From f8b016aeeefb94aa9ba33761d0cb1a1c063d8e26 Mon Sep 17 00:00:00 2001 From: Costa Tsaousis Date: Wed, 8 Apr 2015 21:06:39 +0300 Subject: [PATCH 1/4] Update fireqos-new-user.md --- content/tutorial/fireqos-new-user.md | 35 +++++++++++++++++++--------- 1 file changed, 24 insertions(+), 11 deletions(-) diff --git a/content/tutorial/fireqos-new-user.md b/content/tutorial/fireqos-new-user.md index 52afa88..b506554 100644 --- a/content/tutorial/fireqos-new-user.md +++ b/content/tutorial/fireqos-new-user.md @@ -634,17 +634,30 @@ There are three things we can do to settle this issue: possible. If you control the torrent clients and your clients have a - configuration for setting a fixed port for them, I suggest to take - the opportunity and use a predefined port, instead of a random port, - for each one. For example, I have mine set to use port 51414. - Usually, this setting does not mean the torrent client will always - use this port. Most of the time though, it will. If you do set ports - for your torrent clients, we can match these ports at the `torrents` - class using `match dport 51414` on `input` and `match sport 51414` - on `output` interfaces. I also add `prio 1` to these matches, just - to make sure that if a smart guy on the net puts his client on a - port from 0 to 1023, the rule that matches the fixed torrent port - will be executed first. + configuration for setting fixed port(s) for them, I suggest to take + the opportunity and use predefined ports, instead of random ones. + For example, I have mine set to use port 60000 for incoming requests + and ports 60001 to 65535 for outgoing request. + If you do set ports for your torrent clients, we can match these ports + at the `torrents` class using `match dport 60000-65535` on `input` and + `match sport 60000-65535` on `output` interfaces. I also add `prio 1` + to these matches, just to make sure that if a smart guy on the net puts + his client on a port from 0 to 1023, the rule that matches the fixed + torrent ports will be executed first. + + If you do set your torrent clients to use such port ranges, it would + be also helpful to exclude these ports from other uses. One such use + is the clients on the firewall itself. If you have installed, for + example a transparent proxy with squid, you should instruct your + proxy to avoid using the torrents ports. This can be done by executing + this command `sysctl -w net.ipv4.ip_local_port_range=32768\ 59999`. + This command will enforce all the clients of your firewall to avoid + using the torrents ports. + + You can also instruct the masquerade of your internet interface to + avoid mapping LAN clients on the torrents ports. This can be done + by replacing your `masquerade4 ppp+` command in `firehol.conf` with + `masquerade to-ports 32768-59999 ppp+`. Another more adventurous trick, is to match packets having source and destination ports above 16384. It is very unlikely that an From 8e6428740f55ca17f2b57ca69d0b91a123cdd093 Mon Sep 17 00:00:00 2001 From: Costa Tsaousis Date: Wed, 8 Apr 2015 21:08:16 +0300 Subject: [PATCH 2/4] Update qos-tutorial-10.conf --- content/examples/qos-tutorial-10.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/examples/qos-tutorial-10.conf b/content/examples/qos-tutorial-10.conf index e14caaf..e689626 100644 --- a/content/examples/qos-tutorial-10.conf +++ b/content/examples/qos-tutorial-10.conf @@ -42,7 +42,7 @@ interface $DEVICE world-in input rate $INPUT_SPEED $LINKTYPE # removed balanced @@ -77,5 +77,5 @@ interface $DEVICE world-out output rate $OUTPUT_SPEED $LINKTYPE match dports 6881:6999 # official torrent ports - match dport 51414 prio 1 # my torrent client + match dport 32768:65535 prio 1 # my torrent client match sports 16384:65535 dports 16384:65535 # my trick to match torrents interface $DEVICE world-out output rate $OUTPUT_SPEED $LINKTYPE balanced @@ -77,5 +77,5 @@ interface $DEVICE world-out output rate $OUTPUT_SPEED $LINKTYPE balanced class torrents match sports 6881:6999 # official torrent ports - match sport 51414 prio 1 # my torrent client + match sport 32768:65535 prio 1 # my torrent client match sports 16384:65535 dports 16384:65535 # my trick to match torrents From 2516a2c679aae9d26c67e40d19b738857b9901f6 Mon Sep 17 00:00:00 2001 From: Costa Tsaousis Date: Wed, 8 Apr 2015 21:10:49 +0300 Subject: [PATCH 4/4] Update fireqos-new-user.md --- content/tutorial/fireqos-new-user.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/tutorial/fireqos-new-user.md b/content/tutorial/fireqos-new-user.md index b506554..7dc2ac1 100644 --- a/content/tutorial/fireqos-new-user.md +++ b/content/tutorial/fireqos-new-user.md @@ -639,8 +639,8 @@ There are three things we can do to settle this issue: For example, I have mine set to use port 60000 for incoming requests and ports 60001 to 65535 for outgoing request. If you do set ports for your torrent clients, we can match these ports - at the `torrents` class using `match dport 60000-65535` on `input` and - `match sport 60000-65535` on `output` interfaces. I also add `prio 1` + at the `torrents` class using `match dport 60000:65535` on `input` and + `match sport 60000:65535` on `output` interfaces. I also add `prio 1` to these matches, just to make sure that if a smart guy on the net puts his client on a port from 0 to 1023, the rule that matches the fixed torrent ports will be executed first.