Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to allow only a single connection per machine on a linux gateway or in other words block multiple connections from same IP address. Actually I want to block internet download manager from eating up all the bandwidth of the network. Currently I am using iptables based firewall.

Thanks in Advance

share|improve this question

migrated from Jun 25 '10 at 11:20

This question came from our site for professional and enthusiast programmers.

You can use the iptables "connlimit" match extension, see the man page for iptables for more information.

share|improve this answer
+1 iptables can handle that. here is sample usage iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 3 -j REJECT --reject-with tcp-reset – risyasin Jun 25 '10 at 14:26

If your intent is to block download managers which make multiple HTTP/S connections to the webserver to download same file with multiple connections and hence faster, you might like to disable "Chunked transfer encoding". Depending upon which web server you are using, you can find out how to disable that.

share|improve this answer

If your download manager is from a single/few IP address(es) or port(s), you can also consider using tc to manage that. What you can do is create two "channels", one with a guaranteed large bandwidth and the other with a small guaranteed bandwidth, but with the ability to borrow from the other "channel". For example:

tc qdisc add dev eth1 root handle 1: htb default 10

tc class add dev eth1 parent 1: classid 1:1 htb rate 4mbit ceil 4mbit
tc class add dev eth1 parent 1:1 classid 1:10 htb rate 3mbit ceil 4mbit
tc class add dev eth1 parent 1:1 classid 1:11 htb rate 1mbit ceil 4mbit

tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip src flowid 1:11
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dst flowid 1:11

This will guarantee 1Mbit for the traffic to/from, but it allow to use up to 4MBit if available, and guarantees 3MBit for the traffic for all the other hosts, or more if available.

The only problem is that tc documentation is not exactly good.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.