Stopping ill-mannered use of guest wifi

Question

I support a small business' tech issues including setting up a guest WiFi network. The WiFi is important since they want people sitting around and consuming their product. Over the past months they've received numerous DMCA notices from their ISP regarding someone who insists on downloading porn via P2P. We're currently using a consumer-grade netgear access point. We're looking for ideas on how to stop the bad actors without sacrificing the service to our customers.

Answer 1

It does not take much effort to block P2P etc with current routers and restrict access as this detailed article from 2011 (Lifehacker) shows.

But unless you restrict access a lot and thus make users unhappy they will still be able to upload copyrighted content to youtube, make bomb threats etc. If you don't want to deal with these liability issues (which also differ between countries) you better let a commercial hotspot provider deal with it. These providers usually create a separated network for the guests and route the traffic over their own infrastructure. This way they appear as the source of the traffic and not you and thus they also handle all the liability problems. Of course this shift of responsibility has a price which either you or your customers must pay.

Answer 2

You know what is really the cheapest and simplest solution ? Buy a VPN plan , and route all the company traffic (or the guest WiFi traffic) to the VPN. Never more care if your users are watching porn or downloading torrent or buying drugs or whatever , you won't be the responsible for it. Let the VPN company take care of that

I think this solution is really good because it's cheap and it's one less problem to spend time, and any VPN will do it.

Answer 3

Per this superuser answer, you can try to block access to web sites that index the torrents. This isn't quite what you asked for but may help. That answer explains: One way to do this in an indirect way is by using OpenDNS.

Set the DNS server in your router settings to the OpenDNS servers (208.67.222.222 and 208.67.220.220)

1. Create an account on the OpenDNS web site (that's free), and follow the instructions on their web site how to configure it
2. Then in your account settings choose a custom filtering level and select to block "P2P/File sharing". If you want you can block other categories, I'd definitely block "Phishing", and depending on your needs you can add specific sites as exceptions or to be blocked.

As this is only blocking access to the sites that index torrents, it won't stop a torrent that has already been downloaded to the users computer from continuing. Also, users can configure their own DNS. But this might discourage some unwanted activity.

There are also some routers that won't break the bank (a $216 example) that have fairly sophisticated firewalls in them that I think can be configured to block P2P protocols with. You should check with the vendors before purchasing.

Answer 4

If you block p2p downloads they'll probably download over http instead. But blocking p2p ports is probably a good idea as other answers have said. I suspect that you've got someone with a home connection that either blocks or monitors these downloads and you're the easiest place for them to get their videos.

You don't say how much bandwidth you've got (or monthly data allowances), but per-client throttling could well make it much less worth their while over any protocol while freeing up bandwidth for your other users. You could probably set it at a level that allows casual youtube watching -- or maybe stopping that too would be nice to your other customers (depending on manners and headphones). A good enough router could easily implement progressive throttling, where the connection slows with quantity downloaded, but I don't know if there's anything cheaply commercially available.

Failing that, try to figure out who it is and point them to some advice about TOR or privacy-protecting VPNs (do some homework first, I haven't kept up with the details on this). That would have two effects -- conceal your involvement and probably let them download elsewhere. A third might be that you wouldn't see them again.

Answer 5

As far as I know, BitTorrent clients require UPnP to accept incoming connections behind NAT. If you disable UPnP in the router, users will no longer be able to seed files through BitTorrent.

This may affect some other applications as well.

(Note: most IPv6 networks don't support NAT. This may not work if your ISP supports IPv6.)

Answer 6

This type of traffic can be stopped with the use of either an IPS or a proxy. Using just a firewall will allow circumvention by using a different port. The below solutions are port independent and rely on monitoring of traffic to identify P2P traffic that may be being sent over port 80.

A proxy is commonly used to prevent HTTP and/or HTTPS traffic, but they can also be used to filter on specific protocols being used. This is done by SPANing traffic to a system that identifies and detects protocol usage. When it is detected, it sends a reset signal.

An IPS works in a similar fashion to the above described solution. The difference is that the IPS is directly in-line and all traffic goes directly through the IPS. IPSes have many rules built-in out of the box to prevent malicious or illegal activity. Snort, for example, has the ability to observe P2P & TOR traffic. You can then have the IPS deny any traffic that matches the rules.

Answer 7

Unless there's a technical battle of wits, you can probably get by with just setting a different WPA2 password every day and handing it out to customers.