Monitor and limit internet bandwidth per network client

Question

On a linux server with dhcpd that acts as the internet gateway for all clients of the LAN: how can I monitor the internet usage based on IP/MAC address, and deny internet access if a certain bandwidth consumption has been exceeded?

Solution

On Linux, you could get this done with some scripting:

• Create firewall rules with iptables so that all bandwidth for each client passes through a separate rule. The firewall subsystem in the kernel will count network packets and bytes that a particular rule matched. You can see the counters if you run iptables -vL. You might want to use the -n option too, for performance: iptables -vnL
• Write a script that runs from cron and which checks how much data has been used by every client. Then if it's over a particular amount, have the script modify the firewall so that the client can not access the Internet anymore

Note that iptables' counters get reset when the firewall is cleared (i.e., after reboot, or when you do iptables -F. As such, you might want to have the script state its conclusions to some database or something.

Comments

[Usi]

Which distro are you using? Some distros provide gui tools for this.

[ig-dev]

@Magus In my case it's debian 8. I use i3 and XFCE desktop.

[Wouter Verhelst]

I believe the question was about bandwidth consumption (i.e., number of bytes sent over a large period of time, like a month or so) rather than immediate bandwidth usage. In that case, it's not a duplicate

[Usi]

Yes, but I'm wary of using iptables to do this. Your method will produce network errors on the user's end.

[Usi]

The top answer gives a way to do this without stopping the connection. Not a duplicate, but it answers the question.

[Wouter Verhelst]

I believe that's what the OP wants, but hey

[Usi]

Ok. I agree with you. I'm voting your answer up.

[Usi]

He did literally ask for them to be booted off in that case. I don't think it's a good idea but yes that's what he wants.

[Wouter Verhelst]

I agree with that, but I'm only answering questions :-)