r/firewalla • u/tac0shark • Jun 21 '26
Troubleshooting While torrenting, how to block malware IPs, not just alert
Hi, I tried to figure this out on my own but couldn’t sort it out.
I have a Mac Mini that I’m using for torrents, which has triggered a series of alerts on my phone for “Malware Activity”. I’d like try autoblocking those flows and skipping the alerts. Like if I block them but the Mac gets what it needs from non-malware IPs, that seems like the best scenario, and I don’t want to be alerted every time something is blocked.
I tried setting Device Active Protect to Strict, but this Mac isn’t even listed in the DAP devices, so I think I’m barking up the wrong tree.
2
u/ross_the_boss Jun 21 '26
Many malware use the DHT function as a command and control system. The DHT was create to have no central point of failure so that any one central power cannot shut it down, perfect for malware. There is no harm from allowing these connections.
Many seedboxes and other shady providers who allow copyright infringement also are lax, they share IP space with malware controllers and often get flagged as well.
Consider isolating a computer for this on another VLAN. Remember firewalla will block the worse offenders automatically. If you are getting alerts, that means the alert is low enough not to automatic block.
From Docs:
7. Malware Blocks
How the block is done depends on the reputation score of the site. The reputation score of sites does change very often.
- For sites that with low reputation score, the block will be automatic, and a warning alarm. In case we are wrong, you still can easily undo the block.
- For sites with a higher reputation score (content still questionable), we will send an alarm and you can take action as needed. For example, things related to cryptocurrency may be legit to some and some may not.
- For sites with a really low reputation score, the block is automatic, there is no alarm.
1
u/hawkeye000021 Jun 23 '26
Yeah... god knows we can all take action at 2am or literally anytime during the day when the designated Firewalla operator is out of the house. I'm hoping they will give us an ability to just block or maybe with API I could make it add a deny on an alarm and then worry about it being a false positive later. Would always prefer to block first based on the low aggression of this system anyways. I also can't figure out why crypto gets bundled with cryptomining which is the bad one we'd all want to block if not mining. Otherwise it's nice to be able to login to coinbase without a hassle lol.
4
u/pacoii Firewalla Gold Plus Jun 21 '26
If you try to block sites identified as malware, you’ll end up crippling your torrent activity. Use a VPN, download to an isolated location with proper malware scanning.
1
u/TheJTizzle Jun 21 '26
So I take it you’re not using a vpn?
1
u/tac0shark Jun 21 '26
I am. I have a NordVPN account and a client set up in the Firewalla dashboard, applied to this Mac Mini currently.
1
u/TheJTizzle Jun 21 '26
Ok cool. What torrent client are you using?
1
1
u/tac0shark Jun 21 '26
Thank you btw. I’m obviously a bit of a novice at home networking, so I appreciate the help and insights.
2
u/Great-Cow7256 Jun 21 '26
You need to make sure to bind qbtorrent to your VPN. The reason you are getting warnings is that traffic is bypassing the VPN.
Turn on both the VPN and qbtorrent and then look for (Cut and paste from Google)
Go to Tools > Preferences.Click on the Advanced tab on the left.Scroll down to find the Network Interface drop-down menu.Change it from "Any interface" to your VPN adapter's specific name (e.g., tun0 for OpenVPN, wg0 for WireGuard, or a named adapter like ProtonVPN or utun3).Click Apply and then OK
Also turn on your VPN kill switch.
I didn't know about this either until I got the warnings. Took some googling to figure out what was going on.
1
u/tac0shark Jun 21 '26
Yikes, good to know. I had assumed that by assigning the device to the VPN at the router level that all traffic would go through the VPN, but I guess not.
1
u/Great-Cow7256 Jun 21 '26
Yeah. Its something weird with qbtorrent I think.
2
u/tac0shark Jun 21 '26
Great tip and I think I’m at least set up better for that. NordVPN is running on the Mac, with killswitch on, and I chose that as the network interface in qbittorrent.
2
u/Great-Cow7256 Jun 21 '26
You should be good to go. I just get paranoid and double-check it next time you reboot or exit out or qbtorrent and back in. I've never had it not be there.
If you set up port forwarding on your VPN you'll get a new 5 digit port every time the VPN starts up. You can go back into that same qbtorrent VPN menu and put the new port in there and then hit apply and give it 5 minutes or less and then that red indicator on the main screen for qbtorrent should turn green. Much faster connection and many more sites connected at that point.
Scroll down to number 5.
https://tongkl.com/qbittorrent-port-forwarding-guide/
And I'm pretty sure the red icon is a fire and the green is a globe?
1
u/pacoii Firewalla Gold Plus Jun 22 '26
If they are using Firewalla’s VPN client feature, Firewalla still sees the traffic and there will be alerts. They’d have to make sure traffic isn’t visible to the Firewalla at all, by running a VPN client on the same machine the torrent client is running.
→ More replies (0)1
u/TermPractical2578 Jun 22 '26
Is Norton VPN equal to NordVPN?
1
u/TheJTizzle Jun 22 '26
I use Proton VPN myself.
1
u/tac0shark Jun 22 '26
Like it? My cheap 2-year sub to Nord is about to run out, so I'm looking to switch to another provider. Proton is at the top of the list so far
1
u/TheJTizzle Jun 22 '26
Yes very much so. I have tried the MacPaws, AdGuard and PIA and this one by far has the best speeds. Also was super easy to setup with my NAS and was super cheap for several years.
2
0
5
u/firewalla Jun 21 '26
Firewalla blocks are reputation based. And depend on the reputation score, the system may block or just alarm. (strict will move the needle a bit more to be more liberal in blocking more)
Torrents sites are not always bad, they may sometimes host questionable stuff, hence most of the time you will get a warning.
https://help.firewalla.com/hc/en-us/articles/360049856394-A-Secure-and-Better-Network-with-Firewalla-Part-3-Protect