how to block and punish users who download bittorrent in LAN

block it

iptables -I FORWARD -s -i eth2 -j DROP

how to limit number of connections to server per second with iptables

# 2 hits per second per ip address

iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 1 --hitcount 2 -j DROP

iptables -A INPUT -p tcp --dport 443 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 443 -i eth0 -m state --state NEW -m recent --update --seconds 1 --hitcount 2 -j DROP

how to limit number of connections to our server per period of time with iptables

sample - allow 2 hits once every 3 seconds

iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 3 --hitcount 2 -j DROP

iptables slow down http and https

With:

-P INPUT DROP
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Websites on the server will response very slowly.

But if you add:

 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

 Websites will response fast as usual.