Help · Operators

Torrent Guard

Blocks BitTorrent on your origin, on every transport: Xray drops detected BitTorrent traffic, tracker ports and tracker domains, and a session that has uploaded more than 30 GB and far more than it downloaded, or, where the connection watch runs, that sweeps addresses or behaves like a BitTorrent client, is ended. Set at install time.

Open in the app All help topics
example
BitTorrent detected         → blocked
Ports 6881–6889, 6969         → blocked
Upload ÷ download > 1.5       → session ended (past 30 GB of upload)
Address sweep, torrent swarm  → session ended (connection watch)
User can't reconnect to this node for 1 hour

BitTorrent traffic brings copyright and abuse complaints to your hosting provider, and repeated complaints can get a server suspended. Torrent Guard blocks it.

What it blocks

  • Connections Xray identifies as BitTorrent.
  • Destination ports 6881–6889 and 6969.
  • Domains matching tracker. or torrent (a broad match, so it can catch an unrelated site with either word in its name), plus a few known tracker and DHT hosts.

Detection needs Xray's traffic sniffing, which runs on every transport an exit serves through Xray: Reality, XHTTP, WebTunnel and Hysteria2. olcRTC does not pass through Xray, so the exit itself drops what that traffic sends to the BitTorrent and DHT ports, BitTorrent handshakes sent in the clear and DHT queries; the connection watch below counts its destinations, which the olcRTC server hands it.

Ending sessions

  • Upload ratio (default 1.5): once a session has uploaded more than 30 GB, it is ended if upload ÷ download is above the ratio. Browsing and streaming download far more than they upload; seeding does the opposite. Below 30 GB of upload the ratio is not judged: one video sent or a photo library backed up uploads far more than it downloads too. A video call uploads about as much as it downloads, so a ratio under 1 would end the sessions of people who make a lot of calls.
  • Session limit in GB (optional): a session is ended when it reaches it.
  • The connection watch, on the exits that run it (at the time of writing, ProofKit's exits): every minute the node counts, for each session, how many different destinations its connections reached, how many of them on ports other than 80 and 443, and how many on ports other than 80 and 443 Torrent Guard refused. A session is ended when its count for one minute reaches 300 different destinations, or 200 in each of two minutes in a row (address sweeping), or 100 destinations on ports other than 80 and 443 that are at least 80 % of all of them (a torrent swarm), or 20 on ports other than 80 and 443 refused (a BitTorrent client the rules turned away). All of the account's sessions on the node end together. The watch reads each destination in memory to count it and never writes, logs or sends one; it counts the destinations of UDP on Hysteria2 and VLESS as it counts those of TCP, and those of olcRTC, which the olcRTC server hands it.
  • An ended session shows the reason to the user, and that user can't reconnect to your node for an hour.

When to switch it on

  • Hosts that suspend servers over copyright complaints.
  • Countries with strict copyright enforcement.
  • When WARP is off and complaints come straight to your address.
Torrent Guard is an install option (--torrent-guard, or the toggle when you register), with the ratio and GB limit set in the registration form. The Settings form can't change them. Nodes with it on carry a No P2P badge, and users can filter them out with P2P Allowed.