[BitTorrent] Restrict BT to specific IP's
brian at dessent.net
Fri Sep 10 20:29:12 EDT 2004
> Hello there,
> Up here in Iceland, one has to pay for overseas upload/download but
> domestic traffic is free of charge. What I would like to do is to
> patch BT so that I can only connect to specific IP address ranges and
> reject incoming connections from IPs not in those ranges. In general I
> would like to write a custom python routine that decides if a
> connection is allowed or not.
> I know python so I could probably figure this out for myself, but if
> someone could kindly point me in the right direction as to where in
> the code I should plug in code to validate and authorize connections
> (both incoming and outgoing).
You didn't mention if you're running linux or win32. If you're on linux
and you have a NAT gateway there is an interesting way to apply
traffic control / access restrictions to BitTorrent traffic only. You
can achieve your result with no patches.
Suppose your machine normally has an rfc1918 address such as
192.168.1.101. Just define a second IP alias for the adaptor, say
192.168.1.102. In your NAT gateway / firewall, forward your listening
port to this new alias. Bind your BitTorrent client to this IP with
--bind, or however your client is configured.
Now you can use iptables to apply any rules you want to BitTorrent
traffic specificically. E.g.
export iceland_cidr='220.127.116.11/19 18.104.22.168/17 22.214.171.124/19
126.96.36.199/19 188.8.131.52/16 184.108.40.206/18 220.127.116.11/24 18.104.22.168/16
22.214.171.124/20 126.96.36.199/19 188.8.131.52/16 184.108.40.206/19
220.127.116.11/19 18.104.22.168/19 22.214.171.124/19 126.96.36.199/19
188.8.131.52/19 184.108.40.206/19 220.127.116.11/19 18.104.22.168/18
22.214.171.124/20 126.96.36.199/20 188.8.131.52/19'
for C in $iceland_cidr; do iptables -A INPUT -s $C -d 192.168.1.102 -j
iptables -A INPUT -d 192.168.1.102 -j DROP
This will append rules to the INPUT table to accept packets to
192.168.1.102 from any of those netblocks, and drop anything else.
Season to taste, serves 4 - 6, your mileage may vary.
(Note: the naive reader may be inclined to think that this will not
affect locally-initiated outbound connections. However, SYN-ACK relies
from the remote host will be dropped and so the TCP 2-way handshake will
 If you do not have NAT but instead are directly connected with a
live IP, then you can still use this, it's just a little harder.
Basically you'd have to use the iptables "owner" module to select
locally-generated traffic by the BitTorrent client pid. "man iptables"
and search for --cmd-owner. You'd generate rules to allow traffic from
that pid to the whilelisted blocks, and then block all other traffic
generated by that process.
------------------------ Yahoo! Groups Sponsor --------------------~-->
$9.95 domain names from Yahoo!. Register anything.
Yahoo! Groups Links
<*> To visit your group on the web, go to:
<*> To unsubscribe from this group, send an email to:
BitTorrent-unsubscribe at yahoogroups.com
<*> Your use of Yahoo! Groups is subject to:
More information about the BitTorrent