8

I work in an education office in a third world country. We pay for internet by the megabyte (no other choice) and have lately been using an incredible amount of bandwidth. This is because the office staff have found out about p2p sharing. As far as I know, Limewire is the only program they're using, but I'm sure it's just a matter of time before they discover the more general world of bittorrent.

Using only a linksys router (that I could flash), is there any way for me prevent the office from destroying our bandwidth cap by downloading personal items (against policy).

Even semi-fixes would be better than nothing.

7
  • 1
    solid firewall can block it ..
    – ukanth
    Nov 5, 2009 at 6:23
  • 3
    This question could also have some good answers on serverfault.com, since it sounds like a typical sysadmin task (in case you don't find a convenient one here, of course).
    – Gnoupi
    Nov 5, 2009 at 8:36
  • (Third World -- are you sure? en.wikipedia.org/wiki/Third_World)
    – Arjan
    Nov 5, 2009 at 13:53
  • 1
    Limewire? Educate them about proper p2p usage, then tell them not to do it.
    – Phoshi
    Nov 5, 2009 at 17:08
  • 2
    My point was actually that I think nobody should use that term anymore when referring to developing countries. But if even someone who works there uses it, and can smile about it, then apparently I'm wrong. :-(
    – Arjan
    Nov 6, 2009 at 7:33

7 Answers 7

6

Both good answers from satanicpuppy and cschreiner. I'll add my $0.02. If the linksys router will accept Tomato firmware (http://www.polarcloud.com/tomato), you can use the Traffic Shaping/QoS options to de-prioritise anything you want. I find the Tomato QoS/Shaper works better that anything else I've tried (DDWrt and pfSense)

I am using Tomato firmware right now in a somewhat similar situation where I have multiple people using one connection, and pay per MB of usage.

My Linksys WRT54GL usually has uptimes of around 60-120 days, and it does work very well.

9
  • +1, this is a good path too. When you can't block, try to de-prioritize.
    – nik
    Nov 5, 2009 at 6:45
  • 1
    So, I'd log in to the router, check for downloads, and then de-prioritize them? Does that mean that I have to keep checking, or can I get it to automatically de-prioritize? I'm not averse to work, I just want to know whether this solution will be effective in my absence.
    – Andrew
    Nov 5, 2009 at 7:10
  • No, the opposite. To start, you would designate what traffic has priority and save the settings. From then on, the router will automatically do it. I have not had to babysit my current installation in almost a year. It just sits quietly and does QoS. Truly a fantastic piece of programming. Nov 5, 2009 at 10:22
  • 1
    However this will only allow other programs to have better internet connection when needed, but it won't prevent the extra megabytes to pay.
    – Gnoupi
    Nov 5, 2009 at 13:12
  • 2
    I would follow this tactic if your Linksys supports it, but this overall is a POLICY action that you must institute in the workplace.
    – Jakub
    Nov 5, 2009 at 14:26
6

I would suggest a two pronged tactic:

  1. Set up rules to only allow traffic for specific services of your choosing, such as DNS, web, https, ftp, mail, etc. Trying to block the ports used by P2P apps is a losing battle, as in many cases you can change the port used in the application's preferences or switch to another application.

  2. The other thing to do is talk to the boss or person who makes financial decisions (if this isn't you) and make it a policy that this is not allowed and let the employees know that you are logging what is going on, and anyone using P2P will be fired. It isn't worth your time to be fighting a constantly escalating war to find a foolproof way to keep people from using P2P.

I suggest SonicWall firewalls which can do both internal to any rules, and have logging and reporting options. The tomato firmware mentioned earlier may have these capabilities as well—I am not that familiar with it.

1

Try opendns.com, sign up, add your identified IP address, check off what you want to block, and be sure to add the OpenDNS dns addresses to your linksys router...usually on the first page in the router. Make sure you have secure login/pw assigned to your linksys and of course a good pw for opendns.

Go here to get instructions for your router: https://store.opendns.com/setup/router/

Also...if your provider gives you dynamic IP, you will need to check on the frequency of the IP address change and change your settings occasionally otherwise you are blocking nothing when it changes.

