On a public-facing web server, I'd like to limit the total bytes downloaded per IP address per day. For example, after a visitor downloaded 100MB, any additional requests would be dropped or rejected for the next 24 hours.

Is it possible to accomplish this using iptables alone? The connbytes, connlimit, hashlimit, quota, and recent options all look promising, but the man page plays its cards close to the vest (e.g., "quota - Implements network quotas by decrementing a byte counter with each packet. --quota bytes The quota in bytes.").

Would like to avoid using a proxy (like Squid) if possible.

  • Did you find a way? I'm after the same target (limiting "leechers"), preferably with something like mod_cband (Apache module; I could only establish quota per VHost with it – or "per IP" if I'd know that IP in advance).
    – Izzy
    Sep 21 '15 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.