually incorporated into a public governance system that can be monitored, ranked, assessed, and held accountable.\nThis system can mobilize local resources and reduce detected burning fire points in the short term, but it also raises a new question: when administrative goals do not fully align with farmers\u0026rsquo; economic conditions or local agricultural technical levels, who ultimately bears the cost of the burning ban?\nThe legitimacy of a policy\u0026rsquo;s governance goal does not mean that all implementation methods are equally reasonable. Judging the effectiveness of the straw burning ban requires looking at both environmental improvement and agricultural production conditions and implementation costs.\nFrom the 2008 Olympics assurance to the parallel pursuit of comprehensive bans and comprehensive utilization by 2015, China\u0026rsquo;s straw burning ban entered a critical period of transition from regional prevention and control to systematic administrative governance. This also set the stage for the later controversy over province-wide bans, the adjustment of comprehensive utilization policies, and the debate over precise zoned delineation.\nReferences The following mainly uses original government policy documents, official notices, and academic research. All figures are taken as accurate for the corresponding year and statistical scope in the cited sources.\nMinistry of Environmental Protection: Notice on Further Strengthening Straw Burning Prohibition (Huan Fa [2008] No. 22), 21 April 2008 Jiangsu Provincial People\u0026rsquo;s Government: Jiangsu Province Comprehensive Utilization of Crop Straw Plan (2010 — 2015), 2 December 2009 Standing Committee of the Jiangsu Provincial People\u0026rsquo;s Congress: Decision on Promoting the Comprehensive Utilization of Crop Straw, 20 May 2009 (regulation repost) Ministry of Environmental Protection: Notice on the Summer 2014 Straw Burning Prohibition Work Situation, 15 September 2014 NDRC and others: Notice on Strengthening the Comprehensive Utilization and Burning Prohibition of Crop Straw (Fa Gai Huan Zi [2013] No. 930) Ministry of Environmental Protection: Reply to Suggestion No. 7232 of the Fourth Session of the 12th National People\u0026rsquo;s Congress, 2016 Ministry of Environmental Protection: Reply to Suggestion No. 5677 of the Third Session of the 12th National People\u0026rsquo;s Congress, 23 June 2015 Hubei Provincial People\u0026rsquo;s Congress: Decision on the Open-Field Burning Prohibition and Comprehensive Utilization of Crop Straw, 1 February 2015 Hubei Provincial People\u0026rsquo;s Congress: Explanation of the Amendment to the Draft Decision on the Open-Field Burning Prohibition and Comprehensive Utilization of Crop Straw Ministry of Environmental Protection: Notice on the Summer 2015 Straw Burning Pollution Prevention and Control Work Situation, 8 October 2015 Jiangsu Provincial People\u0026rsquo;s Government: Opinions on Comprehensively Promoting the Comprehensive Utilization of Crop Straw (Su Zheng Fa [2014] No. 126) Qi Jun et al.: Analysis of Farmers\u0026rsquo; Straw Disposal Behavior in Jiangsu, Zhejiang, and Anhui, Resources Science, Vol. 38, No. 6, 2016 NDRC and others: Notice on Further Accelerating the Comprehensive Utilization and Burning Prohibition of Crop Straw (Fa Gai Huan Zi [2015] No. 2651) Note: This article focuses on the policy evolution during 2008 — 2015. The historical content of the cited files does not equal the full current legal provisions as of 2026; for the specific current burning ban scope, time periods, and penalties, refer to current laws and the latest local regulations.\n","permalink":"https://blog.imcaoxuan.cn/en/posts/straw-burning-ban-history-part-2/","summary":"The 2008 Olympics guarantee was an important precedent for comprehensive bans. Jiangsu had already set a province-wide ban target in 2009. After 2013, satellite fire-point data, performance assessment, and fiscal subsidies together changed how the policy was implemented.","title":"One Fire, Three Decades: Why Did China's Straw Burning Ban Move from Targeted Control to Comprehensive Prohibition? (Part 2)"}]