1

I have an OpenVPN server and I want it to log each users bandwidth. I'm looking to log the bytes_send and bytes_received. This is stored in the OpenVPN status file, but I can't easily read that file since it's always changing.

I could use a client-disconnect script, but how would I pass the bandwidth used to it? I'd rather not use this as the bandwidth will only be updated when a client disconnects. What if he just never does so? Right, then he can use as much bandwidth as he likes.

So, how can I log the bandwidth used per client?

2
  • You may look at Sawmill and see if that can pull the info for you: sawmill.net/formats/openvpn.html
    – TheCleaner
    Dec 18, 2012 at 21:30
  • 1
    I would imagine you could setup a script that periodically grabs the counters from the status file, then log the results into an RRD file. Past that, ignore the fact that this is a VPN. Just log the traffic the exact same way you would log any traffic.
    – Zoredache
    Dec 18, 2012 at 21:42

1 Answer 1

1

you can set up iptables rules for each of the users:

iptables -A FORWARD -i tun0 -s 10.0.0.1 -j ACCEPT
iptables -A FORWARD -o tun0 -d 10.0.0.1 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.0.0.2 -j ACCEPT
iptables -A FORWARD -o tun0 -d 10.0.0.2 -j ACCEPT
...

and periodically [eg every 15 minutes] collect statistics from them by running:

iptables -nvxL FORWARD > stats

and clear them out by:

iptables -Z

you will have to parse the stats file and save it eg to a database after each execution.

you might want to create separate chain for the traffic coming to/from the tunnel device and have all vpn'ed traffic pass by it first. then you would parse stats just for that tunnel.

also keep in mind that this solution will cause additional overhead on your cpu compared with situation when you use conntrack module and accept all packets belonging to established, related connections.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .