Page 1 of 1

Regular calls on port 53 triggering my firewall

Posted: Tue Mar 15, 2022 9:07 pm
by mub
I'm getting alerts from my firewall about suspicious connection attempt to an external server on port 53 (this is usually a DNS server port). This is repeating roughly every 10mins and I have confirmed it is definitely qbittorrent doing make these connections. I'm running the current version of qbittorrent on my linux server and there is nothing in the queue.

I have attached 2 screenshots from my router console. One pic shows the list of alerts the other shows more details of one alerts.

What is going on? Why is qbittorrent doing this when the queue is empty?

Re: Regular calls on port 53 triggering my firewall

Posted: Thu Mar 17, 2022 1:10 am
by Peter
qBittorrent like many clients is maintaining a P2P "DHT" network.
https://en.wikipedia.org/wiki/Distributed_hash_table

To disable this, go into Settings -> Bittorent, and you can disable DHT there.
Is it a real threat? I doubt it. I think it's just the firewall being.. well, awful. IMO the "firewall" is junk and you should uninstall it. ^-^

Almost all software firewalls nowadays are just snakeoil and upsell marketing. there are proper firewall out there.. but they are usually dedicated hardware and they cost some money (a lot). but honestly, you don't need it really. you can use a DNS that protects you (such as AdGuard DNS, OpenDNS), and you should use an AdBlock in your browser. this combined protection makes things pretty bulletproof. yeah, if you open "song.mp3.exe" that you just got in email... you are still doomed.

Re: Regular calls on port 53 triggering my firewall

Posted: Thu Mar 17, 2022 11:44 am
by mub
The value of Firewalls varies and depends on the purpose and desired features, but that's a debate for another time.

Now I understand what is triggering the alert I can manage it. Thanks for the info.