6

is there a way to block users on firewall level from using torrents?

Improve this question
1

9 Answers 9

Reset to default
6

Deep packet inspection is the way to go here. The traffic has to be examined in order to block it effectively. If encryption is used, though, all bets are off.

You might try looking at Untangle. It sounds like it could do what you want.

Improve this answer
1
  • 1
    Untangle's "Protocol Control" is a great way to manage this.
    – Jweede
    Sep 10, 2009 at 19:03
7

Most commercial firewalls only block incoming, they allow all outgoing and that is sometimes enough to get torrents working with minimal speed.

If you need to block it, the best thing you can do is block all outgoing on the router, excluding items that are needed such as smtp, pop3, http, https.

Also, block UPnP as this dynamically allows clients to assign / make outgoing/incoming connection rules.

Improve this answer
2
  • 2
    +1 - Only open what is required for business.
    – skamradt
    Jul 28, 2009 at 16:52
  • 1
    I hear what you're saying, but "needed for business" almost always turns out to include HTTPS, and once you've opened one port for encrypted - and therefore uninspectable - traffic, you've effectively opened everything. As has been said elsewhere, there are proxies which, combined with a local CA root installed on all browsers in the enterprise, can decrypt, inspect, and re-sign HTTPS traffic at the perimeter, but these are uncommon and expensive - and people using them probably don't need to ask the OP's question.
    – MadHatter
    Aug 19, 2011 at 7:47
4

You could use a Squid proxy server or a Smoothwall firewall appliance. These would work because traffic shaping needs to use "deep packet inspection" to detect the protocol type.

If you cant figure out how to block the traffic then you have 2 more options:

  1. Limit bandwidth by IP
  2. Limit number of inbound connections by IP (that would slow Torrent to a crawl).
Improve this answer
2

Your default firewall rule should be to deny all traffic in any direction

Other rules should be added on a pre requirement basis. For example, your DNS server(s) should be allowed to perform DNS lookups on the internet from the private network, but possibly no other machine should be allowed. Your HTTP proxy server should be allowed out on ports 80 and 443, no other devices should have this access unless absolutely required

I have to disagree with Wil, any well configured firewall should take in to account traffic in both directions. If it doesn't, the value of a firewall is somewhat lost as traffic does indeed flow in and out

I would suggest you review your infrastructure, and figure out what requires access in what direction. And, check your logs frequently for any traffic that's being denied, and act upon it if required

Improve this answer
1

You might want to take a look at a similar question I asked a little while back:

Battling Bittorrent

Hope this helps.

Improve this answer
0

Block all incoming and outgoing traffic to ports 6800-7000 to block most default setups for bittorrent clients.

The problem with this is that users can adjust the ports on the client to use other ports.

As another stated, just having inbound traffic on port 80 is enough for many bittorrent clients to work, just very slowly.

The only true way to block it is if there is some marker in the packet from/to the bittorrent client that an intelligent router/firewall could read and then block. I am not aware of any markers like this, though. And most routers/firewalls would only read certain parts of the header, not the whole packet, which would be needed. It could add a significant delay to all network traffic at a large site.

Improve this answer
1
  • "Block all incoming and outgoing traffic to ports 6800-7000" Not any more - uTorrent (the most popular client out there) for instance uses a random port around 50,000
    – Jon Rhoades
    Oct 13, 2009 at 11:21
0

You can also use a DNS system such as OpenDns and set security up so that the known torrent tracking domains are blocked. I believe there is already a very large database of them. You can also have this system setup to not allow access to gaming sites, social networking sites, ect. It all depends on your business and if your network users should be allowed access to facebook or not.

Make it a KNOWN policy that it will not be tolerated, and appropriate action will be taken.

Perform random security audits of desktops to make sure that the security settings put in place are still in place.

Improve this answer
1
  • where do I do that?
    – alexus
    Aug 31, 2009 at 14:14
-1

Intrusion Prevention Systems handle this seemlessly. We use Tipping Point.

Improve this answer
-1

You can list popular torrent sites and block HTTP requests to them. This will disable uses from loading ".torrent" files, so they won't be able to use torrent clients. Mostly :)

Improve this answer
2
  • and then I need to maintain list of all torrents sites?
    – alexus
    Aug 31, 2009 at 14:18
  • Yep, but it's much easier to setup, and you'll need no special devices and/or software to make it work. Harder, but cheaper ;)
    – kolypto
    Aug 31, 2009 at 15:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .