Question

Updating Iptables to block torrent traffic

Hi Guys,

I am running a VPN server but need to block illegal torrent downloads. The VPN plugin is provided by safesrv.net I have had updated Iptables prepared but I am interested in feedback from anyone who has experience with this.

Our updated iptables are below:

iptables -I INPUT -p udp --dport 1024:1193 -j DROP iptables -I INPUT -p udp --dport 1195:1644 -j DROP iptables -I INPUT -p udp --dport 1647:65534 -j ACCEPT

Allowing all neede ports for OpenVPN L2TP PPTP and RADIUS

iptables -I OUTPUT -p udp --dport 1812 -j ACCEPT iptables -I OUTPUT -p udp --dport 1813 -j ACCEPT iptables -I OUTPUT -p udp --dport 1701 -j ACCEPT iptables -I OUTPUT -p udp --dport 4500 -j ACCEPT iptables -I OUTPUT -p udp --dport 500 -j ACCEPT iptables -I OUTPUT -p udp --dport 443 -j ACCEPT iptables -I OUTPUT -p tcp --dport 1723 -j ACCEPT

Drop torrents

iptables -A OUTPUT -p tcp --dport 6881:6889 -j DROP iptables -A OUTPUT -p udp --dport 1024:65534 -j DROP

Set more radius (alt) ports

iptables -I OUTPUT -p udp --dport 1645 -j ACCEPT iptables -I OUTPUT -p udp --dport 1646 -j ACCEPT

Try torrent name filters

iptables -A FORWARD -m string --algo bm --string “BitTorrent” -j DROP

Trying forward

iptables -A FORWARD -p tcp --dport 6881:6889 -j DROP iptables -A FORWARD -p udp --dport 1024:65534 -j DROP

Found on web

iptables -N LOGDROP > /dev/null 2> /dev/null iptables -F LOGDROP iptables -A LOGDROP -j DROP

#Torrent iptables -D FORWARD -m string --algo bm --string “BitTorrent” -j LOGDROP iptables -D FORWARD -m string --algo bm --string “BitTorrent protocol” -j LOGDROP iptables -D FORWARD -m string --algo bm --string “peer_id=” -j LOGDROP iptables -D FORWARD -m string --algo bm --string “.torrent” -j LOGDROP iptables -D FORWARD -m string --algo bm --string “announce.php?passkey=” -j LOGDROP iptables -D FORWARD -m string --algo bm --string “torrent” -j LOGDROP iptables -D FORWARD -m string --algo bm --string “announce” -j LOGDROP iptables -D FORWARD -m string --algo bm --string “info_hash” -j LOGDROP

DHT keyword

iptables -A FORWARD -m string --string “get_peers” --algo bm -j DROP iptables -A FORWARD -m string --string “announce_peer” --algo bm -j LOGDROP iptables -A FORWARD -m string --string “find_node” --algo bm -j LOGDROP

Modified debia commands

iptables -A FORWARD -p udp -m string --algo bm --string “BitTorrent” -j DROP iptables -A FORWARD -p udp -m string --algo bm --string “BitTorrent protocol” -j DROP iptables -A FORWARD -p udp -m string --algo bm --string “peer_id=” -j DROP iptables -A FORWARD -p udp -m string --algo bm --string “.torrent” -j DROP iptables -A FORWARD -p udp -m string --algo bm --string “announce.php?passkey=” -j DROP iptables -A FORWARD -p udp -m string --algo bm --string “torrent” -j DROP iptables -A FORWARD -p udp -m string --algo bm --string “announce” -j DROP iptables -A FORWARD -p udp -m string --algo bm --string “info_hash” -j DROP iptables -A FORWARD -p udp -m string --algo bm --string “tracker” -j DROP

iptables -A INPUT -p udp -m string --algo bm --string “BitTorrent” -j DROP iptables -A INPUT -p udp -m string --algo bm --string “BitTorrent protocol” -j DROP iptables -A INPUT -p udp -m string --algo bm --string “peer_id=” -j DROP iptables -A INPUT -p udp -m string --algo bm --string “.torrent” -j DROP iptables -A INPUT -p udp -m string --algo bm --string “announce.php?passkey=” -j DROP iptables -A INPUT -p udp -m string --algo bm --string “torrent” -j DROP iptables -A INPUT -p udp -m string --algo bm --string “announce” -j DROP iptables -A INPUT -p udp -m string --algo bm --string “info_hash” -j DROP iptables -A INPUT -p udp -m string --algo bm --string “tracker” -j DROP

iptables -I INPUT -p udp -m string --algo bm --string “BitTorrent” -j DROP iptables -I INPUT -p udp -m string --algo bm --string “BitTorrent protocol” -j DROP iptables -I INPUT -p udp -m string --algo bm --string “peer_id=” -j DROP iptables -I INPUT -p udp -m string --algo bm --string “.torrent” -j DROP iptables -I INPUT -p udp -m string --algo bm --string “announce.php?passkey=” -j DROP iptables -I INPUT -p udp -m string --algo bm --string “torrent” -j DROP iptables -I INPUT -p udp -m string --algo bm --string “announce” -j DROP iptables -I INPUT -p udp -m string --algo bm --string “info_hash” -j DROP iptables -I INPUT -p udp -m string --algo bm --string “tracker” -j DROP

