Blocking multiple connections from same IP address

Question

I want to allow only a single connection per machine on a linux gateway or in other words block multiple connections from same IP address. Actually I want to block internet download manager from eating up all the bandwidth of the network. Currently I am using iptables based firewall.

Thanks in Advance

Answer 1

You can use the iptables "connlimit" match extension, see the man page for iptables for more information.

Answer 2

If your intent is to block download managers which make multiple HTTP/S connections to the webserver to download same file with multiple connections and hence faster, you might like to disable "Chunked transfer encoding". Depending upon which web server you are using, you can find out how to disable that.

Answer 3

If your download manager is from a single/few IP address(es) or port(s), you can also consider using tc to manage that. What you can do is create two "channels", one with a guaranteed large bandwidth and the other with a small guaranteed bandwidth, but with the ability to borrow from the other "channel". For example:

tc qdisc add dev eth1 root handle 1: htb default 10

tc class add dev eth1 parent 1: classid 1:1 htb rate 4mbit ceil 4mbit
tc class add dev eth1 parent 1:1 classid 1:10 htb rate 3mbit ceil 4mbit
tc class add dev eth1 parent 1:1 classid 1:11 htb rate 1mbit ceil 4mbit

tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip src 10.2.1.100 flowid 1:11
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dst 10.2.1.100 flowid 1:11

This will guarantee 1Mbit for the traffic to/from 10.2.1.100, but it allow to use up to 4MBit if available, and guarantees 3MBit for the traffic for all the other hosts, or more if available.

The only problem is that tc documentation is not exactly good.