Blocking Bittorrent

[u10723]

I have setup two rules for blocking bittorrent on a particular zone.  First rule is set to Deny Trust to Untrust using an application filter built with P2P applications.  Second rule is set to Deny Untrust to Trust using the same application filter. 

I am able to block any uploading content, but the filter doesn't block any torrents from downloading. 

From the trust side, i also have a URL filter setup to block P2P websites.  So if a user starts a bittorrent session, then brings the torrent to our network then the session will download fine, but not upload. 

Any suggestions on how to fix this?

[mikand]

could you add a last rule like:

RULE4 any to any DENY any, log on session end

and then provide how your traffic log looks like?

Would be handy if you (as debug) also set RULE1-3 for "log on session start" aswell as "log on session end" to see wtf is going on...

[mcolles]

We just set up a  file blocking profile and added it to our application rule.

under objects/security profiles/file blocking, add a rule looking for torrent files with action BLOCK, then apply that profile to your application blocking policy.

as stated before, the torrent file isnt really harmful, but this method blocks anyone from downloading the file in the first place.

[mikand]

will the file block really detect the torrent file sent within magnetic link communication with the tracker?

[mivaldi]

The best way to blocking bittorrent is to block applications:

unknown-udp

unknown-tcp

bittorrent

qvod

Some bittorrent clients, (like Deluge) use application qvod to evade and download torrents.