Let me preface this by saying that I have a bit of a strange network.
LAN 1 router: 10.0.0.254/24, Internet via DSL on 10.0.0.254. LAN 2 router: 172.16.2.254/24, default gateway: 10.0.0.254 (LAN 2 is a private link to another location, which uses our feed for Internet)
The router at LAN 2 unfortunately NAT's all traffic from 172.16.2.0/24. I can't change this router - NAT cannot be disabled.
Assuming the only router I have control over is LAN 1 (it's a linux box): How can I log usage (destination IP+Port) against a user? I used to associate users by MAC address, but with this other router now the original MAC will be obscured - likewise the original IP is lost.
I haven't seen any evidence that 802.1X authentication works on anything but the network layer, so that also appears to be out.
The only option that appears left to me is to use a SOCKS proxy and require all clients configure themselves to use that, however that too has its pitfalls (limited client support, only handles TCP and UDP, increases CPU utilization on the router).
Is there anything I have missed? How can I approach this problem?