I've got a friend who has a "rent-by-room" property and includes internet access as part of this. However some tenants are somewhat hogging the internet (i.e. constantly downloading). I was wondering if anyone knows of a fairly easy way of rate limiting each connection to make the system more equitable. A preferred solution would be a cheap piece of hardware or some sort of Linux "appliance". I would rather not have to get an iptables headache if this is avoidable.
what you're looking for is "traffic shaping"
According to monowall's feature page, traffic shaping is a standard feature. I don't see an easy to find feature page for Smoothwall, but it's also highly recommended and I would expect it to likely include a similar feature.
Depending on the appliance you go with, you may be able to apply QoS rules by IP Address or switchport.
Setting up DHCP with reservations for each machine, then targeting specific machines with a QoS Rule on their IP address may be the easiest way to go.
As far as appliances go, Zeroshell seems promising, and delivers its distribution (Linux-based with a web frontend and ssh) in different forms, including LiveCDs and VMWare appliances.
Full disclosure: I'm no way affiliated with ZeroShell, but I'm considering implementing it in the house I'm currently living at as a router/default gateway/DHCP server/QoS Rules/VLAN Routing. Fun stuff!
Actually I think in this particular case of "some tennants are somewhat hogging the internet (i.e. constantly downloading)" I think its safe to assume that QoS would actually help a great deal. Give web and/or VoIP traffic a preference over download traffic, etc.
All that aside, I think pfSense might be a solution for you as I believe it can give you some pretty granular control over things.
If nothing else... a cheap managed switch (from eBay, etc) would probably do the trick. ;-)
Hope this helps!
This question always opens up a can of worms. This is because traffic shaping is easiest done by IP address but doing it by IP makes it fairly easy to circumvent. There's no reason the user can't use a switch and have multiple machines or multiple NIC's abusing the bandwidth. And is there wireless in this building? Is it coming from access points or a router? If your wireless is on a separate router from the wired then that entire subnet will have to share the limited bandwidth. This is why it's best to place each room in their own VLAN and set the equipment to limit each VLAN to a certain amount of ingress and egress traffic. How? With expensive equipment.
What I would do is spend a few hundred bucks on a SOHO router/firewall that can do rudimentary limiting by IP. It's not perfect but it's simple. I like the boxes from DrayTek because, for me, they have been pretty solid routers at a reasonable price.
I just noticed on freshmeat a program called Untangle. It looks like you can download it for free for home use and run it on a Windows box. The wiki page for Quality of Service lists this relevant bullet point:
- Enforces fair sharing of the Internet among multiple users.
Sounds like it might work for what you want.
If you don't mind installing an additional PC to act as a bridge on the network, this software may be of help.
I'm using SPBWM with my cable connection to limit the available bandwidth on a per IP bases.
Here is a diagram of my network.
I have a rule for each address on my subnet, that limits bandwidth to 1Mbit/256k.