How do I apply a traffic limit to those connecting from a specific port with iptables or tc?

Question

To my CentOS server, TCP connection is provided over port 643 and UDP connection is provided over port 6194. I want to add 1 hour drop rule to each IP address that consumes 50MB traffic from each of these ports.

Can I do this using iptables or tc? If I can how do I do it? I don't know enough about the subject, can you help me please?

Answer 1

It is possible to limit incoming and outgoing bandwidth and latency with tc (Traffic Control). This means you can control the throughput, the data amount over time only.

According your description for 50MB/hr you would need to set something like 125kBps for your rate. Since it is bandwidth limitation to make sure that only a specific amount of traffic can be used, there is no time limitation.

Further Questions and Answers on this topic are

• Limiting interface bandwidth with tc
• Limit network bandwith for an IP
• How to limit network bandwidth

A more Advanced Solution could be

• Rate limit network but allow bursting per TCP connection before limiting

Even if it is possible to cut of TCP/IP connections via in example cutter tool or set block time with iptables, I am not aware of any production ready solution for controlling the time of a network session. You may also have a look into wondershaper or trickle.