How to block torrent sites on your network
Torrenting combines three things: websites that list files, trackers that introduce peers, and the peer to peer protocol that moves the data. A block that covers only one of them leaks.
This guide covers all three for IT admins, MSPs, campus and school IT teams, hotels and guest Wi-Fi operators, and vendors who build filters.
Rights holders contact the owner of the network address, which is you.
Pirated software, games and "cracks" are a classic malware carrier.
One busy client can open hundreds of connections and fill an uplink.
Misconfigured clients can share folders that hold company files.
Why organisations block torrent sites and traffic
The scorecard above shows the four main risks. The meters are a rough guide to how often each one drives a decision, not a measured statistic. The table shows how the balance shifts by type of network.
| Network | Main reason to block | Typical stance |
|---|---|---|
| Universities and colleges | Copyright notices about student traffic, bandwidth in residence halls | Block on student and guest networks, exceptions for research |
| K-12 schools | Inappropriate content, malware, CIPA filtering duties | Block everywhere |
| Businesses | Legal exposure, malware, data leaking through shared folders | Block everywhere, alert on attempts |
| Hotels, cafes, guest Wi-Fi | Copyright notices tied to the venue's address, fair bandwidth for guests | Block the protocol and cap per device bandwidth |
| ISPs and MSPs | Customer contracts, network health | Offer blocking as a policy option per customer or tenant |
Sector specific guidance is on our pages for higher education web filtering and hospitality web filtering.
The three tiers of a complete torrent block
Think of torrenting as a chain. Break any link and the download fails, but users try to repair the chain, so break all three. Tier one is the cheapest to deploy and tier three the most robust.
Websites and search engines that list torrent files and magnet links. They change domains often and run many mirrors.
Block with: File Sharing/P2P category in DNS, firewall URL filter or gateway. Add the proxy category so mirrors behind proxies fail too.
Trackers tell a client which peers hold the file. Clients can also find peers without trackers, through the distributed hash table and peer exchange.
Block with: category blocks on tracker domains, plus firewall application control, because trackerless discovery has no domain to block.
The client connects directly to many peers over TCP and UDP, often on random ports and with protocol encryption.
Block with: application control signatures for BitTorrent, connection limits per device, and app control on managed endpoints.
Methods: router, firewall, DNS and device controls
Open each method for concrete steps. Most networks need the DNS or firewall method plus one device method. The label on the right shows which tiers each method covers.
Home or small office routerTier 1, partly 3
- Set DHCP to give out a filtering DNS resolver that blocks File Sharing/P2P.
- Block outbound DNS, DoT and known DoH resolvers so devices cannot skip it.
- If the router has an application or "traffic identification" feature, block peer to peer.
- Limit connections per client if the router allows it; torrent clients open far more connections than browsers.
Port blocks on 6881 to 6889 catch only old or default configurations. Do not rely on them.
Next generation firewallTiers 1, 2 and 3
- Block the peer to peer or file sharing URL category in the outbound web filter.
- Block the BitTorrent application and the wider peer to peer application group in application control.
- Apply the rule to UDP as well as TCP; much modern torrent traffic uses UDP.
- Add session limits per source address to slow clients that evade signatures.
- Send peer to peer detections to logs or a SIEM so repeat offenders are visible.
Firewall vendors maintain their own peer to peer signatures. Check their notes for encrypted torrent detection on your model.
DNS filterTiers 1 and 2
- Block File Sharing/P2P and VPN / Proxy / Anonymizers for all user groups.
- Block Malware / Phishing / Suspicious too; fake torrent sites push malicious installers.
- Lock DNS so clients cannot use another resolver.
- Review logs for tracker style hostnames that are not yet blocked.
DNS cannot see peer connections, which use IP addresses. Use it with a firewall or device control. Our article on DNS filtering integration explains how vendors wire category data into resolvers.
Microsoft Intune and DefenderTier 3 on devices
- Use app control policies (WDAC or AppLocker) to block torrent clients and allow only approved software.
- Remove local admin rights so users cannot install clients or open firewall ports.
- Turn on Defender network protection and add custom indicators for torrent domains you find.
- Use Defender attack surface reduction and antivirus to catch malicious files downloaded by torrent.
