Cisco ZBF + FPM vs. Mikrotik Firewall: Как заблокировать P2P/Торрент (*.torrents, трекеры, DHT/PEX)

!
load protocol system:fpm/phdf/icmp.phdf
load protocol system:fpm/phdf/ip.phdf
load protocol system:fpm/phdf/tcp.phdf
load protocol system:fpm/phdf/udp.phdf
load protocol system:fpm/phdf/ether.phdf
!
ip port-map http port tcp 81
ip port-map http port tcp 2710
ip port-map http port tcp 8080
ip port-map http port tcp 8090
ip port-map http port tcp 8888
!
parameter-map type regex REGEX-TORRENT-ANNOUNCE
 pattern .*[Ii][Nn][Ff][Oo]_[Hh][Aa][Ss][Hh]=.*
parameter-map type regex REGEX-TORRENT-PROHIBIT-DOWNLOAD
 pattern .*application\/x-bittorrent.*|.*\.torrent.*
!
class-map type inspect match-all CLASS-INSPECT-HTTP
 match protocol http
class-map type inspect http match-all CLASS-HTTP-TORRENT-PROHIBIT-DOWNLOAD
 match  response header content-type regex REGEX-TORRENT-PROHIBIT-DOWNLOAD
class-map type inspect match-any CLASS-INSPECT-ANY-P2P
 match protocol gnutella signature
 match protocol kazaa2 signature
 match protocol fasttrack signature
 match protocol bittorrent signature
class-map type inspect match-all CLASS-INSPECT-P2P
 match class-map CLASS-INSPECT-ANY-P2P
class-map type inspect http match-all CLASS-HTTP-TORRENT-ANNOUNCE
 match  request method get
 match  request arg regex REGEX-TORRENT-ANNOUNCE
class-map type inspect match-any CLASS-INSPECT
 description *** Inspection for Protocols ***
 match protocol ftp
 match protocol ftps
 match protocol tftp
 match protocol smtp
 match protocol pop3
 match protocol dns
 match protocol https
 match protocol http
 match protocol tcp
 match protocol udp
 match protocol icmp
class-map type access-control match-all CLASS-ACCESS-TORRENT-DHT-OUTGOING
 match field UDP length range 95 190
 match start UDP payload-start offset 0 size 190 string "d1:ad2:id20:"
 match field UDP dest-port range 1025 65535
class-map type stack match-all CLASS-STACK-IP-UDP
 description *** Stack: [IP [UDP ... ]] ***
 match field IP protocol eq 0x11 next UDP
class-map type inspect http match-any CLASS-HTTP-PORT-MISUSE
 match  request port-misuse p2p
 match  req-resp protocol-violation
class-map type access-control match-all CLASS-ACCESS-TORRENT-BROADCAST
 match field UDP dest-port eq 6771
 match start UDP payload-start offset 0 size 256 string "Infohash"
!
policy-map type inspect http POLICY-HTTP
 class type inspect http CLASS-HTTP-TORRENT-ANNOUNCE
  reset
  log
 class type inspect http CLASS-HTTP-PORT-MISUSE
  reset
 class type inspect http CLASS-HTTP-TORRENT-PROHIBIT-DOWNLOAD
  reset
  log
policy-map type inspect INSIDE->INTERNET
 class type inspect CLASS-INSPECT-P2P
  drop
 class type inspect CLASS-INSPECT-HTTP
  inspect 
  service-policy http POLICY-HTTP
 class type inspect CLASS-INSPECT
  inspect 
 class class-default
  drop
policy-map type access-control POLICY-FILTER
 class CLASS-ACCESS-TORRENT-DHT-OUTGOING
   log
   drop all
 class CLASS-ACCESS-TORRENT-BROADCAST
   log
   drop all
policy-map type access-control POLICY-STACK
 class CLASS-STACK-IP-UDP
  service-policy POLICY-FILTER
!
zone security INSIDE
 description *** LAN ***
zone security INTERNET
 description *** Internet ***
!
zone-pair security INSIDE->INTERNET source INSIDE destination INTERNET
 service-policy type inspect INSIDE->INTERNET
!
interface GigabitEthernet0/0
 description *** LAN ***
 zone-member security INSIDE
 ip nat inside
 service-policy type access-control input POLICY-STACK
!
interface GigabitEthernet0/1
 description *** Internet ***
 zone-member security INTERNET
 ip nat outside
!

add action=drop chain=forward comment="TORRENT No 1: Classic non security torrent" disabled=no p2p=all-p2p
add action=drop chain=forward comment="TORRENT No 2: block outgoing DHT" content=d1:ad2:id20: disabled=no dst-port=1025-65535 packet-size=95-190 protocol=udp
add action=drop chain=forward comment="TORRENT No 3: block outgoing TCP announce" content="info_hash=" disabled=no dst-port=2710,80 protocol=tcp
add action=drop chain=forward comment="TORRENT No 4: prohibits download .torrent files. " content="\r\nContent-Type: application/x-bittorrent" disabled=no protocol=tcp src-port=80
add action=drop chain=forward comment="TORRENT No 5: 6771 block Local Broadcast" content="\r\nInfohash:" disabled=no dst-port=6771 protocol=udp