VeeshanVault

Multiple sites reported a while ago that Comcast was using Sandvine to do tcp packet resets to throttle BitTorrent connections of their users. This practice may be a thing of the past as it’s been found a simple rule in the Linux firewall, iptables, can simply just block their reset packets, returning your BitTorrent back to normal speeds and allowing you to once again connect to all your seeds and peer. So, if you are tired of Sandvine (the application used by Comcast to throttle Bit Torrent with fake TCP packet resets) screwing with your BitTorrent and a user of GNU/Linux, then this is for you. I will tell you how to take your bandwidth back.

Also see:

1. Basics of iptables
2. Iptables: How to save and restore rules at boot & shutdown
3. How to Encrypt Bit Torrent Traffic With Ktorrent and Azurues

If you are using a Red Hat Linux derivative, such as Fedora Core or CentOS, then you will want to edit /etc/sysconfig/iptables. First, make a backup of this file. Next, open this file in your favorite text editor. Replace the current contents with this, substituting 6883 with your BitTorrent port number:

(Note: the values state, reject, dport and tcp-flags begin with a double dash )

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
#Comcast BitTorrent seeding block workaround
-A INPUT -p tcp –dport 6883 –tcp-flags RST RST -j DROP
-A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
#BitTorrent
-A INPUT -m state –state NEW -m tcp -p tcp –dport 6883 -j ACCEPT
-A INPUT -m state –state NEW -m udp -p udp –dport 6883 -j ACCEPT
-A INPUT -j REJECT –reject-with icmp-host-prohibited
COMMIT

Reload your iptables firewall with service iptables restart. You should now see a great improvement in your seeding.

If you are using Ubuntu or another non-Red Hat Linux derivative, then place the following in a file and execute that file as root.

#!/bin/sh
#Replace 6883 with you BT port
BT_PORT=6883
#Flush the filters
iptables -F
#Apply new filters
iptables -A INPUT -i lo -j ACCEPT
#Comcast BitTorrent seeding block workaround
iptables -A INPUT -p tcp --dport $BT_PORT --tcp-flags RST RST -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#BitTorrent
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport $BT_PORT -j ACCEPT
iptables -A INPUT -m state --state NEW -m udp -p udp --dport $BT_PORT -j ACCEPT
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

If you are using Gentoo or another distro, it is important that your iptables rules includes this line, feel free to change the port number (or make it a range of ports).

-A INPUT -p tcp –dport 6883 –tcp-flags RST RST -j DROP

Your firewall is now configured and you should have great upload speed now. You will have to run this script every boot, by the way. One easy way is to call the script at the end of /etc/rc.local.

Easiest way for Gentoo and probably others is the following:

$ iptables -A INPUT -p tcp –dport 6883 –tcp-flags RST RST -j DROP -m comment –comment “Drop RST packets”
$ iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT -m comment –comment “Allow established and related traffic”
$ iptables -A INPUT -m state –state NEW -m tcp -p tcp –dport 6883 -j ACCEPT -m comment –comment “Allow new TCP BitTorrent traffic”
$ iptables -A INPUT -m state –state NEW -m tcp -p udp –dport 6883 -j ACCEPT -m comment –comment “Allow new UDP BitTorrent traffic”
$ iptables -A INPUT -j REJECT –reject-with icmp-host-prohibited -m comment –comment “Reject everything else”
$ /etc/init.d/iptables save

The first lines insert the rules into your currently running iptables rules. The last line tells the init script which will load the rules on boot to save the currently running rules.

Fash wrote:The escalation on this won't be pretty... Eventually they'll implement something to detect you're not accepting their RST packets, and they'll start throttling you another way.

I haven't used a torrent in a long time... Newsleecher ftw!

Aardor wrote:

Fash wrote:The escalation on this won't be pretty... Eventually they'll implement something to detect you're not accepting their RST packets, and they'll start throttling you another way.

I haven't used a torrent in a long time... Newsleecher ftw!

Oh, I also don't think that being able to stop the throttling with linux will cause them to change the way they throttle. There simply is not nearly as many people who are able to set up Linux/iptables as there are people using (or trying to use) bittorrent. Bittorrent became so easy to use that people who could barely navigate computers were able to successfully download anything they wished. Those same users would not have any hope of successfully installing and configuring iptables to stop the throttling.