topic Re: Blocking Bittorrent in General Topics

Blocking Bittorrent

u10723 — Mon, 07 May 2012 15:49:45 GMT

I have setup two rules for blocking bittorrent on a particular zone. First rule is set to Deny Trust to Untrust using an application filter built with P2P applications. Second rule is set to Deny Untrust to Trust using the same application filter.

I am able to block any uploading content, but the filter doesn't block any torrents from downloading.

From the trust side, i also have a URL filter setup to block P2P websites. So if a user starts a bittorrent session, then brings the torrent to our network then the session will download fine, but not upload.

Any suggestions on how to fix this?

Re: Blocking Bittorrent

mharding — Mon, 07 May 2012 16:19:57 GMT

This might help:

Re: Blocking Bittorrent

u10723 — Mon, 07 May 2012 17:06:03 GMT

Yeah I've read through that, but still unable to deny traffic to bittorrent.

Re: Blocking Bittorrent

essnet — Tue, 08 May 2012 16:50:44 GMT

hello,

download a .torrent file is not doing peer to peer, it's like downloading a .doc , it's nothing armful.

Re: Blocking Bittorrent

u10723 — Tue, 08 May 2012 17:13:19 GMT

but opening that .torrent file and downloading a copyrighted product is harmful.

Re: Blocking Bittorrent

mikand — Tue, 08 May 2012 20:21:41 GMT

Not necessary... even GPL stuff is copyrighted but the license allows you to spread the product.

Re: Blocking Bittorrent

mharding — Tue, 08 May 2012 20:30:28 GMT

I wouldn't be too concerned abut .torrent files. A lot of pirating communities (the big one) have switched to magnet links.

http://en.wikipedia.org/wiki/Magnet_URI_scheme

Re: Blocking Bittorrent

essnet — Tue, 08 May 2012 20:39:45 GMT

torrent file is armless : it doesn't contain any dangerous material.

feed it to a torrent client downloader and it will start downloading the real file. This is what PA can block : torrent client traffic.

Re: Blocking Bittorrent

u10723 — Wed, 09 May 2012 00:33:29 GMT

Thank you for your comments, but if you re-read my initial post you will see that I am trying to block torrent client traffic.

Re: Blocking Bittorrent

mikand — Wed, 09 May 2012 08:01:52 GMT

How are your downloads being identified as by the traffic log then?

Perhaps you have some other previous rule in your ruleset that incorrectly allows the traffic?

Re: Blocking Bittorrent

essnet — Wed, 09 May 2012 08:08:35 GMT

Ok,

So first question is : in traffic logs, do you see torrent traffic ? If yes, look at the rule name that allowed that traffic and fix it.

Re: Blocking Bittorrent

u10723 — Wed, 09 May 2012 14:07:14 GMT

my rulleset is setup by:

RULE1 - untrsut to trust DENY P2P

RULE2 - trust to untrust DENY P2P

RULE3 - trust to untrust ALLOW ALL - Filter AV/Malware/URL

I see bittorrent traffic being denied on RULE2 (going out) but no P2P traffic being blocked on RULE1 (coming in).

Re: Blocking Bittorrent

u10723 — Wed, 09 May 2012 15:15:21 GMT

Works great if the torrent is attempted to be started inside the network, but if the tracker is reached and peers connected before bringing the device insde then it will not deny.

Re: Blocking Bittorrent

essnet — Wed, 09 May 2012 15:21:45 GMT

unless you have a rule that allows Untrust to Trust application = ANY , no it won't pass ....

Re: Blocking Bittorrent

u10723 — Wed, 09 May 2012 17:55:31 GMT

That doesn't explain why I can still download torrents. If you read the post above my rules are set in a fashion to deny torrent traffic both in and out, but this doesn't seem to be working properly.

Re: Blocking Bittorrent

mikand — Wed, 09 May 2012 21:44:40 GMT

could you add a last rule like:

RULE4 any to any DENY any, log on session end

and then provide how your traffic log looks like?

Would be handy if you (as debug) also set RULE1-3 for "log on session start" aswell as "log on session end" to see wtf is going on...

Re: Blocking Bittorrent

mcolles — Tue, 15 May 2012 21:51:03 GMT

We just set up a file blocking profile and added it to our application rule.

under objects/security profiles/file blocking, add a rule looking for torrent files with action BLOCK, then apply that profile to your application blocking policy.

as stated before, the torrent file isnt really harmful, but this method blocks anyone from downloading the file in the first place.

Re: Blocking Bittorrent

mikand — Tue, 15 May 2012 22:02:40 GMT

will the file block really detect the torrent file sent within magnetic link communication with the tracker?

Re: Blocking Bittorrent

mivaldi — Fri, 04 Nov 2016 23:28:54 GMT

The best way to blocking bittorrent is to block applications:

unknown-udp

unknown-tcp

bittorrent

qvod

Some bittorrent clients, (like Deluge) use application qvod to evade and download torrents.