iptables -D INPUT -p udp -m string --algo bm --string “BitTorrent” -j DROP iptables -D INPUT -p udp -m string --algo bm --string “BitTorrent protocol” -j DROP iptables -D INPUT -p udp -m string --algo bm --string “peer_id=” -j DROP iptables -D INPUT -p udp -m string --algo bm --string “.torrent” -j DROP iptables -D INPUT -p udp -m string --algo bm --string “announce.php?passkey=” -j DROP iptables -D INPUT -p udp -m string --algo bm --string “torrent” -j DROP iptables -D INPUT -p udp -m string --algo bm --string “announce” -j DROP iptables -D INPUT -p udp -m string --algo bm --string “info_hash” -j DROP iptables -D INPUT -p udp -m string --algo bm --string “tracker” -j DROP

iptables -I OUTPUT -p udp -m string --algo bm --string “BitTorrent” -j DROP iptables -I OUTPUT -p udp -m string --algo bm --string “BitTorrent protocol” -j DROP iptables -I OUTPUT -p udp -m string --algo bm --string “peer_id=” -j DROP iptables -I OUTPUT -p udp -m string --algo bm --string “.torrent” -j DROP iptables -I OUTPUT -p udp -m string --algo bm --string “announce.php?passkey=” -j DROP iptables -I OUTPUT -p udp -m string --algo bm --string “torrent” -j DROP iptables -I OUTPUT -p udp -m string --algo bm --string “announce” -j DROP iptables -I OUTPUT -p udp -m string --algo bm --string “info_hash” -j DROP iptables -I OUTPUT -p udp -m string --algo bm --string “tracker” -j DROP

Delete

iptables -D INPUT -m string --algo bm --string “BitTorrent” -j DROP iptables -D INPUT -m string --algo bm --string “BitTorrent protocol” -j DROP iptables -D INPUT -m string --algo bm --string “peer_id=” -j DROP iptables -D INPUT -m string --algo bm --string “.torrent” -j DROP iptables -D INPUT -m string --algo bm --string “announce.php?passkey=” -j DROP iptables -D INPUT -m string --algo bm --string “torrent” -j DROP iptables -D INPUT -m string --algo bm --string “announce” -j DROP iptables -D INPUT -m string --algo bm --string “info_hash” -j DROP iptables -D INPUT -m string --algo bm --string “tracker” -j DROP

iptables -D OUTPUT -m string --algo bm --string “BitTorrent” -j DROP iptables -D OUTPUT -m string --algo bm --string “BitTorrent protocol” -j DROP iptables -D OUTPUT -m string --algo bm --string “peer_id=” -j DROP iptables -D OUTPUT -m string --algo bm --string “.torrent” -j DROP iptables -D OUTPUT -m string --algo bm --string “announce.php?passkey=” -j DROP iptables -D OUTPUT -m string --algo bm --string “torrent” -j DROP iptables -D OUTPUT -m string --algo bm --string “announce” -j DROP iptables -D OUTPUT -m string --algo bm --string “info_hash” -j DROP iptables -D OUTPUT -m string --algo bm --string “tracker” -j DROP

iptables -D FORWARD -m string --algo bm --string “BitTorrent” -j DROP iptables -D FORWARD -m string --algo bm --string “BitTorrent protocol” -j DROP iptables -D FORWARD -m string --algo bm --string “peer_id=” -j DROP iptables -D FORWARD -m string --algo bm --string “.torrent” -j DROP iptables -D FORWARD -m string --algo bm --string “announce.php?passkey=” -j DROP iptables -D FORWARD -m string --algo bm --string “torrent” -j DROP iptables -D FORWARD -m string --algo bm --string “announce” -j DROP iptables -D FORWARD -m string --algo bm --string “info_hash” -j DROP iptables -D FORWARD -m string --algo bm --string “tracker” -j DROP


Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.

Tried all the rules with string init, does not work!!!. Can still download the torrents. may block all the all other ports except browsing

Here is my rules, change the chain as your need.

iptables -A INPUT -m string --string "BitTorrent" --algo bm -j DROP
iptables -A INPUT -m string --string "BitTorrent protocol" --algo bm -j DROP
iptables -A INPUT -m string --string "peer_id=" --algo bm -j DROP
iptables -A INPUT -m string --string ".torrent" --algo bm -j DROP
iptables -A INPUT -m string --string "announce.php?passkey=" --algo bm -j DROP
iptables -A INPUT -m string --string "torrent" --algo bm -j DROP
iptables -A INPUT -m string --string "announce" --algo bm -j DROP
iptables -A INPUT -m string --string "info_hash" --algo bm -j DROP
iptables -A INPUT -m string --string "tracker" --algo bm -j DROP
iptables -A INPUT -m string --string "get_peers" --algo bm -j DROP
iptables -A INPUT -m string --string "announce_peer" --algo bm -j DROP
iptables -A INPUT -m string --string "find_node" --algo bm -j DROP

Tested it and it works when you put them in the forward chain. Tested it over the openvpn and putting (for testing!) this rule at the top of the chain. All other networks can pass and only traffic coming from the 10.8.1.0/24 network is not getting any over 443 :

-A FORWARD -s 10.8.1.0/24 -p tcp --dport 443 -j DROP -A FORWARD -i tun+ -j ACCEPT