[BitTorrent] Restrict BT to specific IP's

Brian Dessent brian at dessent.net
Fri Sep 10 20:29:12 EDT 2004

arnarbi wrote:
> Hello there,
> Up here in Iceland, one has to pay for overseas upload/download but
> domestic traffic is free of charge. What I would like to do is to
> patch BT so that I can only connect to specific IP address ranges and
> reject incoming connections from IPs not in those ranges. In general I
> would like to write a custom python routine that decides if a
> connection is allowed or not.
> I know python so I could probably figure this out for myself, but if
> someone could kindly point me in the right direction as to where in
> the code I should plug in code to validate and authorize connections
> (both incoming and outgoing).

You didn't mention if you're running linux or win32.  If you're on linux
and you have a NAT gateway[1] there is an interesting way to apply
traffic control / access restrictions to BitTorrent traffic only.  You
can achieve your result with no patches.

Suppose your machine normally has an rfc1918 address such as  Just define a second IP alias for the adaptor, say  In your NAT gateway / firewall, forward your listening
port to this new alias.  Bind your BitTorrent client to this IP with
--bind, or however your client is configured.

Now you can use iptables to apply any rules you want to BitTorrent
traffic specificically.  E.g.

export iceland_cidr=''

for C in $iceland_cidr; do iptables -A INPUT -s $C -d -j
ACCEPT; done
iptables -A INPUT -d -j DROP

This will append rules to the INPUT table to accept packets to from any of those netblocks, and drop anything else. 
Season to taste, serves 4 - 6, your mileage may vary.
(Note: the naive reader may be inclined to think that this will not
affect locally-initiated outbound connections.  However, SYN-ACK relies
from the remote host will be dropped and so the TCP 2-way handshake will
never succeed.)

[1] If you do not have NAT but instead are directly connected with a
live IP, then you can still use this, it's just a little harder. 
Basically you'd have to use the iptables "owner" module to select
locally-generated traffic by the BitTorrent client pid.  "man iptables"
and search for --cmd-owner.  You'd generate rules to allow traffic from
that pid to the whilelisted blocks, and then block all other traffic
generated by that process.


------------------------ Yahoo! Groups Sponsor --------------------~--> 
$9.95 domain names from Yahoo!. Register anything.

Yahoo! Groups Links

<*> To visit your group on the web, go to:

<*> To unsubscribe from this group, send an email to:
    BitTorrent-unsubscribe at yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:

More information about the BitTorrent mailing list