Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an OpenVPN server and I want it to log each users bandwidth. I'm looking to log the bytes_send and bytes_received. This is stored in the OpenVPN status file, but I can't easily read that file since it's always changing.

I could use a client-disconnect script, but how would I pass the bandwidth used to it? I'd rather not use this as the bandwidth will only be updated when a client disconnects. What if he just never does so? Right, then he can use as much bandwidth as he likes.

So, how can I log the bandwidth used per client?

share|improve this question
    
You may look at Sawmill and see if that can pull the info for you: sawmill.net/formats/openvpn.html –  TheCleaner Dec 18 '12 at 21:30
1  
I would imagine you could setup a script that periodically grabs the counters from the status file, then log the results into an RRD file. Past that, ignore the fact that this is a VPN. Just log the traffic the exact same way you would log any traffic. –  Zoredache Dec 18 '12 at 21:42

1 Answer 1

you can set up iptables rules for each of the users:

iptables -A FORWARD -i tun0 -s 10.0.0.1 -j ACCEPT
iptables -A FORWARD -o tun0 -d 10.0.0.1 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.0.0.2 -j ACCEPT
iptables -A FORWARD -o tun0 -d 10.0.0.2 -j ACCEPT
...

and periodically [eg every 15 minutes] collect statistics from them by running:

iptables -nvxL FORWARD > stats

and clear them out by:

iptables -Z

you will have to parse the stats file and save it eg to a database after each execution.

you might want to create separate chain for the traffic coming to/from the tunnel device and have all vpn'ed traffic pass by it first. then you would parse stats just for that tunnel.

also keep in mind that this solution will cause additional overhead on your cpu compared with situation when you use conntrack module and accept all packets belonging to established, related connections.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.