0

GOAL: strict output rules to allow the use of iplayer but make it hard for other p2p programmes.

I'm relatively new to server admin and iptables. Because I can't rely on my users to behave, I've set up the OUTPUT to default to drop rather than accept.

I've opened up ports 22, 80 and 443 for my own remote access and for the users' web browsing. Now I want to allow the use of the BBCS iplayer software. For those who don't know this is basically p2p software for the distribution of BBC programmes (it's by the BBC so all legit.)

The BBC say to open up ports 80, 443, 947, 1948, 4000, 5000, 8888. I assume this refers to INPUT in my iptables. But what would I have to open up for OUTPUT as that's default to drop? The same ports?

When I open the relevant ports in OUTPUT, is there anyway I can specify to allow only traffic for the BBC iplayer and not say Azureus using standard iptables rules? I can't use stuff like -d destination as it's p2p and surely that would change.

I know ports are supposed to in a way target a programme but I know that in azureus you can change the port number. Though I doubt my small number of users are tech savvy enough to do so, am I right in thinking it's possible to simply enter one of the BBC iplayer ports I've opened in azureus and start torrenting?

1 Answer 1

1

Any particular reason you want to allow the use of the P2P version of the iPlayer? You could remove this problem altogther by either using the online flash player, or using the Adobe Air client, which uses HTTP direct downloads, rather than P2P.

4
  • online flash player is fine - when theres teh broadband otherwise it just stutters so i wanted to be able to download. from the blogs i read i thought there was only the p2p version of the desktop iplayer. But come to think of it when i installed it on my pc it was an adobe air app. I read about the p2p version on blogs but they were 2 years old. Has teh bbc switched to air now???
    – adam
    Oct 12, 2009 at 13:30
  • just checked, it looks liek they have released the air version. And i just did tcpdump and found that my pc is communicating with iplay10.something.bbc.co.uk only and not other peers. This looks very promising as i can now add a very specific rule which allows only traffic to come and leave from that very address.
    – adam
    Oct 12, 2009 at 13:36
  • Yeah, P2P was abandoned when they move to Air.
    – Sam Cogan
    Oct 12, 2009 at 13:50
  • Big Grin! That makes things a lot easier for me. Thanks for confirming.
    – adam
    Oct 12, 2009 at 22:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .