Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in the process of setting up an openvpn service for fellow friends (10 - 50) who live in remote countries and would like to get access to various websites. I've got it working great for me but before I let anyone on I want to prevent filesharing programmes from using my server for obvious reasons. Whilst I trust my friends to be law abiding citizens it's all too easy for them to forget that they have the tunnel switched on and start downloading something they shouldn't be.

How can I go about preventing this or limiting this? I've heard it can be tricky. I've heard of squid. Can that help? I could create a whitelist perhaps - it's only 20 or so sites people can't access so it's feasible (not ideal though).

Whilst I'll be offering this to friends, associates, etc., I'll be doing it as a limited company and will explain this to any users who sign up and clearly state it in the TOS. It's a very small gig, but i still have to be careful.

share|improve this question
up vote 3 down vote accepted

Have a look at:

  • l7-filter - Application Layer Packet Classifier for Linux
  • IPP2P - IPP2P is a netfilter extension to identify P2P filesharing traffic.
share|improve this answer
thanks for those, im going to look these up now. – adam Oct 6 '09 at 10:36

If it's just for websites you could block all non-port-80 traffic.

In fact, if it's just for websites, you could make it a secure proxy server.

share|improve this answer
is it possible for users to configure their torrent software to use port 80? – adam Oct 6 '09 at 10:35
Sort of; they would only be able to connect to peers which were set up to use port 80. In practice there aren't any such peers, usually because ISPs don't allow inbound port 80 traffic. The secure proxy server approach avoids all this and only allows them to make outgoing web connections. – pjc50 Oct 7 '09 at 9:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.