I've got a friend who has a "rent-by-room" property and includes internet access as part of this. However some tenants are somewhat hogging the internet (i.e. constantly downloading). I was wondering if anyone knows of a fairly easy way of rate limiting each connection to make the system more equitable. A preferred solution would be a cheap piece of hardware or some sort of Linux "appliance". I would rather not have to get an iptables headache if this is avoidable.

6 Answers 6


what you're looking for is "traffic shaping"

According to monowall's feature page, traffic shaping is a standard feature. I don't see an easy to find feature page for Smoothwall, but it's also highly recommended and I would expect it to likely include a similar feature.

  • Certainly Smoothwall includes traffic shaping in the form of its QOS settings but this is not per user, so is unsuitable for Alister's friend. Oct 1, 2009 at 4:50
  • To get a true "per user" solution, you're going to have to either configure some form of authentication like 802.1x, or rely on the internal source address for shaping. I've done something kinda similar for our first round of wireless using freeradius and chillispot, but it was more of an accounting for traffic versus real traffic shaping. Oct 1, 2009 at 20:58

Depending on the appliance you go with, you may be able to apply QoS rules by IP Address or switchport.

Setting up DHCP with reservations for each machine, then targeting specific machines with a QoS Rule on their IP address may be the easiest way to go.

As far as appliances go, Zeroshell seems promising, and delivers its distribution (Linux-based with a web frontend and ssh) in different forms, including LiveCDs and VMWare appliances.

Full disclosure: I'm no way affiliated with ZeroShell, but I'm considering implementing it in the house I'm currently living at as a router/default gateway/DHCP server/QoS Rules/VLAN Routing. Fun stuff!


Actually I think in this particular case of "some tennants are somewhat hogging the internet (i.e. constantly downloading)" I think its safe to assume that QoS would actually help a great deal. Give web and/or VoIP traffic a preference over download traffic, etc.

All that aside, I think pfSense might be a solution for you as I believe it can give you some pretty granular control over things.


If nothing else... a cheap managed switch (from eBay, etc) would probably do the trick. ;-)

Hope this helps!

  • 1
    Web traffic is not always distinguishable over download traffic. And I have never found a cheap managed switch that will shape network traffic by port. I have never found expensive switches that do it, it is generally built into Firewall/Router type devices.
    – scotthere
    Oct 1, 2009 at 5:25
  • I agree with you about trying to distinguish traffic. Every once in a while you can get lucky though using QoS. ;-) As for traffic shaping by port, Ive seen some Cisco products do this. You have to apply a bandwidth policy. If I recall there are 2 options, one guarantees bandwidth, the other guarantees bandwidth, plus allows usage of unused bandwidth.
    – KPWINC
    Oct 1, 2009 at 15:39

This question always opens up a can of worms. This is because traffic shaping is easiest done by IP address but doing it by IP makes it fairly easy to circumvent. There's no reason the user can't use a switch and have multiple machines or multiple NIC's abusing the bandwidth. And is there wireless in this building? Is it coming from access points or a router? If your wireless is on a separate router from the wired then that entire subnet will have to share the limited bandwidth. This is why it's best to place each room in their own VLAN and set the equipment to limit each VLAN to a certain amount of ingress and egress traffic. How? With expensive equipment.

What I would do is spend a few hundred bucks on a SOHO router/firewall that can do rudimentary limiting by IP. It's not perfect but it's simple. I like the boxes from DrayTek because, for me, they have been pretty solid routers at a reasonable price.


I just noticed on freshmeat a program called Untangle. It looks like you can download it for free for home use and run it on a Windows box. The wiki page for Quality of Service lists this relevant bullet point:

  • Enforces fair sharing of the Internet among multiple users.

Sounds like it might work for what you want.


If you don't mind installing an additional PC to act as a bridge on the network, this software may be of help.


I'm using SPBWM with my cable connection to limit the available bandwidth on a per IP bases.

Here is a diagram of my network.


I have a rule for each address on my subnet, that limits bandwidth to 1Mbit/256k.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .