3

I want to ensure they're not downloading any illegal content (torrent websites in particular). If they're using a VPN or Tor, then I guess there's not much I can do, but if they're just connecting directly to, say, pirate bay, without masking their traffic and downloading content through them, is there a way for me to spot that and tell them off?

I'm not interested in throttling their traffic or monitoring what websites they otherwise visit. I'm only interested in detecting if they access the popular torrent websites (pirate bay, kickass, demonoid etc.) and download stuff through them.

My WiFi router is Technicolor 582n.

  • Your ability to block torrents will vary depending on your gateway device. See the following question for information on how to block torrent traffic : security.stackexchange.com/questions/42145/… – DKNUCKLES Feb 7 '15 at 12:18
  • I just want to detect that they're using it, not necessarily blocking it. – Nobilis Feb 7 '15 at 12:22
  • Linked question still applies – DKNUCKLES Feb 7 '15 at 12:29
  • I'll have a look, thanks, I wonder how much of this I can achieve with a plain, off-the-shelf router though. – Nobilis Feb 7 '15 at 12:33
  • Admittedly, likely not much. Torrent traffic is notoriously difficult to block, even with enterprise firewalls because of the nature of how it operates. Monitoring or detecting it is typically done by monitoring the traffic and connections which, I would imagine, is beyond the capabilities of your router. – DKNUCKLES Feb 7 '15 at 12:39
1

I guess that most corporate people setting up Internet access for the employees may have the same need: how to ensure that employee does not waste enterprise's bandwith to download torrents?

Usually, the main answer lies in two things:

  • Restrict the destination port numbers to the really needed ones,
  • Setup a DNS cache server, which can provide an easy way to blacklist certain domain names (this implies that rules above do not allow port 53 as destination port),
  • Make the HTTP flow go through a proxy,in the current case a non caching proxy like privoxy may be usefull.

For HTTPS content, you will not be able to check the actual page or data content however you will be able to know the domain name of the website currently visited (both thanks to DNS requests and SNI) and compare it to a blacklist, which seems sufficient for your needs.

edit: Just a thought, in case of a one time check to answer questions like "Internet is going damn slowly, I hope my neighbor is not using all the bandwidth with torrents", you have the possibility to use a network sniffing software (like wireshark) on your wifi network to check what is going on currently.

  • Does setting up a DNS cache server or installing privoxy depend on the type of router I have? Can I perhaps set up a low-grade proxy server PC to monitor traffic that passes through the network and alert me if, say, certain domain names crop up? – Nobilis Feb 7 '15 at 14:34
  • On my side I finally ended by using the "low-grade server" directly as a router and wifi AP, so I am completely free about what I can do, and the router provided by my Internet provider has now wifi disabled and acts mainly as a modem. However, if your neighbor traffic must still go through your Technicolor router, then yes you are bound to the functionality offered by the manufacturer, however some propose relatively advanced "firewall" filtering rules which may potentially allow you to redirect traffic coming from the Wifi interface to your proxy host. – WhiteWinterWolf Feb 7 '15 at 14:48
  • I'll have a look at the router's setting then, thanks, I honestly thought this would be more straightforward. – Nobilis Feb 7 '15 at 14:54
  • It should be noted, for what it's worth, all of the above measures are easily circumvented by someone who knows what they're doing. I would also note that these methods deal with blocking access to known trackers, but torrent downloads are facilitated by downloading pieces from different peers which is what makes it so difficult to block. – DKNUCKLES Feb 7 '15 at 15:11
  • 1
    @Nobilis: For information, as an alternative to using a low end PC as router, there are router where you can flash the ROM to install an open and, therefore, more customizable firmware. A list of projects is available here, but if you are interested be sure to choose a router compatible with the selected project. – WhiteWinterWolf Feb 7 '15 at 15:46
1

I think what you are looking for is 'parental controls' on your modem/router. Check your router if such a facility is available. If its not, then a browser that has such controls. The cheaper versions will just give you an option to enter the names of the websites that you want to block. The pricier ones will have advanced software (like privoxy as mentioned by GZBK) which restricts on keywords etc.,

  • Yeah, I did find those and added a bunch of torrent websites to them. However one of them uses encryption and even though I've correctly input the address, it's still accessible. Oh, well, might just get a better router. – Nobilis Feb 9 '15 at 8:39
  • I am not sure what you mean by encryption. If you mean the site requires a https connection, your router should still be able to stop those connection. Did you reset the connection after applying the settings? Can you google and check if others are having similar problems with this router? – nitarshs Feb 10 '15 at 11:30
  • Yeah, it picked up all the other websites that weren't using HTTPS but not this one for whatever reason. It might be a common issue with lower grade routers (as suggested here). – Nobilis Feb 10 '15 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.