I'm trying to stop a Torrent client from talking to certain IP ranges. The client runs as a specific user; in my case it is 500. The system has a network interface venet0 for connecting to the internet.

If I do something like:

iptables -A OUTPUT -o venet0 -m owner --uid-owner 500 -j torrent_iprange_check

iptables -A torrent_iprange_check -d -j DROP
iptables -A torrent_iprange_check -d -j DROP
iptables -A torrent_iprange_check -j ACCEPT

Is this alone sufficient to block torrent traffic to those IPs, or do I have to block on the INPUT chain as well?


Blocking bittorrent traffic on the OUTPUT should be enough for it not being able to transmit and announce it´s presence to that IP addresses; for all effects it will be dead.

However, if you want to prevent the bittorrent client from wasting time, and due to the nature of the trackers, the networks eventually might try to originate a connection, so to not waste resources, it might also be interesting doing it on the INPUT side.

Eventually if the list becomes too long, I would just apply it to the OUTPUT direction to save CPU resources.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.