I already wrote about Linux command line bittorrent client. However, I received few more queries regarding firewall issues. Basically you need to open ports using iptables.
Bittorrent client by default uses tcp 6881 to 6889 ports only. In order to work with Bittorrent client you need to open these ports on firewall. Remember, if you are behind a firewall (hardware or software) you need to enable port forwarding to internal systems.
Scenario # 1: Windows or Linux desktop behind router firewall
Internet -> Hardware Router -> Your Linux Desktop
with port forwarding Client
enabled
You have router (ADSL/DSL/Cable modem+router) and you have already enabled port forwarding on router (open web browser > Open router web admin interface > Find port forwarding > Enable port forwarding for bittorent protocol). You also need to open port using following iptables rules on Linux desktop (open TCP port 6881 to 6999):
iptables -A INPUT -p tcp --destination-port 6881:6999 -j ACCEPT iptables -A OUTPUT -p tcp --source-port 6881:6999 -j ACCEPT
Here is a complete sample firewall script:
#!/bin/sh iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X modprobe ip_conntrack modprobe ip_conntrack_ftp # Setting default filter policy iptables -P INPUT DROP iptables -P OUTPUT ACCEPT # Unlimited access to loop back iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow UDP, DNS and Passive FTP iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT #allow bittorent incomming client request iptables -A INPUT -p tcp --destination-port 6881:6999 -j ACCEPT #Uncomment below to allow sshd incoming client request #iptables -A INPUT -p tcp -dport 22 -j ACCEPT # DROP everything and Log it iptables -A INPUT -j LOG iptables -A INPUT -j DROP
Scenario # 2
Internet -> Linux computer Router -> Your Linux Desktop
with port forwarding OR Windows XP client
enabled using IPTABLES IP:192.168.1.2
IP:192.168.1.254Here you are using a Linux as software firewall and iptables as your NAT (firewall) for internal network (192.168.1.2). You need to enable port forwarding to a internal Linux desktop (may be Windows XP desktop) for BitTorrent client system. Add following two line of code to your existing NAT firewall script.
iptables -t nat -A PREROUTING -p tcp --dport 6881:6889 -j DNAT --to-destination 192.168.1.2 iptables -A FORWARD -s 192.168.1.2 -p tcp --dport 6881:6889 -j ACCEPT
Related: Linux Command line BitTorrent client
- 30 Handy Bash Shell Aliases For Linux / Unix / Mac OS X
- Top 30 Nmap Command Examples For Sys/Network Admins
- 25 PHP Security Best Practices For Sys Admins
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- 20 Linux Server Hardening Security Tips
- Linux: 20 Iptables Examples For New SysAdmins
- Top 20 OpenSSH Server Best Security Practices
- Top 20 Nginx WebServer Best Security Practices
- 20 Examples: Make Sure Unix / Linux Configuration Files Are Free From Syntax Errors
- 15 Greatest Open Source Terminal Applications Of 2012
- My 10 UNIX Command Line Mistakes
- Top 10 Open Source Web-Based Project Management Software
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- The Novice Guide To Buying A Linux Laptop
{ 30 comments… read them below or add one }
Excellent information solved all my problems related to bittorent and your script is gr8 help thx :D
Very nice your firewall rulez are very simple and easy to follow, this page is bookmarked.
Keep it up good work
all this is good but what happens when
I have a linux box in a windows network and I have no control over the firewall set up by an administrator?
I can ssh from my linux box to outside as well as surf the net.
thanks
bliko,
Then login to your linux box over ssh and use the bittorrent-curses as follows:
python2.4 /usr/bin/bittorrent-curses ‘/path/to/file.torrent’
See our article Linux: Command line BitTorrent client
Have a fun :D
This is a nice work. Keep up the good work.
what if there are multiple desktop machines behind the linux firewall? can only one use bittorrent, or is there some other way to do it?
You can use for loop as follows (assuming that you have three desktop systems with IP 192.168.1.2 192.168.1.5 192.168.1.6):
CLIENT=”192.168.1.2 192.168.1.5 192.168.1.6″
for i in $CLIENT
do
iptables -t nat -A PREROUTING -p tcp –dport 6881:6889
-j DNAT –to-destination $i
iptables -A FORWARD -s $i -p tcp –dport 6881:6889
-j ACCEPT
done
Other option is to grant permission to range of IP addres. For example, grant permission to 192.168.1.5 to 192.168.1.100:
iptables -t nat -A PREROUTING -p tcp –dport 6881:6889
-j DNAT –to-destination 192.168.1.5-192.168.1.100
iptables -A FORWARD -s 192.168.1.5-192.168.1.100 -p tcp –dport 6881:6889
-j ACCEPT
im getting..
[root@localhost brian]# iptables -A INPUT -p tcp –destination-port 6881:6999 -j ACCEPT
bash: iptables: command not found
what do i do?
