Limits the kernel enforces
A customer's quota is an nftables quota object on their address. The packet that crosses it is dropped by the kernel; the panel is not in the data path.
bash <(curl -Ls https://raw.githubusercontent.com/AbolfazlTafakori/w-ui/main/install.sh)It asks four questions, then does the rest: packages, kernel forwarding, a check that this kernel can hold quota objects, an unprivileged service account, a hardened systemd unit, a certificate, and a w-ui command. Read what happens next.
The difference is where the limit is enforced. Most panels poll a byte counter every couple of seconds and disable the customer once the number crosses their quota. Between two polls the customer keeps transferring at full speed — roughly 25 MB of overshoot on a 100 Mbit link, 250 MB on a gigabit one. W-UI programs the limit into the kernel as an nftables quota object; the overshoot is one packet, whatever the link speed. How it works.