Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

is there a way to block users on pfsense-firewall level from using torrents?

Thnaks in advance

share|improve this question
1  
yes, you could ask your users to kindly stop using torrents. Co-operation from your user base will always work better than enforcing rules on them. –  The Unix Janitor Jul 27 '12 at 9:39
    
Hi Unix Janitor, Thanks, but I want to know the configuration for the traffic shaper. –  shreedhar.bh Jul 27 '12 at 11:00
add comment

3 Answers

The short answer is no.

The long answer is that Torrent traffic isn't easily characterizable. I have yet to see a deep packet inspection program that can accurately identify torrent traffic.

If you are concerned that your users are saturating your link with Torrent traffic while other users are trying to do simple things like check e-mails, you should probably consider limiting the amount of simultaneous connections a user can have. Torrents work based off of having many simultaneous connections work together. If you limit the amount connections, you can limit the speed of the torrent and thus, the amount of bandwidth the torrent consumes.

share|improve this answer
    
Would be easier to just equally divide the internet pipe among the users (bandwidth wise), so all users get at least 1/N of it or more when some of them aren't using their quota. –  AnonymousLurker Jul 29 '12 at 20:06
add comment

The "easy" way is to limit internet traffic to proxied traffic - depends if your use case permits this.

The hard way is to get a DPI firewall - not sure if there are any add-ons for pfsense... nDPI is an opensource DPI but not sure if it works on BSD. Even that will be imperfect.

share|improve this answer
add comment

As Seanny123 correctly states, one method is to limit the number of concurrent connections per user.

You could also limit the number of outgoing ports, so only fx. port 21,80,443,25,110 etc is allowed - and then open up on request if users have a good reason.

That is how I do it when I got a lot of users on a limited WAN connection, and it works.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.