Fri Mar 20, 2015 10:13 pm
Short answer - you can't. Besides, I don't see the difference in his re-selling his connection to others and you reselling what you're purchasing. As long as he cannot receive more bandwidth than you sold him, then that's the end of it.
If you know he's doing this, and you can't stand the idea that he's getting money for this, then cancel his account or charge him more money.
With NAT, you can't really tell the difference between 3 browser windows on one computer, or 3 computers behind NAT with one browser window on each one. You could do deep application-layer inspection with gear that can monitor his browsing and use habits and guess the difference between him and his "customers" - but I imagine such software is either expensive or else difficult to properly manage.
If his "customers" are using their own routers to connect to his router, then you could use mangle table to reduce TTL to 2 before sending to your customers. This would stop any more routers from being behind his router unless he's technically savvy enough to recognize what you're doing and increase it with his own router.
Your final option is to limit his bandwidth to something so low that he cannot stand it, and when he complains, shrug your shoulders and say you do not know what is wrong - your service works for your other customers, etc.