Re: how to block kazaa ?

[Joel Newkirk <netfilter@newkirk.us>]

On Tuesday 25 February 2003 09:44 pm, inghau@perkom.co.id wrote:
> hello
>
> i have some problems in my lan environment. most of my clients using
> kazaa to dowmload mp3 and mpg files. these progams eating most of my
> small bandwidth so can i put some rules to "block" these kazaa and
> other p2p program ?
>
> right now my linux boxes is just act as very simple NAT router using
> iptables
>
>
> thank you very much

If you want simply to keep them from working, then the answer is to DROP 
traffic in FORWARD chain to/from the ports used for server or peer 
communication.  For Gnutella/Limewire/Morpheus and kin, this means:

iptables -A FORWARD -p tcp --dport 6346:6347 -j DROP
iptables -A FORWARD -p udp --dport 6346:6347 -j DROP

for EDonkey & Overnet:

iptables -A FORWARD -p tcp --dport 4660:4666 -j DROP
iptables -A FORWARD -p udp --dport 4660:4666 -j DROP

for older Kazaa apparently this suffices:

iptables -A FORWARD -p tcp --dport 1214 -j DROP
iptables -A FORWARD -p udp --dport 1214 -j DROP

But newer implementations apparently support port-hopping, so it seems 
that the only confirmed way to stop it with iptables is with the STRING 
match from patch-o-matic, and block anything with the string "kazaa" 
(don't recall case requirements) in it.  Compiling a custom 
kazaa-blocking kernel may be more than you want to do, though.

If you want to be 'polite' then use the REJECT target instead of DROP, at 
least for connections initiated from the LAN.  If you want to be 
thorough, then LOG the traffic, find out who it is, and beat the kazaa 
out of them with a keyboard... :^)

Also, if the primary bottleneck is outbound, you might find that using 
the mangle table in prerouting to set TOS for certain desirable traffic 
and enacting pfifo queuing discipline will help a great deal - IE change 
TOS to a favorable value (0x10 perhaps) for specific traffic like HTTP 
SMTP POP3 IMAP or any VNC or such and then setting TOS to a 'bulk 
traffic' value (0x02 for example) for the remainder, or for the P2P 
traffic if it is identifiable.  The pfifo qdisc will always send the 
0x10 traffic, and send 0x02 only if there is nothing else waiting to be 
sent.

j