Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been trying to set up traffic quotas for users on a shared server and i believe [with my limited knowledge] that iptables --quota and ports which have been selected for each user [--dport] is the way to do this...

iptables -A OUTPUT --dport 1,2,3,4... --quota 123412341234 -j ACCEPT
iptables -A OUTPUT --dport 1,2,3,4... -j DROP

I think something like this would work to limit the traffic [and reset every month] but its only for traffic going out.

  • Is there something I could do to combine -A OUTPUT and -A INPUT into one quota?
  • Or, is there a different method I could use to achieve the same thing more efficiently?

OS is debian squeeze


share|improve this question
Let me ask you a question first: Do you want the quota to apply to the sum of INPUT + OUTPUT? – pepoluan Mar 9 '11 at 4:04
yes, if that's possible that would be perfect. – Nick Mar 9 '11 at 18:01
up vote 1 down vote accepted

If you want to apply quota to both incoming and outgoing, you'd do it like this:

-A OUTPUT -p tcp --sport $PORTNUM_1 -g filter_quota_1
-A OUTPUT -p tcp --sport $PORTNUM_2 -g filter_quota_2
<other OUTPUT rules for other users>
-A INPUT  -p tcp --dport $PORTNUM_1 -g filter_quota_1
-A INPUT  -p tcp --dport $PORTNUM_2 -g filter_quota_2
<other INPUT rules>
-A filter_quota_1 -m quota --quota $QUOTA_1 -g chain_where_quota_not_reached
-A filter_quota_1 -g chain_where_quota_is_reached
-A filter_quota_2 -m quota --quota $QUOTA_2 -g chain_where_quota_not_reached
-A filter_quota_2 -g chain_where_quota_is_reached
<other filter_quota_N chains>

When you want to reset quota #N, you'd do iptables -F filter_quota_N and then re-populate filter_quota_N.

Since the rules are mostly similar, you really should consider automation with bash (or other scripting language of your choice)

share|improve this answer
Thank you so much! - I could simply replace "-g chain_where_quota_is/not_reached" with a simple "-j ACCEPT/DROP" to start with something simple right? - Also what's the reason for "-p tcp", would there be any reason to include udp too? – Nick Mar 10 '11 at 22:19
@Nick where_quota_not_reached can be replaced with ACCEPT. but I suggest having a LOG+DROP pair in where_quota_is_reached, so you can easily find out if a user has hit her quota. the -p tcp is necessary to use --dport and --sport. UDP traffic generally is negligible, but if you want to monitor it, too, add similar rules but replacing -p tcp with -p udp – pepoluan Mar 10 '11 at 23:43
Thanks for all your help, can't vote you up though :/ – Nick Mar 11 '11 at 20:34
@Nick heh, no problem, don't lose your sleep over it :) ... glad to be of help :) – pepoluan Mar 12 '11 at 3:24
No need to flush the chain and repopulate it ... just zero out the counters and you should be done. – user325735 Dec 5 '15 at 22:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.