Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

GOAL: strict output rules to allow the use of iplayer but make it hard for other p2p programmes.

I'm relatively new to server admin and iptables. Because I can't rely on my users to behave, I've set up the OUTPUT to default to drop rather than accept.

I've opened up ports 22, 80 and 443 for my own remote access and for the users' web browsing. Now I want to allow the use of the BBCS iplayer software. For those who don't know this is basically p2p software for the distribution of BBC programmes (it's by the BBC so all legit.)

The BBC say to open up ports 80, 443, 947, 1948, 4000, 5000, 8888. I assume this refers to INPUT in my iptables. But what would I have to open up for OUTPUT as that's default to drop? The same ports?

When I open the relevant ports in OUTPUT, is there anyway I can specify to allow only traffic for the BBC iplayer and not say Azureus using standard iptables rules? I can't use stuff like -d destination as it's p2p and surely that would change.

I know ports are supposed to in a way target a programme but I know that in azureus you can change the port number. Though I doubt my small number of users are tech savvy enough to do so, am I right in thinking it's possible to simply enter one of the BBC iplayer ports I've opened in azureus and start torrenting?

share|improve this question
up vote 1 down vote accepted

Any particular reason you want to allow the use of the P2P version of the iPlayer? You could remove this problem altogther by either using the online flash player, or using the Adobe Air client, which uses HTTP direct downloads, rather than P2P.

share|improve this answer
online flash player is fine - when theres teh broadband otherwise it just stutters so i wanted to be able to download. from the blogs i read i thought there was only the p2p version of the desktop iplayer. But come to think of it when i installed it on my pc it was an adobe air app. I read about the p2p version on blogs but they were 2 years old. Has teh bbc switched to air now??? – adam Oct 12 '09 at 13:30
just checked, it looks liek they have released the air version. And i just did tcpdump and found that my pc is communicating with only and not other peers. This looks very promising as i can now add a very specific rule which allows only traffic to come and leave from that very address. – adam Oct 12 '09 at 13:36
Yeah, P2P was abandoned when they move to Air. – Sam Oct 12 '09 at 13:50
Big Grin! That makes things a lot easier for me. Thanks for confirming. – adam Oct 12 '09 at 22:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.