Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

At our institution we had connected 300+ computers to different LAN's with Internet. Included here are Officies LAN, and Internet Laboratory for students. And we want to Control Torrents or any P2P Protocols. Previous solution to our problem is KerioWinRoute 6.5.x, which satisfies most.

The problem is, we have migrated to Ubuntu 8.04 LTS using Webmin Platform.

Thanks.

share|improve this question
add comment

12 Answers 12

up vote 10 down vote accepted

Port based P2P blocking is hardly a 100% solution. What you might want to consider is called L7 filtering (Layer 7 filtering). Basically, linux has an implementation that does regex based matching on all packets to decide whats good and whats bad.

http://l7-filter.sourceforge.net/

This can help you block all sorts of stuff, including skype.

http://l7-filter.sourceforge.net/protocols

share|improve this answer
add comment

You cannot use straight port blocking. There's a few alternatives. Layer7 filter is slow, unreliable, and to my knowledge no longer maintained.

IPP2P is ok but was superceded by OpenDPI, which has now been discontinued by sponsor ipoque (who sell PACE, a commercial equivalent) nDPI appears to be the logical conclusion of this little path: http://www.ntop.org/products/ndpi/

Easiest, and fairly effective is an extension of David Pashley's suggestion. Block all ports and only allow what you need - and extend this by proxying those services you need - eg with a web proxy, and perhaps an internal mailserver whichn is allowed port25, but clients only talk to the internal server. In this way you can have clients which need no open ports on the firewall at all. This should work but can start to fall to bits if you need to use any complex and/or badly written apps that need direct access.

share|improve this answer
add comment

just try this iptables to stop the p2p. I've tried and it's work on my ubuntu server. Sorry for my bad english. Thanks

Log Torrent

iptables -N LOGDROP > /dev/null 2> /dev/null

iptables -F LOGDROP

iptables -A LOGDROP -j LOG --log-prefix "LOGDROP "

iptables -A LOGDROP -j DROP

Torrent

iptables -A FORWARD -m string --algo bm --string "BitTorrent" -j LOGDROP

iptables -A FORWARD -m string --algo bm --string "BitTorrent protocol" -j LOGDROP

iptables -A FORWARD -m string --algo bm --string "peer_id=" -j LOGDROP

iptables -A FORWARD -m string --algo bm --string ".torrent" -j LOGDROP

iptables -A FORWARD -m string --algo bm --string "announce.php?passkey=" -j LOGDROP

iptables -A FORWARD -m string --algo bm --string "torrent" -j LOGDROP

iptables -A FORWARD -m string --algo bm --string "announce" -j LOGDROP

iptables -A FORWARD -m string --algo bm --string "info_hash" -j LOGDROP

DHT keyword

iptables -A FORWARD -m string --string "get_peers" --algo bm -j LOGDROP

iptables -A FORWARD -m string --string "announce_peer" --algo bm -j LOGDROP

iptables -A FORWARD -m string --string "find_node" --algo bm -j LOGDROP

share|improve this answer
    
Will it allow loading your advice again, being applied? ;-) –  poige Jun 9 '12 at 12:30
    
Of course, I have applied to the network at my office, and now no longer a client that can connect to p2p applications like torrent etc. –  Heri YT Jun 13 '12 at 6:42
add comment

Try these rules (without quotes), and torrents stop:

"iptables -A FORWARD -m string --string "torrents" --algo -kmp --65535 -j DROP"
"iptables -A FORWARD -m string --string "torrent" --algo -kmp --65535 -j DROP"
"iptables -A FORWARD -m string --string "info_hash" --algo -kmp --65535 -j DROP"
"iptables -A FORWARD -m string --string "announce.php?passkey=" --algo -kmp --65535 -j DROP"
"iptables -A FORWARD -m string --string "announce_peers" --algo -kmp --65535 -j DROP"
"iptables -A FORWARD -m string --string "BitTorrent protocol" --algo -kmp --65535 -j DROP"
"iptables -A FORWARD -m string --string "BitTorrent" --algo -kmp --65535 -j DROP"
share|improve this answer
3  
That just matches strings in the packets. Will result in many false positives, and won't stop any encrypted traffic that modern BitTorrent clients. –  Martijn Heemels Mar 16 '12 at 22:28
4  
@MartijnHeemels, including his own text on this page, yeah. ;-) –  poige Jun 9 '12 at 12:31
add comment

bittorrent and most p2p now days is quite evasive. Instead of blocking traffic, use QOS rules to starve clients that are using a large amount of bandwidth, or slowly throttles p2p traffic to zero over amount of time. It won't block the protocol but it will deter p2p'ers that it's so slow it's not worth doing.

Remember not all torrent traffic is bad, some of it good! :-)

share|improve this answer
add comment

You can use ip2p, as earlier mentioned. It's not going to block things completely however. Ideally, you should be fire walling every port you don't specifically use, and using ip2p. Not a perfect solution, but the best you're likely to get.

share|improve this answer
add comment

Popular SSL tunneling programs like Ultrasurf can let users bypass your firewalls easily. To block encrypted bittornet traffic you would need a specialized UTM device that can inspect and block encrypted tunnels going over http(s). I know only about one that is able to do that - Astaro, but there should be more.

share|improve this answer
add comment

It's good practice to block common tracker ports like: 6881-6889 2710 6969

but this will not help against trackers binded on 80 port(i.e tpb.tracker.thepiratebay.org). So blocking all, but 80,443,22 would not help.

ipp2p is best solution i know. See Documentation/Usage section

About l7-filter. In bittorrent.pat comment says:

This pattern has been tested and is believed to work well. It will, however, not work on bittorrent streams that are encrypted, since it's impossible to match (well) encrypted data.

In BSD systems pf can apply actions depending on number of states or connections per second, so you can tag bittotent-like traffic, 'cause it rapidly generates connections. Read iptables manual, may be it can do it too.

share|improve this answer
add comment

The only proper technical solution is to have all traffic going through a proxy that will decrypt SSL traffic on the fly and then apply layer 7 filtering on the passing traffic.

Such products are pretty expensive as there is usually a big team of engineers behind them updating the rules needed to classify the packets.

You can help yourself somewhat with iptables modules sush as beforementioned ipp2p or l7-filter, but they will not catch encrypted traffic.

In any case, technology is very rarely the solution for social problems, and misuse od corporate/public/whatever networks for p2p is a social problem. Try talking to your users, get your organization to create appropriate policies and enforce them with sanctions. This in my experience works much better than a constant technology arms race with your users.

share|improve this answer
    
Er how do proxy servers decrypt SSL on the fly? –  David Pashley Jun 17 '09 at 8:41
    
Take care that using SSL Proxy is forbidden in some contries –  radius Jun 17 '09 at 8:41
    
David Pashley, they sent there certificate instead of the site one. So that they now the private, then they forward request to the true site. –  radius Jun 17 '09 at 8:42
1  
One other step involved in that is using Group Policy to push a trusted root certificate for the SSL proxy so it can forge trusted certs. –  Zan Lynx Jun 17 '09 at 14:38
    
David Pashley, read about "man in the middle" –  grawity Jun 17 '09 at 15:51
show 1 more comment

You can't block P2P completely -- unless you only allow the "good" TCP ports 80, 443, 22... And even that is usually enough for the computer-minded types who have VPNs and similar things.

share|improve this answer
    
p2p works using http and https ports without problem and much configuration –  Kazimieras Aliulis Jun 17 '09 at 9:21
    
softly.lt called it squarely. Over the past few years more and more p2p apps are either moving towards port 80 (often encrypted), or will scan through ports looking for one that is open. Application layer snooping (a specific form of deep packet inspection) will catch the direct use, but not necessarily if the traffic is being tunneled. –  Scott Pack Jun 17 '09 at 11:58
1  
@packs: More and more BitTorrent clients offer full encryption and even camouflage as other protocols because of ISPs doing packet inspection. –  Zan Lynx Jun 17 '09 at 14:36
    
@grawity - Exactly, but they would need to be a pretty advanced user, knowing how to VPN+proxy, and those types of people are probably smart enough not to Torrent at work. –  djangofan Jun 9 '12 at 18:21
    
@packs - yeah, ISPs certainly have packet inpspection, but if they have uTorrent encryption enabled, you aren't going to be able to tell what the traffic is except that they have a large number of connections open. For all they know, you might be playing Diablo 3. –  djangofan Jun 9 '12 at 18:22
add comment

The simple solution is to block all outgoing ports except the ones you want to allow.

Alternatively, you can find a list of the ports likely to be used for common P2P applications and block those. Bittorrent tends to only allow a very limited amount of downloading if you are not also uploading, so you should also make sure that you don't accept any incoming connections.

You might find it useful to set up some sort of IP accounting on your router based on the TCP port used, and then find out which port is the most heavily used. IPTraf is a useful tool for checking this.

I should warn you that you'll never stop everything; people are ingenious and will find a way around any restriction you put in place. Most firewalls will stop the casual user though, which may be enough.

share|improve this answer
add comment

There is a module named IPP2P that can detect & block P2P protocols: http://www.ipp2p.org/

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.