MHOSTMHOST

Blocking BitTorrent traffic on your VPS

BitTorrent traffic on a VPS is a common source of copyright-holder complaints and abuse reports from your upstream provider: the server starts holding hundreds of simultaneous TCP/UDP connections to peers and trackers, and the provider gets a complaint and blocks the IP or asks for an explanation. You can't perfectly distinguish encrypted BitTorrent traffic from ordinary traffic — the protocol supports encryption (Message Stream Encryption) and can run on arbitrary ports — but combining port blocking, DHT request detection, and a connection-count limit covers the bulk of "default" clients. In this article you'll configure iptables on your MHost VPS to block typical torrent traffic without affecting normal web and SSH traffic.

What you'll need

  • An MHost VPS on Ubuntu 22.04/24.04 or Debian 11/12 — the commands below use iptables (netfilter), the default on these systems.
  • SSH access as root or a user with sudo rights.
  • The iptables-persistent (netfilter-persistent) package to keep rules across reboots.
  • Access to the VMmanager 6 panel — as a safety net in case a rule blocks something it shouldn't and you need console access without SSH.
Important: no set of iptables rules gives you 100% blocking. Encrypted traffic and clients using a non-default port won't be caught by these rules — treat this as reducing the bulk of torrent traffic, not a guaranteed block. For port-level control across the whole server, see "The ufw firewall: managing ports."

Step 1. Block the standard BitTorrent ports

Most clients listen on a well-known port range by default — this is the cheapest layer of filtering, though a user can change the port manually in their client settings.

bash
sudo iptables -A INPUT -p tcp --dport 6881:6889 -j DROP
sudo iptables -A INPUT -p tcp --dport 51413 -j DROP
sudo iptables -A INPUT -p udp --dport 6881:6889 -j DROP
sudo iptables -A INPUT -p udp --dport 6969 -j DROP


Port 6969/tcp is the standard HTTP tracker port. If you're not running your own service on that port, it's worth closing it the same way.

Step 2. Block DHT requests by signature

BitTorrent's DHT (distributed hash table) runs over UDP and is almost always transmitted unencrypted in bencode format — this lets you match characteristic strings in the packet regardless of port.

bash
sudo iptables -A FORWARD -p udp -m string --algo bm --string "1:q9:find_node" -j DROP
sudo iptables -A FORWARD -p udp -m string --algo bm --string "1:q9:get_peers" -j DROP
sudo iptables -A FORWARD -p udp -m string --algo bm --string "1:q13:announce_peer" -j DROP
sudo netfilter-persistent save
Don't use short strings like "announce" without the bencode length prefix (13:announce_peer). The word "announce" on its own often shows up in ordinary HTTP/HTTPS traffic (analytics, ad pixels), and a rule like that will start dropping legitimate requests.

Step 3. Limit simultaneous connections per address

A torrent client typically keeps dozens to hundreds of parallel connections open to different peers — an ordinary browser or mail client doesn't do that. You can use this as an additional behavioral signal.

bash
sudo iptables -A FORWARD -p tcp --syn -m connlimit --connlimit-above 100 --connlimit-mask 32 -j DROP
A threshold of 100 connections is a starting point. If your server legitimately carries a lot of parallel sessions (a proxy serving several users, say), raise the value and watch your logs before cutting off client traffic.

Step 4. Enable deep packet inspection via nDPI (optional)

Ports and bencode signatures won't catch encrypted or obfuscated torrent traffic. The nDPI kernel module classifies the protocol by packet behavior patterns instead of relying only on unencrypted content.

bash
sudo apt install -y build-essential linux-headers-$(uname -r) git
git clone https://github.com/ndpi-netfilter/nDPI.git
cd nDPI/ndpi-netfilter && make && sudo make install
sudo modprobe xt_ndpi
sudo iptables -A FORWARD -m ndpi --bittorrent -j DROP
The module is built for a specific kernel version — after a kernel update (sudo apt upgrade) you'll need to rebuild it, or the rule will silently stop working. Add this to your server-update checklist.

Step 5. Check the rules and save them

Review the active rules and make sure normal traffic — SSH, HTTP/HTTPS, your own services — still gets through:

bash
sudo iptables -L -n -v --line-numbers
If your sites and SSH keep working, and a test torrent connection won't establish — the rules are working.
Without sudo netfilter-persistent save, all the rules you've added will be lost on server reboot — save them the same way as in Step 2.


What's next

Basic iptables commands, without tying them to a specific task, are covered in the "iptables basics" article. If a simple set of allowed ports is enough and you don't need iptables' full flexibility, see "The ufw firewall: managing ports."

Related articles

PreviousThe ufw firewall: managing portsNextFail2ban: protection against brute-force