Netfilter conntracking for P2P protocols (edonkey, bittorent...)

nekkro-kvlt · 05-17-2009, 02:05 PM

Hi everyone, I would like to allow multi users to access P2P networks, so I wonder if there's a way to tracking these kind of protocols with netfilter, and also compatibility with nat, like the module conntrack_ftp seems to do with the FTP protocol.
Thanks guys.
Edit/Delete Message

win32sux · 05-18-2009, 08:45 AM

Quote:

Originally Posted by nekkro-kvlt

Hi everyone, I would like to allow multi users to access P2P networks, so I wonder if there's a way to tracking these kind of protocols with netfilter, and also compatibility with nat, like the module conntrack_ftp seems to do with the FTP protocol.
Thanks guys.

I've never used eDonkey, but I can tell you that I've never needed any special helper modules in order to do stateful packet filtering for BitTorrent or Gnutella. The only reason you need a helper for FTP is because the port number for the data connection is sent at the application layer. I would think the P2P protocol designers would avoid doing that sorta thing, in order to make file distribution as simple as possible. Of course, like I said, I've only got experience with BitTorrent and Gnutella.

nekkro-kvlt · 05-18-2009, 08:58 AM

Quote:

Originally Posted by win32sux

I've never used eDonkey, but I can tell you that I've never needed any special helper modules in order to do stateful packet filtering for BitTorrent or Gnutella. The only reason you need a helper for FTP is because the port number for the data connection is sent at the application layer. I would think the P2P protocol designers would avoid doing that sorta thing, in order to make file distribution as simple as possible. Of course, like I said, I've only got experience with BitTorrent and Gnutella.

Hi, I do not use gnutella, but bittorent speed is improved if allowing inbound connection to the client. For ed2k, there's the same thing, you need to redirect inbound connections to the client. As these ports can be configured in client options, I thing they're negociated with the server. A solution that may do the trick is IPP2P, but I hadn't time to check it yet.

win32sux · 05-18-2009, 07:51 PM

Quote:

Originally Posted by nekkro-kvlt

Hi, I do not use gnutella, but bittorent speed is improved if allowing inbound connection to the client. For ed2k, there's the same thing, you need to redirect inbound connections to the client. As these ports can be configured in client options, I thing they're negociated with the server. A solution that may do the trick is IPP2P, but I hadn't time to check it yet.

Personally, I've never heard of BitTorrent doing that, and my experience has been that it hasn't. In the application, I configure the port I want it to use and that's it. Iptables only needs to be told to allow inbound connections to that port - everything else is handled by connection tracking. Imagine how messed-up it would be if people would need to use stuff like IPP2P in order to make BitTorrent work! Of course, I'm not denying that application-layer filters are useful. I'm just saying that they are pointless for BitTorrent and Gnutella if what you want is to:

Quote:

Originally Posted by nekkro-kvlt

allow multi users to access P2P networks