Nat – How to connect to P2P clients behind a router

First, I don't think you are going to be able to do a good job of this on a broadband router. You probably need to look at setting up a Linux box to act as a proxy firewall router. Plus, if you do this on a computer you can run a cache which will save you bandwidth since pages visited by many users will only need to be downloaded once.

Blocking P2P tends to get very difficult. Most protocols these days tend to be very good at getting around the firewall.

• Setup a firewall that by default denies any outgoing requests. Yes, this is very harsh, but if you really want block things this is a cheap way to start
  • you will need to probably explicitly add rules for any servers that are hosted within your network.
• Setup an HTTP proxy (e.g. squid), and all the browsers to use the proxy server.
• Subscribe to a blacklist (e.g. 1, 2) service and make sure you prohibit any proxies.
• Setup something like srg or sarg to produce reports per user/computer about who is visiting what, and how much bandwidth they are using. Give the administration the ability to view this information.
• Use the controls inside your proxy server to throttle computers (squid delay_pools)
• Setup a procedure for trusted users to get around the default deny firewall policy. (But still keep logs)

I know the above is very heavy-handed, but it will block almost all P2P traffic, and isn't particularly difficult to implement.

Please see these related questions:

• Using Linux IPTables, How to block torrents or any P2P protocols?
• block Torrent through firewall
• How can I block LimeWire on my corporate network?

OpenDPI, L7-filter and IP2P block P2P. Also, block 6969 6880-6890 port. And you can shape traffic to high port(>20000) by connlimit or tc.