I have a Squid proxy server that controls all internet traffic for my network.

I need a way to stop users from downloading big files (say >50MB) in my network. I banned some famous ports (e.g. torrent) but some downloads are possible by HTTP port. Obviously I cannot ban port 80!

A simple solution is limiting maxmimum number of the simultaneous connections for each IP (e.g. 3 connections). It's possible in Squid with this config:

acl limitusercon maxconn 3
http_access deny ACCOUNTSDEPT limitusercon

But this solution has really bad impact in web browsing, because any smart browser get different parts of a website by several connections simultaneously to speedup web browsing. But if we have a maximum number of connections, the browsers will fail to get some parts and the website will be shown partially and some parts/images/frames will not be shown.

So, can we limit maximum number of persist connections? I think this policy will works: Specify Maximum number of connections that is alive for 10 seconds But Number of simultaneous connections for every IP is unlimited

But how can we implement this policy when Squid? With which config?


artifex and Tom Newton offered using a bandwidth-limiting approach to fight against downloaders.

But bandwidth-limiting in Squid has a shortcoming: It's static and cannot dynamically change. So a person has a limited bandwidth not matter how many people are using internet (maybe nobody!)

Also, this solution cannot help to stop people from downloading. They still can download but in a lower speed.

But if we find a way to terminate persist connections (or any connection that is alive more than a specific time), downloading big files will be almost impossible (always there is some way!)

  • Thanks for clearing that up. Not sure if delay pools can "cascade" spare bandwidth. That would be fun. There's some setting in squid to limit filesize.. or are these connections "tunnelled"? What's bad: users clobbering your bandwidth... or that they can do this at all? – Tom Newton Oct 27 '09 at 14:13
  • There was a project to patch in Dynamic Delay Pools back in 2003 i think. They seem to have vanished though, basic idea: if noone else is using internet, allocate spare bandwitdh to were its needed. – artifex Oct 29 '09 at 12:46

This wont solve the problem the way you purpose. But in a different way, limiting each host to a certain bandwith (not per request, but per host)

example taken from http://wiki.squid-cache.org/Features/DelayPools

acl only128kusers src
delay_pools 1
delay_class 1 3
delay_access 1 allow only128kusers
delay_access 1 deny all
delay_parameters 1 64000/64000 -1/-1 16000/64000

this specify that all clients have 512kbits to share but a single ip can only use 128kbits.

note that the values for delay_parameters above are in BYTES and not BITS.

|improve this answer|||||
  • 2
    You said: "I need a way to limit user downloads in my networks." I provided a soloution for that. I even said it wont solve the problem the way you wanted it. Sometimes, there are alternate soloutions that people haven't thought of. I tried to provide that. Anyhow, if this soloution is not applicable thats that. – artifex Oct 27 '09 at 8:18
  • 1
    I was going for alhough you asked A could A be solved by B? – artifex Oct 27 '09 at 8:33
  • 1
    Unfortunately "A" isn't likely to bring anything but pain - "B" is a good answer from where I sit - or is there a reason you can't limit bandwidth per-host? Certainly I have seen this used to great effect. – Tom Newton Oct 27 '09 at 10:29
  • @Tom Newton, @artifex - I add some details about this A and B and also fixed my question. Thanks anyway – Isaac Oct 27 '09 at 12:31

Have you tried: reply_body_max_size?

From the docs it sounds exactly like what you were asking:

This option specifies the maximum size of a reply body. It can be used to prevent users from downloading very large files, such as MP3's and movies.

Ergo, try adding the following to squid.conf:

reply_body_max_size 50 MB

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.