I have the following for iptables & tc but it limits the upload speed to 2Mbits once the quota of 1GB has been hit.

iptables -t mangle -A POSTROUTING -o eth0 -p tcp -m owner --uid-owner aaron -m quota --quota 1073741824 -j ACCEPT

iptables -t mangle -A POSTROUTING -o eth0 -p tcp -m owner --uid-owner aaron -j CLASSIFY --set-class 1:11

tc qdisc add dev eth0 root handle 1:0 htb default 99

tc class add dev eth0 parent 1:0 classid 1:1 htb rate 1024Mbit ceil 1024Mbit

tc class add dev eth0 parent 1:1 classid 1:11 htb rate 2Mbit ceil 2Mbit prio 2

tc qdisc add dev eth0 parent 1:11 handle 10: sfq perturb 10

It works perfectly well but after searching a lot and trying to setup proper rules I've failed miserably.

I simply need it to limit BOTH the upload & download combined. So regardless of the usage on each one, I need it to assign both the upload and download as one quota combined. Whether it be 1GB of download or 1GB of upload of 500MB each, I need it to have the quota at 1GB. And once the total of 1GB has been used, it should limit both the download and upload speed to 2Mbit.

The difficulty comes with handling the different packets as a combined total (PREROUTING & POSTROUTING).

Should I use iptables -N and use a chain of rules then assign that the quota?

Please help!

  • I'm a little confused as to what you're trying to achieve here. Can you explain the usage scenario. I've done this before and I think there may be a better way to go about it. – Matt Sep 1 '13 at 21:27
  • Essentially I'm trying to apply bandwidth caps for a user. I'm trying to limit user 'aaron' to 1GB of total traffic (either up/down). Once that limit is passed, I'd prefer to have it throttled to 2Mbit otherwise a REJECT is fine. I'm just trying to set a traffic cap. – whisky Sep 2 '13 at 1:54
  • Alright, so I found serverfault.com/questions/348658/… How to implement it with the throttling now using tc? – whisky Sep 2 '13 at 2:40
  • It does work with multiple users, so for now I'm using awk to extract the correct lines. Then based on the amount, a shell script would suspend the user or related (run via cron). Question though, is there are better way to do this without a shell script ie via tc or related? – whisky Sep 2 '13 at 4:08

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.