[BitTorrent] Restrict BT to specific IP's

Brian Dessent brian at dessent.net
Fri Sep 10 20:29:12 EDT 2004


arnarbi wrote:
> 
> Hello there,
> 
> Up here in Iceland, one has to pay for overseas upload/download but
> domestic traffic is free of charge. What I would like to do is to
> patch BT so that I can only connect to specific IP address ranges and
> reject incoming connections from IPs not in those ranges. In general I
> would like to write a custom python routine that decides if a
> connection is allowed or not.
> 
> I know python so I could probably figure this out for myself, but if
> someone could kindly point me in the right direction as to where in
> the code I should plug in code to validate and authorize connections
> (both incoming and outgoing).

You didn't mention if you're running linux or win32.  If you're on linux
and you have a NAT gateway[1] there is an interesting way to apply
traffic control / access restrictions to BitTorrent traffic only.  You
can achieve your result with no patches.

Suppose your machine normally has an rfc1918 address such as
192.168.1.101.  Just define a second IP alias for the adaptor, say
192.168.1.102.  In your NAT gateway / firewall, forward your listening
port to this new alias.  Bind your BitTorrent client to this IP with
--bind, or however your client is configured.

Now you can use iptables to apply any rules you want to BitTorrent
traffic specificically.  E.g.

export iceland_cidr='62.145.128.0/19 81.15.0.0/17 82.112.64.0/19
82.148.64.0/19 82.221.0.0/16 83.173.0.0/18 192.147.34.0/24 193.4.0.0/16
193.109.16.0/20 194.105.224.0/19 194.144.0.0/16 212.1.192.0/19
212.30.192.0/19 212.126.224.0/19 213.167.128.0/19 213.176.128.0/19
213.181.96.0/19 213.190.96.0/19 213.213.128.0/19 213.220.64.0/18
217.9.128.0/20 217.28.176.0/20 217.151.160.0/19'

for C in $iceland_cidr; do iptables -A INPUT -s $C -d 192.168.1.102 -j
ACCEPT; done
iptables -A INPUT -d 192.168.1.102 -j DROP

This will append rules to the INPUT table to accept packets to
192.168.1.102 from any of those netblocks, and drop anything else. 
Season to taste, serves 4 - 6, your mileage may vary.
  
(Note: the naive reader may be inclined to think that this will not
affect locally-initiated outbound connections.  However, SYN-ACK relies
from the remote host will be dropped and so the TCP 2-way handshake will
never succeed.)

[1] If you do not have NAT but instead are directly connected with a
live IP, then you can still use this, it's just a little harder. 
Basically you'd have to use the iptables "owner" module to select
locally-generated traffic by the BitTorrent client pid.  "man iptables"
and search for --cmd-owner.  You'd generate rules to allow traffic from
that pid to the whilelisted blocks, and then block all other traffic
generated by that process.

Brian


------------------------ Yahoo! Groups Sponsor --------------------~--> 
$9.95 domain names from Yahoo!. Register anything.
http://us.click.yahoo.com/J8kdrA/y20IAA/yQLSAA/dkFolB/TM
--------------------------------------------------------------------~-> 

 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/BitTorrent/

<*> To unsubscribe from this group, send an email to:
    BitTorrent-unsubscribe at yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/
 



More information about the BitTorrent mailing list