How To Block Torrents

d3v1ls33k3r

I cannot find how to block torrent in openvpn ,

I tired to use the IPTables command below but this seems to block all network , VPN is connecting but no surfing/download is possible 🙁

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 10.1.0.0/24 -p tcp --dport 80 --j ACCEPT
iptables -A FORWARD -s 10.1.0.0/24 -p tcp --dport 443 --j ACCEPT
iptables -A FORWARD -s 10.1.0.0/24 -p icmp --j ACCEPT
iptables -A FORWARD -s 10.1.0.0/24 --j DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 10.2.0.0/24 -p tcp --dport 80 --j ACCEPT
iptables -A FORWARD -s 10.2.0.0/24 -p tcp --dport 443 --j ACCEPT
iptables -A FORWARD -s 10.2.0.0/24 -p icmp --j ACCEPT
iptables -A FORWARD -s 10.2.0.0/24 --j DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 10.3.0.0/24 -p tcp --dport 80 --j ACCEPT
iptables -A FORWARD -s 10.3.0.0/24 -p tcp --dport 443 --j ACCEPT
iptables -A FORWARD -s 10.3.0.0/24 -p icmp --j ACCEPT
iptables -A FORWARD -s 10.3.0.0/24 --j DROP

I Have Multiple Ports Opened :

10.1.0.0 - This IP is set for UDP 1921 Port
10.2.0.0 - This IP is set for UDP 1951 Port
10.3.0.0 - This IP is set for UDP 53 Port

xauen

I do not understand why you would want to block access using openvpn. You can try squid proxy to do this.
However, if you really want to, you can block access to all incoming ports (assuming for web browsing only) except port 80 and the openvpn ports.

# AFAIK Set the default policy of the INPUT chain to DROP
iptables -P INPUT DROP
# AFAIK Accept incoming TCP connections from eth0 on port 80
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
# AFAIK Accept incoming UDP connections from eth0
iptables -A INPUT -i eth0 -p udp --dports 1921,1951,53 -j ACCEPT

d3v1ls33k3r

Ok i am trying this, and i want to block torrent because my VPS Data-center Don't Support It..And has strict policy for it...

d3v1ls33k3r

@xauen I tried your iptable rules ,

1st thing is

iptables -P INPUT DROP

The above command blocked all ports including ssh .. That's why ssh stopped but i could run ssh commands from VPS Panel though...

iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT

This didn't create any problem but then also ssh was blocked

iptables -A INPUT -i eth0 -p udp --dports 1921,1951,53 -j ACCEPT

This showed some error "iptables v1.3.5: Unknown arg `--dports'"

xauen

d3v1ls33k3r wrote@xauen I tried your iptable rules ,

1st thing is

iptables -P INPUT DROP

The above command blocked all ports including ssh .. That's why ssh stopped but i could run ssh commands from VPS Panel though...

iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT

This didn't create any problem but then also ssh was blocked

iptables -A INPUT -i eth0 -p udp --dports 1921,1951,53 -j ACCEPT

This showed some error "iptables v1.3.5: Unknown arg `--dports'"

Since I only gave the openvpn iptables rule you should be able to remember also to allow input on your ssh port

#allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#Separate ports
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 1921 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 1951 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT

xauen

d3v1ls33k3r wrote@xauen I tried your iptable rules ,

1st thing is

iptables -P INPUT DROP

The above command blocked all ports including ssh .. That's why ssh stopped but i could run ssh commands from VPS Panel though...

iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT

This didn't create any problem but then also ssh was blocked

iptables -A INPUT -i eth0 -p udp --dports 1921,1951,53 -j ACCEPT

This showed some error "iptables v1.3.5: Unknown arg `--dports'"

Since I only gave the openvpn iptables rule you should be able to remember also to allow input on your ssh port

#allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#Separate ports
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 1921 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 1951 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT

d3v1ls33k3r

tried now vpn not connecting :

Fri Oct 12 23:06:26 2012 OpenVPN 2.1.1 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Dec 12 2009
Fri Oct 12 23:06:26 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Fri Oct 12 23:06:26 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Oct 12 23:06:27 2012 LZO compression initialized
Fri Oct 12 23:06:27 2012 UDPv4 link local (bound): [undef]:1194
Fri Oct 12 23:06:27 2012 UDPv4 link remote: 142.54.177.215:53
Fri Oct 12 23:07:28 2012 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Fri Oct 12 23:07:28 2012 TLS Error: TLS handshake failed
Fri Oct 12 23:07:28 2012 SIGUSR1[soft,tls-error] received, process restarting
Fri Oct 12 23:07:38 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Fri Oct 12 23:07:38 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Oct 12 23:07:38 2012 Re-using SSL/TLS context
Fri Oct 12 23:07:38 2012 LZO compression initialized
Fri Oct 12 23:07:38 2012 UDPv4 link local (bound): [undef]:1194
Fri Oct 12 23:07:38 2012 UDPv4 link remote: 142.54.177.215:53

xauen

basically you need to block all other ports except the 80 and openvpn port:
This is a sample rule to allow only ssh. You can build it based on this:

#!/bin/sh
# My system IP/set ip address of server
SERVER_IP="65.55.12.13"
# Flushing all rules
iptables -F
iptables -X
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Allow unlimited traffic on loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
 
# Allow incoming ssh only
iptables -A INPUT -p tcp -s 0/0 -d $SERVER_IP --sport 513:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s $SERVER_IP -d 0/0 --sport 22 --dport 513:65535 -m state --state ESTABLISHED -j ACCEPT
# make sure nothing comes or goes out of this box
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP