How to block BitTorrent traffic with IPtables

admin
  • December 19, 2023
0 Shares
0
0
0
0
0
Shares
0
0
0
0

IPTABLES is a user-space application that allows the system administrator to configure the tables provided by the Linux kernel firewall (implemented as various Netfilter modules) and its stored chains and rules.

Set up IPtables rules

To block BitTorrent traffic with IPTABLES, you can edit /etc/sysconfig/iptables (CentOS 7) and include the following:

vim /etc/sysconfig/iptables

.First you need to add the chain just above the first rules.

:RH-Firewall-1-INPUT - [0:0]

 

Then add the following above the COMMIT line.

# Torrent ALGO Strings using Boyer-Moore
-A RH-Firewall-1-INPUT -m string --algo bm --string "BitTorrent" -j DROP
-A RH-Firewall-1-INPUT -m string --algo bm --string "BitTorrent protocol" -j DROP
-A RH-Firewall-1-INPUT -m string --algo bm --string "peer_id=" -j DROP
-A RH-Firewall-1-INPUT -m string --algo bm --string ".torrent" -j DROP
-A RH-Firewall-1-INPUT -m string --algo bm --string "announce.php?passkey=" -j DROP
-A RH-Firewall-1-INPUT -m string --algo bm --string "torrent" -j DROP
-A RH-Firewall-1-INPUT -m string --algo bm --string "announce" -j DROP
-A RH-Firewall-1-INPUT -m string --algo bm --string "info_hash" -j DROP
-A RH-Firewall-1-INPUT -m string --algo bm --string "/default.ida?" -j DROP
-A RH-Firewall-1-INPUT -m string --algo bm --string ".exe?/c+dir" -j DROP
-A RH-Firewall-1-INPUT -m string --algo bm --string ".exe?/c_tftp" -j DROP

# Torrent Keys
-A RH-Firewall-1-INPUT -m string --string "peer_id" --algo kmp -j DROP
-A RH-Firewall-1-INPUT -m string --string "BitTorrent" --algo kmp -j DROP
-A RH-Firewall-1-INPUT -m string --string "BitTorrent protocol" --algo kmp -j DROP
-A RH-Firewall-1-INPUT -m string --string "bittorrent-announce" --algo kmp -j DROP
-A RH-Firewall-1-INPUT -m string --string "announce.php?passkey=" --algo kmp -j DROP

# Distributed Hash Table (DHT) Keywords
-A RH-Firewall-1-INPUT -m string --string "find_node" --algo kmp -j DROP
-A RH-Firewall-1-INPUT -m string --string "info_hash" --algo kmp -j DROP
-A RH-Firewall-1-INPUT -m string --string "get_peers" --algo kmp -j DROP
-A RH-Firewall-1-INPUT -m string --string "announce" --algo kmp -j DROP
-A RH-Firewall-1-INPUT -m string --string "announce_peers" --algo kmp -j DROP

 

Restart IPtables

/etc/init.d/iptables restart

View IPtables/Verify Rules

iptables -L

Sample output

Chain RH-Firewall-1-INPUT (0 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            STRING match "BitTorrent" ALGO name bm TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "BitTorrent protocol" ALGO name bm TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "peer_id=" ALGO name bm TO 65535 
DROP       all  --  anywhere             anywhere            STRING match ".torrent" ALGO name bm TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "announce.php?passkey=" ALGO name bm TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "torrent" ALGO name bm TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "announce" ALGO name bm TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "info_hash" ALGO name bm TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "/default.ida?" ALGO name bm TO 65535 
DROP       all  --  anywhere             anywhere            STRING match ".exe?/c+dir" ALGO name bm TO 65535 
DROP       all  --  anywhere             anywhere            STRING match ".exe?/c_tftp" ALGO name bm TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "peer_id" ALGO name kmp TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "BitTorrent" ALGO name kmp TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "BitTorrent protocol" ALGO name kmp TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "bittorrent-announce" ALGO name kmp TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "announce.php?passkey=" ALGO name kmp TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "find_node" ALGO name kmp TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "info_hash" ALGO name kmp TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "get_peers" ALGO name kmp TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "announce" ALGO name kmp TO 65535 
DROP       all  --  anywhere             anywhere            STRING match "announce_peers" ALGO name kmp TO 65535

 

In this article:
,,,
Post written by:
Follow
Leave a Reply

Your email address will not be published. Required fields are marked *


Previous Article
Next Article
You May Also Like
The best ways to prevent DDoS attacks

Best practices for preventing DDoS attacks for website administrators

DDoS (Distributed Denial of Service) attacks are one of the most common and destructive security threats to websites and servers. These attacks saturate server resources by sending a huge volume of malicious requests, causing severe slowdowns, site downtime, and even loss of revenue and brand reputation. For site managers and server administrators, familiarity with basic methods of dealing with DDoS is a necessity, not an option. In this article, we will examine the most effective technical and practical solutions to prevent and reduce the impact of DDoS attacks in an expert manner.
0 Shares
0
0
0
5 Effective Tips for Securing SSH Server on Ubuntu

5 Effective Tips for Securing SSH Server on Ubuntu

  • Elahe
  • December 24, 2025
  • 5 minute read
This article will explore 5 effective ways to harden your SSH server on Ubuntu. By implementing these tips, you can increase the security of your servers and prevent unwanted access. These include authenticating with SSH keys, restricting access, and using protection tools like Fail2Ban.
0 Shares
0
0
0