Re: Bittorrent blocking

Re: Bittorrent blocking

[Humberto Jucá]

Hi,

I usually set a policy "default drop" - It's what I prefer.
Keeping the range of high ports (UDP) closed, many P2P clients will crash.

There are alternatives like "l7filter" or "opendpi-netfilter for nDPI"
but the processing cost can be quite high in larger networks.
Particularly, it is something that i avoid doing.
https://github.com/ewildgoose/ndpi-netfilter

The snort can help too. You can use a signature like this (local.rules):
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"RST P2P BitTorrent
transfer"; flow:to_server; content:"|13|BitTorrent protocol";
depth:20; metadata:policy security-ips drop;
classtype:policy-violation; sid:1000000; rev:4; resp:rst_all;)

In this example i set flexresp reaction, but the result is more
efficient in "inline mode".


2013/2/20 Dmitry Korzhevin <dmitry.korzhevin@stidia.com>:
> Hello,
>
> Guys, i understand, that this is too frequent question, and i'm already made
> solid investigation in google, but.. mabe you already have good iptables
> rules to block such type of traffic (Bittorrent), or maby you can give
> advice.
>
> For now i use snort with bittorrent-related detection rules, but seems it is
> not best solution.
>
>
> Best Regards,
> Dmitry
>
> ---
> Dmitry KORZHEVIN
> System Administrator
> STIDIA S.A. - Luxembourg
>
> e: dmitry.korzhevin@stidia.com
> m: +38 093 874 5453
> w: http://www.stidia.com
>

Re: Bittorrent blocking

[Michael Rash]

On Feb 20, 2013, Humberto Juc? wrote:

> Hi,
> 
> I usually set a policy "default drop" - It's what I prefer.
> Keeping the range of high ports (UDP) closed, many P2P clients will crash.
> 
> There are alternatives like "l7filter" or "opendpi-netfilter for nDPI"
> but the processing cost can be quite high in larger networks.
> Particularly, it is something that i avoid doing.
> https://github.com/ewildgoose/ndpi-netfilter
> 
> The snort can help too. You can use a signature like this (local.rules):
> alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"RST P2P BitTorrent
> transfer"; flow:to_server; content:"|13|BitTorrent protocol";
> depth:20; metadata:policy security-ips drop;
> classtype:policy-violation; sid:1000000; rev:4; resp:rst_all;)
> 
> In this example i set flexresp reaction, but the result is more
> efficient in "inline mode".

If you go the snort rule route, fwsnort can translates this to (after
removing the metadata keyword - need to update that):

-A FWSNORT_FORWARD -p tcp -m tcp -m string --hex-string
"|13426974546f7272656e742070726f746f636f6c|" --algo bm --to 84 -m
comment --comment "sid:1000000; msg:RST P2P BitTorrent transfer;
classtype:policy-violation; rev:4; FWS:1.6.3;" -j LOG --log-ip-options
--log-tcp-options --log-prefix "[1] REJ SID1000000 " 

-A FWSNORT_FORWARD -p tcp -m tcp -m string --hex-string
"|13426974546f7272656e742070726f746f636f6c|" --algo bm --to 84 -j REJECT
--reject-with tcp-reset 

The above rule is generated with the fwsnort --ipt-reject option if you
really want iptables to reset the connection.

--Mike


> 2013/2/20 Dmitry Korzhevin <dmitry.korzhevin@stidia.com>:
> > Hello,
> >
> > Guys, i understand, that this is too frequent question, and i'm already made
> > solid investigation in google, but.. mabe you already have good iptables
> > rules to block such type of traffic (Bittorrent), or maby you can give
> > advice.
> >
> > For now i use snort with bittorrent-related detection rules, but seems it is
> > not best solution.
> >
> >
> > Best Regards,
> > Dmitry
> >
> > ---
> > Dmitry KORZHEVIN
> > System Administrator
> > STIDIA S.A. - Luxembourg
> >
> > e: dmitry.korzhevin@stidia.com
> > m: +38 093 874 5453
> > w: http://www.stidia.com
> >
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Bittorrent blocking

[Andrew Beverley]

On Wed, 2013-02-20 at 11:58 +0200, Dmitry Korzhevin wrote:
> Guys, i understand, that this is too frequent question, and i'm already 
> made solid investigation in google, but.. mabe you already have good 
> iptables rules to block such type of traffic (Bittorrent), or maby you 
> can give advice.

What's your reason for blocking? Is it just to stop excessive use of
bandwidth? If so, I'd recommend shaping the traffic instead of blocking,
otherwise you just create an arms race whereby users will try and get
around your blocks (and it's unlikely any block will be perfect).

I've had quite good success with some rudimentary detection rules that
just look for lots of traffic to lots of high port numbers. I wrote it
up here:

http://www.andybev.com/index.php/Fair_traffic_shaping_an_ADSL_line_for_a_local_network_using_Linux

I've not updated the page for a while, but the concept should still work
even if you need to adjust the rules.

Andy