topic Re: Block torrent applications in Firewall & Security Management

Block torrent applications

prashantds — Sun, 22 Mar 2020 10:41:41 GMT

Hi All, I want to block all torrent applications specifically uTorrent.

i have added utorrent in the in the application blocking but still not working..

Thanks,

Prashant.

Re: Block torrent applications

Chris_Atkinson — Sun, 22 Mar 2020 12:35:34 GMT

Please share some additional information if you would like assistance e.g.

- Version & JHF?

- SSL / HTTPS inspection? Y/N

- Classification (hold) mode Y/N

- What alternate rule in the policy is matching the traffic?

Re: Block torrent applications

prashantds — Sun, 22 Mar 2020 12:52:53 GMT

Version :- R77.30
SSL/HTTPS - N
Classification - N
Currently no policy is there except the Application block policy which is of no help.

Thanks
Prashant.

Re: Block torrent applications

PhoneBoy — Sun, 22 Mar 2020 20:34:28 GMT

What rules are the traffic matching on instead and how do those rule relate to the one you've shown?
Based on that we might be able to make suggestions.

Also note that R77.30 is End of Support and it would probably be a good idea to upgrade to a supported release.

Re: Block torrent applications

prashantds — Mon, 23 Mar 2020 04:17:14 GMT

Hi,

UDP utilization is showing too high for interface when checked. so i checked client pc remotely he is using torrent. now i don't want him or anyone else to use torrent.

Yeah, received the new firewall but waiting for downtime from management.
Thanks,
Prashant.

Re: Block torrent applications

PhoneBoy — Mon, 23 Mar 2020 04:32:20 GMT

Understood, but what rule(s) are matching the traffic in question?
In this case, both Firewall and Application Control rules?

I suspect you're allowing UDP high ports to random places on the Internet, which is generally not best practice.

Re: Block torrent applications

prashantds — Mon, 23 Mar 2020 04:38:18 GMT

yes both FW and Application control rules.

I suspect you're allowing UDP high ports to random places on the Internet, which is generally not best practice. - How do i stop this??
Sorry i am not having much knowledge of firewalls doing just some RnD. Support is not available trying to do it myself.

Re: Block torrent applications

PhoneBoy — Mon, 23 Mar 2020 04:50:40 GMT

You sent a screenshot of the Application Control rule you thought should have blocked Bittorrent, so clearly you have access to SmartDashboard...and probably SmartView Tracker and/or SmartLog to see the logs of the traffic.

As a general rule in R77.x and earlier: in order to pass through the Firewall rulebase, there has to be an explicit rule that allows the traffic.
What precise rule is allowing the traffic?
SmartView Tracker and/or SmartLog should tell you if it's not obvious from looking at your rulebase and you have logging enabled on your rules.

Then, in R77.x and earlier, if the Firewall rulebase allowed the traffic, it goes to the Application Control rulebase.
In this rulebase, unless there is an explicit rule that blocks traffic, it will be allowed.

Note that in R80.x with Policy Layers, this behavior is different as you can potentially have many layers and set the default behavior for each layer differently (default deny or accept).

Re: Block torrent applications

prashantds — Mon, 23 Mar 2020 05:43:40 GMT

We have some firewall rules which state from any to any. please find the SS attached.

Re: Block torrent applications

Chris_Atkinson — Mon, 23 Mar 2020 11:32:37 GMT

For an effective strategy you will need to limit (reduce) the number of such rules and get more detailed with the permitted services and destinations.

Re: Block torrent applications

prashantds — Mon, 23 Mar 2020 11:35:45 GMT

Hi,

i will make sure of that during the installation of latest firewall. for time being i am looking for the solution to block torrent or limit the download speeds(only for torrent not whole interface).

Thanks,

Prashant.

Re: Block torrent applications

PhoneBoy — Mon, 23 Mar 2020 21:21:28 GMT

Like I said, you need to limit either the destinations, the services, or both.
This advice applies to one or more of 8, 17, 20, 24.

Each one of these rules could easily be two rules.
One example:

Replace http/https with the precise services that are actually required for Internet access and nothing more.
This is by far the most performant approach.

Another option would be to put a rule near the bottom of your App Control rulebase like the following:

To get the Service column to show up in your App Control rulebase, right click on the title bar and check Service.
If you don't want to outright block the traffic, you can instead use the action "Limit" and specify whatever sort of limit you wish to place on this traffic.
Note the limit applies for anything matching this rule and should be below more specific rules.

Re: Block torrent applications

prashantds — Tue, 24 Mar 2020 04:25:00 GMT

Hi,

Thank you very much for your all help and support.
i limited the traffic through the application rule.
now seems to be working fine with bandwidth.