Google Admin consoleTiers 1 and 3 on Chromebooks
- Block torrent sites in the Chrome URL blocklist or, better, through a category filter.
- Block Chrome extensions and Android apps except an approved list, so torrent extensions and apps cannot be added.
- Turn off DNS over HTTPS or fix it to your filtering resolver.
Mobile MDMTier 3 on phones
- Allow only apps from an approved catalogue on managed devices.
- Push a DNS or filtering profile so the category block follows the phone.
- Restrict users from adding their own VPN configurations where the platform allows it.
Legitimate BitTorrent use: plan exceptions, not loopholes
BitTorrent is a protocol, not a crime. Some legitimate work depends on it, so give those cases a narrow exception instead of weakening the main rule.
Open source downloads
Several open source projects offer large installer images by torrent as well as direct download.
Rule: point users to the direct download mirror insteadResearch datasets
Some large scientific and machine learning datasets are shared peer to peer between institutions.
Rule: allow on a named research server or segmentSoftware and game delivery
Some software distribution and update tools have used peer to peer techniques to save bandwidth.
Rule: test updates after blocking, allow the vendor's app onlyInternal content distribution
A few organisations use peer to peer tools to push large files to many sites.
Rule: allow between internal subnets, block to the internetSuggested acceptable use wording
| Clause | Example wording you can adapt |
|---|---|
| Scope | Peer to peer file sharing software and torrent websites may not be used on organisation networks or devices. |
| Exceptions | IT may approve named devices for specific work that needs peer to peer transfer, for a fixed period. |
| Monitoring | Network traffic is filtered and logged to enforce this rule and to protect the network. |
| Consequences | Breaches are handled under the usual conduct or guest terms, and devices may be disconnected. |
Bypass risks to close
Once torrent sites and the protocol are blocked, these are the routes users try. Each has a defensive answer.
VPN tunnels
A VPN hides both the index site and the peer traffic. Close it with our guide to blocking VPN apps.
Cloud download services
Paid services fetch torrents on a remote server and offer the result as a normal web download. Block them with the File Sharing/P2P and file hosting categories.
Mirrors and proxies
Index sites run mirror domains and proxy copies. A category feed that is updated daily and the proxy site block handle both.
Protocol encryption
Clients can encrypt the protocol to evade simple inspection. Behaviour based detection and connection limits still flag them.
Mobile hotspots
A laptop on a phone's hotspot leaves your network. Device app control is the only defence that travels with the laptop.
File sharing and hosting sites
The same files appear on one click hosting sites. See our guide to blocking file sharing sites.
When a copyright notice arrives: a response checklist
Even good blocks can miss a device for a while. If a rights holder or your ISP forwards an infringement notice, a calm, repeatable process protects the organisation and the user.
- Record the notice: date, time, the public IP address named and the file title, and keep the original message.
- Match the time and address to your NAT, DHCP and firewall logs to find the internal device. Note time zones, which notices often state in UTC.
- Disconnect or quarantine the device if the client is still running, and remove the torrent client.
- Check how it got through: unmanaged device, VPN, new index domain, or a gap in application control.
- Fix the gap and add the domains you found to a lookup check, so you know whether they are categorized.
- Follow your acceptable use policy with the user. For guests, apply your venue's terms of use.
- Reply to the notice only as your legal or compliance team advises. Rules differ by country.
- Keep a short incident record so repeated cases show a pattern.
Block or shape? Bandwidth controls as a second line
On guest and residential networks, a hard block is sometimes paired with traffic shaping. Shaping does not remove the copyright risk, but it limits the damage when a client slips through.
| Control | What it does | Good for | Limit |
|---|---|---|---|
| Category block | Stops index sites, trackers and client downloads by name | Every network | Cannot see direct peer connections |
| Application control block | Drops recognised peer to peer sessions | Firewalled networks | Some encrypted traffic is missed |
| Per device bandwidth cap | Limits any single device to a fair share of the link | Hotels, residences, guest Wi-Fi | Does not stop the download |
| Connection count limit | Caps simultaneous sessions per device, which torrent clients exceed | Small sites with basic routers | Can affect heavy legitimate users |
| Low priority queue | Gives unknown high volume traffic the lowest priority | Shared business links | Complex to tune well |
Torrent activity signals worth watching
Hundreds of short connections
A single device opening connections to many external addresses on high ports is the classic peer to peer pattern.