3
  • I don't think OpenDNS will work. The best it seems able to do is block websites where torrent files can be found (i.e. piratebay)... but this isn't going to stop limewire, right?
    – Andrew
    Nov 5, 2009 at 7:45
  • Nor is going to stop someone from sending me a torrent file I could double click. Nov 5, 2009 at 10:09
  • it might block the torrent client from finding some trackers, but it wouldn't prevent replacing those with direct ip addresses. Nov 5, 2009 at 10:27
1

If blocking p2p traffic is a real issue, you might want to get a real firewall (Linux, OpenBSD, etc). With the proper configuration (not that hard really, but you’ll have to read a lot and play in serverfault.com), you could block all outgoing traffic that you don’t want, plus, throttling the outgoing remaining traffic (which regardless of P2P is always a good idea). It takes time and testing but once the solution is working, you really never have to worry again. I’ve had an OpenBSD box running for more than two years non-stop.

As stated here, users will always find new ways to pass the traffic, but if you keep the blocking tight, even if they p2p, the speed will be miserable and they may opt to simply quit the idea.

SOCIAL ENGINEERING

I remember I had a user downloading stuff via some weird port like a madman. So I prioritized ftp through port 22 and started a 2gb download at full speed from that location (which was really close, so the speed was “full speed” 200 k/sec at the moment). That “killed” the rest of the network. End result: not only the other users of the net were angry at this person for “killing” their internet, but the user also had to stop because the download speed was miserable. The “reason” for the net to be slow I gave him, was because his P2p connection was killing the old router. (lie).

He stopped his activities.

;)

0

If outbound firewall rules do not help you (as I noted in a comment to another answer here),
the next step would be to consider a Snort based filter.

This would be a little more complex and require additional resources and effort.
So, look at this as a theoretical suggestion; if nothing else works...

  • You could use a Windows based installation, or pick a Linux box
  • You would need to setup specific rules like this one that stops Bittorrent
    • there would be a 'learning curve' as you locate signatures that work for you
  • You could reduce other 'intrusion' related signatures for performance

This is the best I can come up in the given conditions.
Will add in more notes if I get better ideas -- or, maybe some will scale this up with a better solution.

0

Should be pretty easy. For most Linksys routers it'll be something like this: Go to the admin interface of your router, (just point your web browser at the router. I think it defaults to 192.168.1.1, but you should be able to tell from your pc by using "tracert google.com": the router should be the first entry) and click on the tab that says, "Access Restrictions" and under that you should see a couple of tabs that say "Blocked Services" with a button underneath that says "Add/Edit Service"

Click the Add/Edit button, and put in the range of ports you want to block. Limewire defaults to 6346.

Unfortunately the off-the-shelf versions don't allow fine grained control. If you post your router hardware model, I'll check for updated firmwares. If you can find something that offers full IPTables support, you can do port whitelisting, which is the best way to go...Block EVERYTHING except the stuff you want.

@Nik: Yep, you're right. But this is about all you can do with an off-the-shelf linksys. Setting up bandwidth throttling and such requires configuring an actual proxy, and that pretty much requires a server, and a whole boat load of knowledge (or a bunch of ready cash).

If I was going to do it, I'd set up a squid proxy to throttle by content, and if that didn't work, I'd just throttle the hell out of my problem users (or fire them).

1
  • Actually these things don't work that great. After a while people 'discover' anonymousing/tunneling tools that end taking up more bandwidth for the same amount of data (encryption, P2P rerouting). The only good thing about that is -- hopefully, they will be discouraged by the effort and discomfort of that path. But, that does not always work.
    – nik
    Nov 5, 2009 at 6:33
0

If you control the machines in the office, then rather than trying to block the ports on the router, why don't you just block the P2P application in Windows firewall?

As it works at the application level rather than at the ports/protocols level. Then the application is blocked regardless of what port it's trying to use.

image

Note: If the application is not listed in the list, you can add it to the list by using the Add Program button at the bottom of this window.

1
  • I should have mentioned this, but I don't have access to each computer.
    – Andrew
    Nov 5, 2009 at 7:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .