≡ Menu

Linux Iptables open Bittorrent tcp ports 6881 to 6889

I already wrote about Linux command line bittorrent client. However, I received few more queries regarding firewall issues. Basically you need to open ports using iptables.

Bittorrent client by default uses tcp 6881 to 6889 ports only. In order to work with Bittorrent client you need to open these ports on firewall. Remember, if you are behind a firewall (hardware or software) you need to enable port forwarding to internal systems.

Scenario # 1: Windows or Linux desktop behind router firewall

Internet ->     Hardware Router    -> Your Linux Desktop
          with port forwarding          Client
              enabled

You have router (ADSL/DSL/Cable modem+router) and you have already enabled port forwarding on router (open web browser > Open router web admin interface > Find port forwarding > Enable port forwarding for bittorent protocol). You also need to open port using following iptables rules on Linux desktop (open TCP port 6881 to 6999):

iptables -A INPUT -p tcp --destination-port 6881:6999 -j ACCEPT
iptables -A OUTPUT -p tcp --source-port 6881:6999 -j ACCEPT

Here is a complete sample firewall script:

#!/bin/sh
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
#allow bittorent incomming client request
iptables -A INPUT -p tcp --destination-port 6881:6999 -j ACCEPT
#Uncomment below to allow sshd incoming client request
#iptables -A INPUT -p tcp -dport 22 -j ACCEPT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

Scenario # 2

Internet -> Linux computer Router  ->  Your Linux Desktop
         with port forwarding      OR Windows XP client
         enabled using IPTABLES       IP:192.168.1.2
           IP:192.168.1.254

Here you are using a Linux as software firewall and iptables as your NAT (firewall) for internal network (192.168.1.2). You need to enable port forwarding to a internal Linux desktop (may be Windows XP desktop) for BitTorrent client system. Add following two line of code to your existing NAT firewall script.

iptables -t nat -A PREROUTING -p tcp --dport 6881:6889
-j DNAT --to-destination 192.168.1.2
iptables -A FORWARD -s 192.168.1.2 -p tcp --dport 6881:6889
-j ACCEPT

Related: Linux Command line BitTorrent client

Tweet itFacebook itGoogle+ itPDF itFound an error/typo on this page?

Comments on this entry are closed.

  • Bruno December 11, 2005, 4:20 am

    Excellent information solved all my problems related to bittorent and your script is gr8 help thx :D

  • Unknown December 13, 2005, 12:33 am

    Very nice your firewall rulez are very simple and easy to follow, this page is bookmarked.
    Keep it up good work

  • bliko January 24, 2006, 4:46 pm

    all this is good but what happens when
    I have a linux box in a windows network and I have no control over the firewall set up by an administrator?

    I can ssh from my linux box to outside as well as surf the net.
    thanks

  • nixcraft January 25, 2006, 8:57 pm

    bliko,

    Then login to your linux box over ssh and use the bittorrent-curses as follows:

    python2.4 /usr/bin/bittorrent-curses ‘/path/to/file.torrent’

    See our article Linux: Command line BitTorrent client

    Have a fun :D

  • Anonymous January 25, 2006, 8:59 pm

    This is a nice work. Keep up the good work.

  • Anonymous February 25, 2006, 6:57 am

    what if there are multiple desktop machines behind the linux firewall? can only one use bittorrent, or is there some other way to do it?

  • nixcraft February 25, 2006, 10:36 am

    You can use for loop as follows (assuming that you have three desktop systems with IP 192.168.1.2 192.168.1.5 192.168.1.6):

    CLIENT=”192.168.1.2 192.168.1.5 192.168.1.6″
    for i in $CLIENT
    do
    iptables -t nat -A PREROUTING -p tcp –dport 6881:6889
    -j DNAT –to-destination $i

    iptables -A FORWARD -s $i -p tcp –dport 6881:6889
    -j ACCEPT
    done

    Other option is to grant permission to range of IP addres. For example, grant permission to 192.168.1.5 to 192.168.1.100:

    iptables -t nat -A PREROUTING -p tcp –dport 6881:6889
    -j DNAT –to-destination 192.168.1.5-192.168.1.100

    iptables -A FORWARD -s 192.168.1.5-192.168.1.100 -p tcp –dport 6881:6889
    -j ACCEPT

  • Brian March 7, 2006, 2:56 am

    im getting..

    [root@localhost brian]# iptables -A INPUT -p tcp –destination-port 6881:6999 -j ACCEPT
    bash: iptables: command not found

    what do i do?

  • nixcraft March 7, 2006, 9:55 am

    Brian,

    a) If you are using su command to become root, use su –

    b) Use full path to iptables i.e. /sbin/iptables

    c) You do not have iptables installed. Install it.

  • Anonymous April 4, 2006, 12:33 am

    [root@server html]# iptables -A INPUT -p tcp –destination-port 6881:6999 -j ACCEPT
    iptables v1.3.0: can’t initialize iptables table `filter': iptables who? (do you need to insmod?)
    Perhaps iptables or your kernel needs to be upgraded.
    [root@server html]# iptables -A OUTPUT -p tcp –source-ports 6881:6999 -j ACCEPT
    iptables v1.3.0: Unknown arg `–source-ports’
    Try `iptables -h’ or ‘iptables –help’ for more information.

    How to fix that?

