|
At our institution we had connected 300+ computers to different LAN's with Internet. Included here are Officies LAN, and Internet Laboratory for students. And we want to Control Torrents or any P2P Protocols. Previous solution to our problem is KerioWinRoute 6.5.x, which satisfies most. The problem is, we have migrated to Ubuntu 8.04 LTS using Webmin Platform. Thanks.
| |||
|
feedback
|
|
Port based P2P blocking is hardly a 100% solution. What you might want to consider is called L7 filtering (Layer 7 filtering). Basically, linux has an implementation that does regex based matching on all packets to decide whats good and whats bad. http://l7-filter.sourceforge.net/ This can help you block all sorts of stuff, including skype. | |||
|
feedback
|
|
The only proper technical solution is to have all traffic going through a proxy that will decrypt SSL traffic on the fly and then apply layer 7 filtering on the passing traffic. Such products are pretty expensive as there is usually a big team of engineers behind them updating the rules needed to classify the packets. You can help yourself somewhat with iptables modules sush as beforementioned ipp2p or l7-filter, but they will not catch encrypted traffic. In any case, technology is very rarely the solution for social problems, and misuse od corporate/public/whatever networks for p2p is a social problem. Try talking to your users, get your organization to create appropriate policies and enforce them with sanctions. This in my experience works much better than a constant technology arms race with your users. | |||||||||||
feedback
|
|
There is a module named IPP2P that can detect & block P2P protocols: http://www.ipp2p.org/ | |||
|
feedback
|
|
It's good practice to block common tracker ports like: 6881-6889 2710 6969 but this will not help against trackers binded on 80 port(i.e tpb.tracker.thepiratebay.org). So blocking all, but 80,443,22 would not help. ipp2p is best solution i know. See Documentation/Usage section About l7-filter. In bittorrent.pat comment says:
In BSD systems pf can apply actions depending on number of states or connections per second, so you can tag bittotent-like traffic, 'cause it rapidly generates connections. Read iptables manual, may be it can do it too. | ||||
|
feedback
|
|
The simple solution is to block all outgoing ports except the ones you want to allow. Alternatively, you can find a list of the ports likely to be used for common P2P applications and block those. Bittorrent tends to only allow a very limited amount of downloading if you are not also uploading, so you should also make sure that you don't accept any incoming connections. You might find it useful to set up some sort of IP accounting on your router based on the TCP port used, and then find out which port is the most heavily used. IPTraf is a useful tool for checking this. I should warn you that you'll never stop everything; people are ingenious and will find a way around any restriction you put in place. Most firewalls will stop the casual user though, which may be enough. | |||
|
feedback
|
|
You can't block P2P completely -- unless you only allow the "good" TCP ports 80, 443, 22... And even that is usually enough for the computer-minded types who have VPNs and similar things. | |||||||
feedback
|
|
Popular SSL tunneling programs like Ultrasurf can let users bypass your firewalls easily. To block encrypted bittornet traffic you would need a specialized UTM device that can inspect and block encrypted tunnels going over http(s). I know only about one that is able to do that - Astaro, but there should be more. | ||||
|
feedback
|
|
You can use ip2p, as earlier mentioned. It's not going to block things completely however. Ideally, you should be fire walling every port you don't specifically use, and using ip2p. Not a perfect solution, but the best you're likely to get. | |||
|
feedback
|
