I have configured Routing and Remote Access Service in Windows Server 2003 as the VPN server. VPN users are defined in Active Directory which is running on this server too.

How i can configure the server to give each user a limited download size (for example 1GB) and does not authenticate them when they exceeds their download quota.

The VPN server should also disconnect the users that reach their quota.

Update: Apparently a third-party RADIUS server could provide this feature. One solution I have found is TekRADIUS but it is commercial. FreeRADIUS is a open-source free RADIUS server but I am not sure if it could these kind of features.

  • 1
    interesting question, but I'm curious: why would you want to cap users after a given quota of downloading? Might rate-limiting be easier? – warren Aug 3 '10 at 17:27
  • 1
    I haven't seen any options for this in Windows 2003, and I would be surprised it they had that kind of functions built-in. – tore- Aug 4 '10 at 12:46
  • @warren: The download rate is already limited for users. Our ISP enforces a limited download quota for us (200GB per month), so we have to limited download quota for users too. – Isaac Aug 6 '10 at 15:10
  • @tore, So is there any other Microsoft product for this? Is there any opensource software for this which be compatible with Win2003? – Isaac Aug 6 '10 at 15:11
  • rate-limiting to 75 kbps (if my math is right) would force you to not exceed the 200GB per month cap your ISP has leveled – warren Aug 9 '10 at 2:29

This may be possible by imposing policies and / or restrictions on the network level for IP addresses allocated to the VPN.

That said, here's another thought: if you have your VPN configured right now so that when users are connected, ALL traffic (including outside sites such as google.com etc.) gets routed through the VPN, you might be doing it wrong.

What you can do instead is uncheck the option on the user side to "use the default gateway on the remote network" (something along those lines) so that any traffic NOT intended for VPN ip address / DNS names will get routed through the user's local gateway and therefore around the VPN. HUGE savings in bandwidth if your users tend to do a lot of Internet browsing / downloading.

A lot of corporations, especially big ones, tend to force users to use the remote gateway which not only caps the user's bandwidth (because of the corporate limitations & extra hops), but also restricts the user's access to his own local network i.e. if working from home.

  • Users get their internet access throught VPN. Although this is not a good configuration (using VPN server to provide internet access), I have no control over it and it is not possible to change this. I just want to limited download quota for VPN users. – Isaac Aug 6 '10 at 15:15

No way to do that with operating system features. RRAS is targetting corporate use - your features sound more like you want to sell something like anonymous surfing via a VPN tunnel, so your traffic is "relevant". This is a very special use case - and thus one MS does not support. For corporate use you want none of this in place.

I would suggest you retire the RRAS solution, put in a Mikrotik router for less than 50 pounds and do itthere ;) It CAN do such things - it is a router / access point for internet providers, not something for busineses with limtied features like Microsoft.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.