I have D-Link Router DSL-2730U that support busybox OS and iptables version 1.4.0

I managed successfully to block the host for being connect to the internet using the following command

block by ip address

iptables -I  FORWARD -d -j DROP

Or By mac source

iptables -I FORWARD -m mac --mac-source bc:20:a4:ff:79:80 -j DROP

The only problem now i have is trying to limit transfer speed rate (upload & download) to be only serve 30/kbps by MAC Address using iptables

I tried to make iptables rule like

iptables -I FORWARD -m mac --mac-source bc:20:a4:ff:79:80 -m state --state RELATED,ESTABLISHED -m limit --limit 100/second --limit-burst 30 -j ACCEPT

But it didn't work

Note : this router cannot modify , delete or add any files . i cannot make a bash or script file inside the router run , and unfortunately the iptables connlimit module not supported in this iptables version too

  • It doesn't make much sense to call a source rule (--mac-source) an alternative to a destination rule (-d)... You can limit the bandwidth with traffic shaping (tc), too, but if connlimit isn't available that raises the question whether tc is. – Hauke Laging Feb 8 '15 at 11:23
  • 1
    --limit doesn't do what you appear to think it does, and you can't limit traffic speed with iptables. Instead use tc to manage traffic shaping. Have a search for myshaper, amongst other utilities. – roaima Feb 8 '15 at 13:14

You can limit speed by iptables, like this.

iptables -I FORWARD -d -j DROP
iptables -I FORWARD -d -m limit --limit 100/sec -m state --state ESTABLISHED -j ACCEPT

But in not very convenient, because "limit" limits by packets, not bytes per seconds. If we suppose 1 packet = 1500 bytes, 100 packets/s = 150 KB/s. But some protocols with smaller packets will work slower. Also this may cause sudden disconnections.

However, if you must limit traffic in router, there is not much choice, often iptables is the only utility on router to do this.

Note that, "limit" and "drop" rules should be in right order. First rule limits and allow traffic, second rule blocks traffic over the limit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.