Check: firewall session table per sourceSteady upload at night
Clients keep seeding after a download finishes, so uploads continue when the user is away.
Check: traffic graphs by deviceLookups for tracker style names
DNS queries for host names that contain "tracker" or "announce" often point to torrent use.
Check: DNS logs, then a category lookupNew executables after a download
Pirated software often arrives as an installer or "crack" that endpoint tools flag.
Check: endpoint protection alertsHow to test the torrent block
Run these from an unmanaged test laptop and a managed device on every segment. Only use legally distributable test torrents, such as an open source installer image. Keep the results in a simple log so the next test can be compared against this one.
- Open several torrent index and magnet search sites in a browser. Each should show the block page.
- Look up those domains in our domain lookup tool and confirm File Sharing/P2P is among the categories.
- On the unmanaged laptop, open a legal open source torrent in a client. It should fail to find or connect to peers.
- Change the client to use encryption and a random port, then retry. The firewall should still log a peer to peer detection.
- On a managed Windows device, try to install or run a torrent client. App control should refuse it.
- On a managed Chromebook or phone, search for torrent apps and extensions. They should be unavailable.
- Check that approved exceptions, such as a research server, still work.
- Confirm the firewall or SIEM recorded every test with device and user details.
- Repeat each quarter and after firmware or signature updates.
Category-based blocking with our database
Torrent index sites are some of the most frequently renamed domains on the web. A static list cannot keep up; a category that is updated as new domains appear can.
Our file sharing and P2P category covers torrent index sites, magnet link search engines, tracker domains and client download pages. Each domain can also carry other ranked categories, so a site that mixes streaming and torrents is caught either way.
To check a batch of domains from your firewall logs at once, use bulk categorization. For streaming piracy sites that do not use torrents, also consider our streaming category.
For MSPs and ISPs, one licence can power the torrent block for every tenant. Policies stay per customer, while the category data underneath is shared and refreshed for all of them at once. See ISP web filtering for the network operator view.
What licensees receive
- 120 million categorized domains in 59 categories, plus the IAB Content Taxonomy in the same file.
- About 300,000 newly registered domains categorized daily, delivered as delta files.
- CSV, Parquet or JSON for your own systems, including air-gapped deployments.
- Exports such as DNS RPZ, hosts files and firewall external dynamic lists, see blocklist formats.
- A lookup API included with licences.
Torrent blocking FAQ
Is blocking torrent websites enough to stop BitTorrent?
No. Blocking index sites stops users finding new torrents, but a client that already has a torrent or magnet link can find peers through trackers and the distributed hash table. You also need tracker blocks, application control for the peer to peer protocol and device controls.
Can I block BitTorrent by port?
Only partly. Older clients used ports 6881 to 6889, but modern clients pick random ports and can encrypt the protocol. Application control signatures and behaviour based detection on a firewall are far more effective than port rules.
Why do organisations block torrents?
Mostly for copyright risk, because rights holders send infringement notices to the owner of the network address, and for bandwidth. Torrented files are also a common way to deliver malware disguised as software, films or games.
Are there legitimate uses of BitTorrent?
Yes. Some open source projects distribute large downloads by torrent, and some research datasets are shared that way. Handle these with an exception for a specific device or segment rather than allowing peer to peer traffic everywhere.
Which category should I block for torrent sites?
In our database torrent index sites, trackers, magnet link search engines and peer to peer client download pages sit in File Sharing/P2P. Add VPN / Proxy / Anonymizers so users cannot route around the block.
How do I block torrents on guest Wi-Fi?
Guest devices are unmanaged, so rely on the network: block the File Sharing/P2P category in DNS, enable peer to peer application control on the firewall, and cap per device bandwidth so a single client cannot saturate the link.
Keep up with renamed torrent domains
License a categorized domain database with daily updates for new domains and a lookup API, running in your own platform. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
BitTorrent is a trademark of Rainberry, Inc. Microsoft, Windows, Intune and Defender are trademarks of Microsoft Corporation. Google, Chrome, Chromebook and Android are trademarks of Google LLC. These names are used here only to identify the products and protocols discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.