Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I have a typical broadband setup at home (It's a flatshare I have no control over who uses the house) and I want to prevent anyone using it from illegally downloading via torrents etc.


Is there a way in which I can configure the router to block all forms of illegal downloads?

share|improve this question
Huge ISPs who lose massive amounts of money over this can't do it - if you do figure it out, you may be able to retire early :) – Phoshi Jan 11 '10 at 15:11

Short answer: No

Longer answer:
Probably not, it depends on your router. Most routers targeted to home users don't have that kind of traffic filtering capabilities.

share|improve this answer
And even if they have the traffic filtering, a determined user can likely SSH tunnel or something. – ceejayoz Jan 11 '10 at 14:42
If they are tunneling, the liability is shifted to whoever owns that tunnel and the other end. That's would be still a win. – crazysim Aug 5 '10 at 21:02

Not all torrents are illegal, so you're effectively making the decision to block peer-to-peer technology, as opposed to blocking "illegal downloads".

  • You can start by blocking the major sites that offer torrents in the first place, using an invisible proxy. That will prevent people from getting the .torrent files.

  • Then you can look at blocking the ports that the main apps use, and disable UDP completely (except the ports used for DNS, but I believe that can work on TCP/IP now anyway).

That's certainly not an exhaustive list, but it's a good starting point.

share|improve this answer
And as Nifle points out, it's impossible to do it completely. A lot of P2P clients now use obfuscation to bypass detection by proxies, and as soon as they switch over to SSH, you're poked. – user3463 Jan 11 '10 at 14:38
Disabling UDP would wreck VOIP. – Iain Jan 11 '10 at 14:44
Randolph ideas is the best choice, IMHO, though I think that if a user is able to switch over to ssh it is possible that any other solutions will fail as well. But for a non-power-user point of view that could be enough. Also: if you have to deal with just a few users, you can "mess up" your routing table to forward any incoming .torrent files to your mail address, and then choose which to flag as legal and which don't. Just a thought. – dag729 Jan 11 '10 at 14:52
Most DNS resolvers can fall back to TCP [not "TCP/IP"], but they'll likely try UDP anyway every time. = Slowness. – grawity Jan 11 '10 at 15:00
Blocking UDP would hose pretty much all network video games as well. – SnOrfus Jan 11 '10 at 15:54

From a legal perspective, any of the other solutions, though technically incomplete, may be adequate to your purposes. If the sh*t hits the fan, you can demonstrate to a court of law that you acted in good faith, and that the user was forced to 'hack' your system. This means that the user's access was 'unauthorized', and any liability for the resulting behaviour is strictly his.

Check with your lawyer, though. Cause I'm not one.

share|improve this answer
+1 for a very nice ssh-buck-passing technique! :D – dag729 Jan 11 '10 at 15:43

Here's one way that's probably not foolproof, but would at least reduce the possibility of someone getting away with it.

  1. Set up an account at They're free.
  2. Choose settings and create a network & give it a name to be your home network.
  3. Pick that network in the "Settings For" drop-down
  4. Choose "Web Content Filtering" on the left.
  5. Select the "Custom" radio button at the bottom of the list.
  6. In the large array of radio buttons which then appears, make sure you have "P2P/File sharing" checked.
  7. Configure your router to use OpenDNS's servers for DNS.

Now, on some routers you can configure them to log in to your OpenDNS account so they know who you are when your router gets its IP from your ISP. On others you may have to run one of the OpenDNS clients to identify your network to the servers at connection time. See the help at the OpenDNS site.

This won't stop a determined user. (For example, they could bypass the DNS address you're providing them and use their own). But it will at least show that you made an effort if someone came and accused you of something.

Disclosure: I do not work for OpenDNS.

share|improve this answer
Im not a 100% sure, but I think this only effects websites and not the P2P-Program/Traffic itself. – Bobby Nov 2 '10 at 15:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .