Block P2P traffic

[ekkas2]

I'm trying to block users from using P2P during office hours.
In activity I see hundreds of TCP connections to port 4346 so under
services I added TCP mapping service,
time limited : always access except from 07:00 to 20:00 default system policies ignored.

But still users make hundreds of connections to 4346

Help please as these leeches are pulling down our bandwidth.


Other ways to limit P2P traffic anyone ?

Thanks a lot

[MattP]

Hi,

Which license do you have? If you have a version 6 Pro or Enterprise then you get Bandwidth control. You can create a bandwidth control rule to reduce traffic on port 6346 - 6348 to 1kb. This won't actually stop the connection but it will reduce it to the point where it is practically unusable. You can also create time restrictions on this rule so you free up the bandwidth after work hours.

The hard part about P2P applications is that they will find another port to use if they get blocked at the firewall, so they can be hard to stop. You could try using the WGIC then stopping them from even running on the network.

[ekkas2]

I'm using WGPro for a small WISP so WGIC is out of the question.

P2P open hundreds of sessions per user, so I'd like to block them entirely during office hours as our WiFi equipment can't keep up with so many sessions and normal performance is degraded.

What's wrong with my attempt?

[MattP]

Well, a TCP mapping is designed for incoming connections to map them to a port on a server on your LAN, or for connections out to map them to another server. It doesn't offer a way to capture traffic like the WWW proxy, so you're only going to get the users to connect to you by setting the proxy settings on the client machines.

You could try setting up another WWW proxy service and running it on port 6346, then capturing all connections on that port. You can then set up your time restrictions to control access.