Unable to block P2P by "all-P2P"

Hello all!

What is this guy doing (192.168.10.103)?

I suspect it to be kind of P2P but I haven’t been able to block it.

I have the following entries in the firewall:

/ ip firewall mangle 
add chain=forward action=mark-connection new-connection-mark=P2P passthrough=no p2p=all-p2p \
    connection-state=new comment="" disabled=no 

/ ip firewall filter 
add chain=forward action=log connection-mark=P2P log-prefix="DROP P2P" comment="Log P2P" \
    disabled=no 
add chain=forward action=drop connection-mark=P2P comment="Drop P2P" disabled=no

.. but not a single hit, although I know P2P is going on. I have been able to block Bittorrent by testing port nos 6881-6899 but when disabling the Bittorrent rules the same packets are not caught by the general P2P rules.

So what am I doing wrong?

And - Mikrotik staff blame users for asking the same questions all the time about P2P blocking instead of searching old posts, but why is search on keyword “P2P” blocked?

Not a single hit when i include “P2P” in my search.

I don’t think you need to bother marking the packets first, just create a “drop” rule and select “all p2p” in the P2P dropdown. Also don’t bother setting the Connection State, this will reject all by default.

I haven’t banned P2P completely, I have one customer that tries to download Gigabytes daily, in the end I just put in a time based queue that limits their bandwidth to 64Kbps during the day, but allows them full bandwidth during the night.

Well, from what I’ve read P2P programs nowadays use encryption, standard ports (http port 80?) and such things to hide from filters, so that once a packet is recognized as P2P, the connection must be tagged to be able to drop further packets on the same connection.

Anyway, there must be something serious I’ve missed about this, as I’m not even able to catch packets to Bitttorrent ports 6881-6899 using the “all-P2P” option.

Someone to enlighten me?

And - can somebody at Mikrotik tell me why searches for the keyword “P2P” is banned?

It’s not banned, forum just doesn’t like short terms. use something like this:
http://www.google.lv/search?q=p2p+site%3Ahttp%3A%2F%2Fforum.mikrotik.com

P2P matcher doesn’t care about ports, just as the other poster said, use a simple drop rule

Thanks Normis,

But will this hit ALL P2P packets, not only initial ones?
What about my assumption about the need for mangling connections in order to hit subsequent P2P packets in disguise? Will such packets be filtered as well, or is the problem non-existing as no downloads are allowed to be initiated?

when establishing connection p2p software sends out unecnrypted packets, if they are dropped then no connection is established.

Thank you Janis, then I’ll just use the following:

add chain=forward action=drop p2p=all-p2p comment="Drop P2P" disabled=no

What about the image in my initial post? What is this user doing with all these port 9000-connections?

also, this rule will not drop already established encrypted p2p connections, so you have to clear connection table

and that on port 9000 can be anything.

Ok, that works to a certain extent but as far as I’ve found out there are major limitations to this method, for instance when I would like to restrict the search to a specific period of time, sort on posting time etc.

Why does not the forum “like” abbreviations, this must me something that’s configured by admins?
Earlier (in the old forum) any search could be performed, and other phpBB boards allow whatever search you want.

IMHO it is meaningless not to allow users to search for exact search strings using the built-in functions.
You know, when people don’t find what they are looking for, they continue naging you!

we didn’t make the engine, sorry guys we’ll try to upgrade again and see if “they” fixed it.

ok, search works now. p2p can be searched

Thank you for your quick reply Normunds, I see that now it works.

I know that MT is not the developer of phpBB. I just found it strange that some search criteria were suppressed by the engine, and assumed that this might be something that is configured by you.

Anyay, thanks again!