2

I've been trying to set up traffic quotas for users on a shared server and i believe [with my limited knowledge] that iptables --quota and ports which have been selected for each user [--dport] is the way to do this...

iptables -A OUTPUT --dport 1,2,3,4... --quota 123412341234 -j ACCEPT
iptables -A OUTPUT --dport 1,2,3,4... -j DROP

I think something like this would work to limit the traffic [and reset every month] but its only for traffic going out.

  • Is there something I could do to combine -A OUTPUT and -A INPUT into one quota?
  • Or, is there a different method I could use to achieve the same thing more efficiently?

OS is debian squeeze

Thanks.

Improve this question
2
  • Let me ask you a question first: Do you want the quota to apply to the sum of INPUT + OUTPUT?
    – pepoluan
    Mar 9, 2011 at 4:04
  • yes, if that's possible that would be perfect.
    – Nick
    Mar 9, 2011 at 18:01

1 Answer 1

Reset to default
5

If you want to apply quota to both incoming and outgoing, you'd do it like this:

-A OUTPUT -p tcp --sport $PORTNUM_1 -g filter_quota_1
-A OUTPUT -p tcp --sport $PORTNUM_2 -g filter_quota_2
<other OUTPUT rules for other users>
-A INPUT  -p tcp --dport $PORTNUM_1 -g filter_quota_1
-A INPUT  -p tcp --dport $PORTNUM_2 -g filter_quota_2
<other INPUT rules>
-A filter_quota_1 -m quota --quota $QUOTA_1 -g chain_where_quota_not_reached
-A filter_quota_1 -g chain_where_quota_is_reached
-A filter_quota_2 -m quota --quota $QUOTA_2 -g chain_where_quota_not_reached
-A filter_quota_2 -g chain_where_quota_is_reached
<other filter_quota_N chains>

When you want to reset quota #N, you'd do iptables -F filter_quota_N and then re-populate filter_quota_N.

Since the rules are mostly similar, you really should consider automation with bash (or other scripting language of your choice)

Improve this answer
5
  • Thank you so much! - I could simply replace "-g chain_where_quota_is/not_reached" with a simple "-j ACCEPT/DROP" to start with something simple right? - Also what's the reason for "-p tcp", would there be any reason to include udp too?
    – Nick
    Mar 10, 2011 at 22:19
  • @Nick where_quota_not_reached can be replaced with ACCEPT. but I suggest having a LOG+DROP pair in where_quota_is_reached, so you can easily find out if a user has hit her quota. the -p tcp is necessary to use --dport and --sport. UDP traffic generally is negligible, but if you want to monitor it, too, add similar rules but replacing -p tcp with -p udp
    – pepoluan
    Mar 10, 2011 at 23:43
  • Thanks for all your help, can't vote you up though :/
    – Nick
    Mar 11, 2011 at 20:34
  • @Nick heh, no problem, don't lose your sleep over it :) ... glad to be of help :)
    – pepoluan
    Mar 12, 2011 at 3:24
  • No need to flush the chain and repopulate it ... just zero out the counters and you should be done.
    – user325735
    Dec 5, 2015 at 22:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .