title: Blocking torrent traffic through server with deep packet inspection
body: <p>I run a VPN service and I've been trying to find a way to block torrent traffic going through the server so that customers don't use the VPN service for torrenting. At first I tried using iptables to block common ports used for torrenting as well as string matching, but the only thing that ended up doing was slowing down the startup process of connecting to peers. This is due to the fact that torrent clients will port hop until they find a usable port.</p>
  
  <p>After looking around online, the conclusion I came to was that the only was to block torrent traffic reliably is through Deep Packet Inspection.</p>
  
  <p>I installed a service that consists of ndpi and kernel module on one of the VPN servers so that after ndpi detects torrent protocol, it can be passed to Iptables for dropping. </p>
  
  <p>Found here: <a href="https://github.com/betolj/ndpi-netfilter" rel="nofollow">https://github.com/betolj/ndpi-netfilter</a></p>
  
  <p>Through the ntopng web interface, it is properly detecting torrent traffic, but iptables doesn't seem to be dropping the packets, as torrent traffic is still able to go through perfectly fine. </p>
  
  <p>Did I do something wrong, or is there perhaps a better method/software to perform traffic shaping? </p>