  • nixcraft April 4, 2006, 12:52 am

    To fix first error run command:
    modprobe ip_tables iptable_filter ipt_state ip_conntrack ipt_LOG iptable_mangle

    Then verify module loaded with following command:
    lsmod | grep ip

    If above two command fails with an error then you need to upgrade your kernel. Btw specify your Linux disto…

    To fix second error, type rule as follows (it is –source-port not –source-ports ):
    iptables -A OUTPUT -p tcp –source-port 6881:6999 -j ACCEPT

  • Anonymous June 27, 2006, 9:10 am

    is the default port range 6881:6889 or 6881:6999 – the article mentions both, seems a confict there.

  • nixcraft July 3, 2006, 2:48 am

    6881:6889 ==> More than sufficient for Bittorent client.

    If you are going to distribute torrents then use 6881:6999

  • Anonymous September 22, 2006, 11:37 pm

    oh yeah! Now I don’t get that yellow ball when using BitTornado.

    Thanks a lot!!! :)

  • joe March 17, 2007, 5:04 pm

    hi,
    i tried running the sample code:

    iptables -A INPUT -p tcp –destination-port 6881:6999 -j ACCEPT

    but the shell spit up “bad argument ‘-destination-port'”

    i looked in the help file for my version of iptables and could not find this parameter. i tried the other parameters that seemed similar, -d & –destination. The latter worked, while the former did not. In the help file the -d option appears with a ‘[!]’ next to it – what does this indicate?

    despite my success with ‘–destination’ a new error popped up. ‘-p’ was considered a bad argument. i tried ‘–proto,’ the alternative according to the help file, but to no avail.

    what do you suggest?

    thanks for your time,

    joe

  • Darkly May 31, 2007, 8:52 pm

    replace -destination-port with –destination port and you will be fine.

  • figure May 31, 2007, 11:18 pm

    joe,

    Here is the command you need (a little late).

    /sbin/iptables -A INPUT -p tcp -v –match multiport –dports 6881:6999 -j ACCEPT

    /sbin/iptables -A OUTPUT -p tcp -v –match multiport –dports 6881:6999 -j ACCEPT

    To get rid of these rules after you are done,

    /sbin/iptables -D INPUT -p tcp -v –match multiport –dports 6881:6999 -j ACCEPT

    /sbin/iptables -D OUTPUT -p tcp -v –match multiport –dports 6881:6999 -j ACCEPT

    The key change is the –match option as it loads a module that allows the –dports (or –destination-ports) to be used. It can load many other modules besides the multiport module, but this is the one we need here.

  • Avesh September 19, 2007, 8:39 am

    Hi, my iptables is not working in redhat linux.
    It gives me the error as iptables-restore not matched. whereas this file is /sbin.
    whether i need to run the command of service iptables-save. also when i put -p in my iptables command it gives me the error. so what shud I do?

  • Albert December 6, 2007, 3:49 pm

    I’m getting:

    iptables -t nat -A PREROUTING -p tcp –d 6881:6889
    -j DNAT –to-destination 192.168.0.30

    — Bad argument ‘192.168.0.30’

    I looked in the help but no -to-destination argument found…

    What can I do? thanks in advance.

  • nixCraft December 6, 2007, 4:37 pm

    It should be as follows, (note double dash –)

    iptables -t nat -A PREROUTING -p tcp --dport 6881:6889 -j DNAT --to-destination 192.168.0.30
  • rich January 8, 2008, 4:42 pm

    It took me a while to find this info… I had port forwarded 6881-6889 and didnt gain anything so I was glad to see that there’s one more step to getting it working correctly. I’ll try it out tonight:

    iptables -A INPUT -p tcp –destination-port 6881:6999 -j ACCEPT
    iptables -A OUTPUT -p tcp –source-port 6881:6999 -j ACCEPT

  • Sneezy Melon March 15, 2008, 4:58 pm

    nice post! Thanks for sharing!

  • Gini July 2, 2008, 5:01 pm

    Hi
    Is there a way that we can force a particular application to use a particular interface say wlan0 or eth0 ?

  • Hellimod September 6, 2008, 12:47 pm

    Everything said in this article is true except for the port assignment. ports 6881 to 6889 are blacklisted by both ISP’s and trackers now adays. Advising people use these ports is completely incorrect. Better to just say to people to pick any ports in the 50000+ range. Not only are those ports blacklisted. Using them will get you banned from many trackets. Yep complete and utter outright ban on those ports they are not to be used EVER.

  • chandan kumar February 24, 2009, 2:50 pm

    i know about protocol-ports.

  • voxeljorz April 15, 2009, 5:42 am

    i use free ports for torrent, by the way using windows OS with Kerio Firewall

  • stewa September 3, 2009, 4:52 pm

    Thank you! Now Torrent works great!

  • i3keba May 6, 2010, 8:24 am

    Question: how will behave iptables if I will forward one port range to different port range?
    Example:
    iptables -t nat -A PREROUTING -p tcp –dport 6001:6999 -j DNAT –to-destination 192.168.0.30:7001-7999
    As I know 2.4 kernel was mapping port to port but 2.6.11 and up seems always mapping 6001:6999 to first port (7001) of 7001-7999 range.

    Any ideas

  • SIFE June 10, 2010, 6:03 pm

    hi, this info very good and give me some idea to apply in other services in future .
    what if i want to block seeding only or leeching only ,i am using OpenBSD PF .

  • Ahmad Fikrizaman September 20, 2012, 8:58 pm

    Hello cyberciti, is there any way to block torrent in OpenVZ container? layer7, rope or any like that not working because iptables for OpenVZ is not complete..

  • دانلود سریال November 27, 2014, 10:24 pm

    very nice