[SOLVED] iptables, byte count and quota

intmail01 · 10-05-2016, 04:55 PM

Hello,

I try to limit my internet transfert by using "quota" with iptables.

These are my rules to limit 10MB of data transfert:

Code:

iptables -A OUTPUT -p tcp -m multiport -m quota --dport 80,443 --quota 10240000 -j ACCEPT

Code:

iptables -A OUTPUT -p tcp -m multiport --dport 80,443 -j DROP

When checking my transfert by using "iptables -L output -v", the byte column doesnot match the ammount given by my router.
iptable shows 2M, wehreas router and ISP tell me 10M (input + output). There is too much difference.

Could some one tell what is wrong.

unSpawn · 10-06-2016, 02:49 PM

Quote:

Originally Posted by intmail01

When checking my transfert by using "iptables -L output -v", the byte column doesnot match the ammount given by my router.
iptable shows 2M, wehreas router and ISP tell me 10M (input + output). There is too much difference.

What we have here is two iptables rules without their corresponding location in the rule set (as in full 'iptables-save' output) and no "evidence" of the actual output of 'iptables -t filter -nvxL OUTPUT;' and output of what exactly your router and ISP measure and "tell" you. Also note traffic may not be symmetrical, for example you browsing web sites or streaming music tends to be highly asymmetrical as a small request results in downloading huge amounts of data. Until there's more and comparable data there's no way telling what's wrong (if there actually is).

intmail01 · 10-29-2016, 01:51 PM

This is the right commands to limit network by using quota:

Code:

iptables -i wlan0 -A INPUT   ! -s 192.168.8.1  -m quota --quota 1024000 -j ACCEPT -c 0 0;
iptables -i wlan0 -A INPUT   ! -s 192.168.8.1  -j DROP;

wlan0 is the name of the interface which is connected to the router. The address of the router is 192.168.8.1
There are also data output which are about 10% of my input:

Code:

iptables -o wlan0 -A OUTPUT   ! -s 192.168.8.1  -m quota --quota 102400 -j ACCEPT -c 0 0;
iptables -o wlan0 -A OUTPUT   ! -s 192.168.8.1  -j DROP;