Brian,
a) If you are using su command to become root, use su -
b) Use full path to iptables i.e. /sbin/iptables
c) You do not have iptables installed. Install it.
[root@server html]# iptables -A INPUT -p tcp –destination-port 6881:6999 -j ACCEPT
iptables v1.3.0: can’t initialize iptables table `filter’: iptables who? (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
[root@server html]# iptables -A OUTPUT -p tcp –source-ports 6881:6999 -j ACCEPT
iptables v1.3.0: Unknown arg `–source-ports’
Try `iptables -h’ or ‘iptables –help’ for more information.
How to fix that?
To fix first error run command:
modprobe ip_tables iptable_filter ipt_state ip_conntrack ipt_LOG iptable_mangle
Then verify module loaded with following command:
lsmod | grep ip
If above two command fails with an error then you need to upgrade your kernel. Btw specify your Linux disto…
To fix second error, type rule as follows (it is –source-port not –source-ports ):
iptables -A OUTPUT -p tcp –source-port 6881:6999 -j ACCEPT
is the default port range 6881:6889 or 6881:6999 – the article mentions both, seems a confict there.
6881:6889 ==> More than sufficient for Bittorent client.
If you are going to distribute torrents then use 6881:6999
oh yeah! Now I don’t get that yellow ball when using BitTornado.
Thanks a lot!!! :)
hi,
i tried running the sample code:
iptables -A INPUT -p tcp –destination-port 6881:6999 -j ACCEPT
but the shell spit up “bad argument ‘-destination-port’”
i looked in the help file for my version of iptables and could not find this parameter. i tried the other parameters that seemed similar, -d & –destination. The latter worked, while the former did not. In the help file the -d option appears with a ‘[!]‘ next to it – what does this indicate?
despite my success with ‘–destination’ a new error popped up. ‘-p’ was considered a bad argument. i tried ‘–proto,’ the alternative according to the help file, but to no avail.
what do you suggest?
thanks for your time,
joe
replace -destination-port with –destination port and you will be fine.
joe,
Here is the command you need (a little late).
/sbin/iptables -A INPUT -p tcp -v –match multiport –dports 6881:6999 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -v –match multiport –dports 6881:6999 -j ACCEPT
To get rid of these rules after you are done,
/sbin/iptables -D INPUT -p tcp -v –match multiport –dports 6881:6999 -j ACCEPT
/sbin/iptables -D OUTPUT -p tcp -v –match multiport –dports 6881:6999 -j ACCEPT
The key change is the –match option as it loads a module that allows the –dports (or –destination-ports) to be used. It can load many other modules besides the multiport module, but this is the one we need here.
Hi, my iptables is not working in redhat linux.
It gives me the error as iptables-restore not matched. whereas this file is /sbin.
whether i need to run the command of service iptables-save. also when i put -p in my iptables command it gives me the error. so what shud I do?
I’m getting:
iptables -t nat -A PREROUTING -p tcp –d 6881:6889
-j DNAT –to-destination 192.168.0.30
– Bad argument ’192.168.0.30′
I looked in the help but no -to-destination argument found…
What can I do? thanks in advance.
It should be as follows, (note double dash –)
It took me a while to find this info… I had port forwarded 6881-6889 and didnt gain anything so I was glad to see that there’s one more step to getting it working correctly. I’ll try it out tonight:
iptables -A INPUT -p tcp –destination-port 6881:6999 -j ACCEPT
iptables -A OUTPUT -p tcp –source-port 6881:6999 -j ACCEPT
nice post! Thanks for sharing!
Hi
Is there a way that we can force a particular application to use a particular interface say wlan0 or eth0 ?
Everything said in this article is true except for the port assignment. ports 6881 to 6889 are blacklisted by both ISP’s and trackers now adays. Advising people use these ports is completely incorrect. Better to just say to people to pick any ports in the 50000+ range. Not only are those ports blacklisted. Using them will get you banned from many trackets. Yep complete and utter outright ban on those ports they are not to be used EVER.
i know about protocol-ports.
i use free ports for torrent, by the way using windows OS with Kerio Firewall
Thank you! Now Torrent works great!
Question: how will behave iptables if I will forward one port range to different port range?
Example:
iptables -t nat -A PREROUTING -p tcp –dport 6001:6999 -j DNAT –to-destination 192.168.0.30:7001-7999
As I know 2.4 kernel was mapping port to port but 2.6.11 and up seems always mapping 6001:6999 to first port (7001) of 7001-7999 range.
Any ideas
hi, this info very good and give me some idea to apply in other services in future .
what if i want to block seeding only or leeching only ,i am using OpenBSD PF .
Hello cyberciti, is there any way to block torrent in OpenVZ container? layer7, rope or any like that not working because iptables for OpenVZ is not complete..