Question about xt_ipp2p module
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 5 lines · Dmitry Korzhevin
Hi,
I'm using Debian 6.0.7
x86_64. I have installed xtables withxt_ipp2pand seems i did something wrong, because my rules doesn't drop bittorrent traffic.
My gut instinct is it's not working because ipp2p is old software and may not match the bittorrent stream that you are using.
Quoted 6 lines
1 33 2970 ACCEPT all -- eth0 * 10.2.0.2
0.0.0.0/0 policy match dir in pol ipsec reqid 116 proto 50
2 26 10983 ACCEPT all -- * eth0 0.0.0.0/0
10.2.0.2 policy match dir out pol ipsec reqid 116 proto 50
3 0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0 ipp2p --bit
Nonetheless, given that the default policy is ACCEPT, why not just delete rules 1 and 2 to check whether that is the problem?
Are you forwarding the bittorrent traffic to another machine or downloading it locally? I see that you are using rules in both the INPUT and FORWARD chains.
Andy
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 9 lines · Dmitry Korzhevin
1 33 2970 ACCEPT all -- eth0 * 10.2.0.2 0.0.0.0/0 policy
match dir in pol ipsec reqid 116 proto 50
2 26 10983 ACCEPT all -- * eth0 0.0.0.0/0
10.2.0.2 policy match dir out pol ipsec reqid 116 proto 50But, this rules is inserted automaticaly by strongswan ipsec daemon, after my connection..
So turn it off in strongswan?
Quoted 8 lines · Jan Engelhardt
Quoted 7 lines · Dmitry Korzhevin
1 33 2970 ACCEPT all -- eth0 * 10.2.0.2 0.0.0.0/0 policy
match dir in pol ipsec reqid 116 proto 50
2 26 10983 ACCEPT all -- * eth0 0.0.0.0/0
10.2.0.2 policy match dir out pol ipsec reqid 116 proto 50
Quoted 4 lines
Quoted 2 lines
But, this rules is inserted automaticaly by strongswan ipsec daemon, after my connection..
So turn it off in strongswan?
Or if you can't do that, then just delete the rules once they're in there, or reinsert your own rules at a higher priority.
Andy
Quoted 11 lines · Andrew Beverley
Quoted 8 lines
Quoted 6 lines
2 26 10983 ACCEPT all -- * eth0 0.0.0.0/0
10.2.0.2 policy match dir out pol ipsec reqid 116 proto 50But, this rules is inserted automaticaly by strongswan ipsec daemon, after my connection..
So turn it off in strongswan?
Or if you can't do that, then just delete the rules once they're in there, or reinsert your own rules at a higher priority.
Well, strongswan has this leftfirewall=yes option that probably causes this, but I have not yet found a reason to use it, because you can just use -m policy on your own. While you do not know the reqid, it probably does not matter because strongswan would add ACCEPT rules for all of them anyway.
Quoted 21 lines · Dmitry Korzhevin
26.03.2013 23:28, Andrew Beverley пишет:
Quoted 20 lines · Dmitry Korzhevin
Quoted 5 lines
Hi,
I'm using Debian 6.0.7
x86_64. I have installed xtables withxt_ipp2pand seems i did something wrong, because my rules doesn't drop bittorrent traffic.My gut instinct is it's not working because ipp2p is old software and may not match the bittorrent stream that you are using.
Quoted 6 lines
1 33 2970 ACCEPT all -- eth0 * 10.2.0.2
0.0.0.0/0 policy match dir in pol ipsec reqid 116 proto 50
2 26 10983 ACCEPT all -- * eth0 0.0.0.0/0
10.2.0.2 policy match dir out pol ipsec reqid 116 proto 50
3 0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0 ipp2p --bitNonetheless, given that the default policy is ACCEPT, why not just delete rules 1 and 2 to check whether that is the problem?
Quoted 7 lines
Quoted 3 lines
Are you forwarding the bittorrent traffic to another machine or downloading it locally? I see that you are using rules in both the INPUT and FORWARD chains.
Thank you for answer! But, i'm testing this netfilter module according various internet howtos, where people claim that this module can block bittorrent traffic.
Yes, but that doesn't mean that it is guaranteed to match every bittorrent implementation.
An alternative way of matching bittorrent traffic is to use the connlimit module to look for lots of connections from a client above ports 1024. This is pretty brutal and prone to false-positives, but it may work for you. There is an example here:
http://andybev.com/index.php/Fair_traffic_shaping_an_ADSL_line_for_a_local_network_using_Linux
BTW: Please don't top-post.
Andy