4

I have configured Routing and Remote Access Service in Windows Server 2003 as the VPN server. VPN users are defined in Active Directory which is running on this server too.

How i can configure the server to give each user a limited download size (for example 1GB) and does not authenticate them when they exceeds their download quota.

The VPN server should also disconnect the users that reach their quota.

Update: Apparently a third-party RADIUS server could provide this feature. One solution I have found is TekRADIUS but it is commercial. FreeRADIUS is a open-source free RADIUS server but I am not sure if it could these kind of features.

Improve this question
5
  • 1
    interesting question, but I'm curious: why would you want to cap users after a given quota of downloading? Might rate-limiting be easier?
    – warren
    Aug 3, 2010 at 17:27
  • 1
    I haven't seen any options for this in Windows 2003, and I would be surprised it they had that kind of functions built-in.
    – tore-
    Aug 4, 2010 at 12:46
  • @warren: The download rate is already limited for users. Our ISP enforces a limited download quota for us (200GB per month), so we have to limited download quota for users too.
    – Isaac
    Aug 6, 2010 at 15:10
  • @tore, So is there any other Microsoft product for this? Is there any opensource software for this which be compatible with Win2003?
    – Isaac
    Aug 6, 2010 at 15:11
  • rate-limiting to 75 kbps (if my math is right) would force you to not exceed the 200GB per month cap your ISP has leveled
    – warren
    Aug 9, 2010 at 2:29

2 Answers 2

Reset to default
1

This may be possible by imposing policies and / or restrictions on the network level for IP addresses allocated to the VPN.

That said, here's another thought: if you have your VPN configured right now so that when users are connected, ALL traffic (including outside sites such as google.com etc.) gets routed through the VPN, you might be doing it wrong.

What you can do instead is uncheck the option on the user side to "use the default gateway on the remote network" (something along those lines) so that any traffic NOT intended for VPN ip address / DNS names will get routed through the user's local gateway and therefore around the VPN. HUGE savings in bandwidth if your users tend to do a lot of Internet browsing / downloading.

A lot of corporations, especially big ones, tend to force users to use the remote gateway which not only caps the user's bandwidth (because of the corporate limitations & extra hops), but also restricts the user's access to his own local network i.e. if working from home.

Improve this answer
1
  • Users get their internet access throught VPN. Although this is not a good configuration (using VPN server to provide internet access), I have no control over it and it is not possible to change this. I just want to limited download quota for VPN users.
    – Isaac
    Aug 6, 2010 at 15:15
1

No way to do that with operating system features. RRAS is targetting corporate use - your features sound more like you want to sell something like anonymous surfing via a VPN tunnel, so your traffic is "relevant". This is a very special use case - and thus one MS does not support. For corporate use you want none of this in place.

I would suggest you retire the RRAS solution, put in a Mikrotik router for less than 50 pounds and do itthere ;) It CAN do such things - it is a router / access point for internet providers, not something for busineses with limtied features like Microsoft.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .