Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can anyone provide the tc command to limit upload bandwidth per user in Debian Lenny?

I found that to mark packets per user with iptables I can use the following command

iptables -t mangle -A OUTPUT -p tcp -m owner --uid-owner testuser -j MARK --set-mark 500

but I have no idea how to use tc


by running following commands, i managed to limit testuser upload bandwidth to 10Mbit

iptables -t mangle -N HTB_OUT
iptables -t mangle -I POSTROUTING -j HTB_OUT
iptables -t mangle -A HTB_OUT -j MARK --set-mark 30
iptables -t mangle -A HTB_OUT -m owner --uid-owner testuser -j MARK --set-mark 10

tc qdisc replace dev eth0 root handle 1: htb default 30
tc class replace dev eth0 parent 1: classid 1:1 htb rate 10Mbit burst 5k
tc class replace dev eth0 parent 1:1 classid 1:10 htb rate 10Mbit ceil 10Mbit
tc qdisc replace dev eth0 parent 1:10 handle 10: sfq perturb 10
tc filter add dev eth0 parent 1:0 prio 0 protocol ip handle 10 fw flowid 1:10

now the problem is, i do not want to limit testuser's FTP bandwidth but by running above commands FTP speed also limited to 10Mbit.


share|improve this question
A similar question was asked here before The answer suggested to look up the LARTC. There is no specific example, but the full NAT example might be helpful. –  Dmitri Chubarov Dec 9 '12 at 15:49
Thanks i found a solution for limit upload bandwidth per user with TC and iptables commands. but now the problem is, it limit the user's FTP speed too :( –  Gihan Lasita Dec 9 '12 at 16:13
Of course it does. –  Michael Hampton Dec 9 '12 at 16:39
may be is there way to use two rules and set different speed for FTP port 21 only? –  Gihan Lasita Dec 9 '12 at 16:46
sure, use two iptables rules, and match them on different port numbers. –  Sirex Dec 9 '12 at 23:21
add comment

1 Answer

iptables -A OUTPUT -m conntrack --connbytes from:to --connbytes-mode packets/bytes/avgpkt -m owner --uid-owner owner -J DROP

Other possibilities -m connlimit -m hashlimit

share|improve this answer
can you please explain what the above command do? i have no idea –  Gihan Lasita Dec 10 '12 at 10:08
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.