We have squid installed and all the traffic is through squid, we are using squidguard for packet filtering and everything seems working, but i am not able to filter any content that users accessing through vpn. is it possible to monitor vpn traffic using any tool? or is it possible using by checking logs of vpn client

  • 1
    Making this impossible is kind of the point of VPNs (at least that's one major motivation to use a VPN). – Sven Sep 20 '17 at 16:53

The way a VPN works is establishing a connection between the client and the remote server. With any modern VPN, the established tunnel is encrypted. Thus, the traffic is encrypted when it runs through the hops that brings it to the server. Thus, as suggested in the comments, this is impossible at any hops but the client and the server themselves, including at your router.

So, what are your options:

if you need clients to use vpn, but you want to filter anything:

  • You can install an application to your clients, in order to monitor and/or limit what they do with the browser, and other applications too. I won't suggest anything, as I just know commercial solutions for this, and don't want to be for them an "advisor for free". There are solutions for this at about €3000 for 50 users, just to hint you with a potential cost of such a product.

if you don't need clients to use vpn, and you want to filter anything:

  • You can just disallow vpn protocols in the device acting in your network as router. It should probably be the same running squid, in a small env.

Honestly I don't see any other option for your inquiry.

And coming to your questions:

Is it possible to monitor vpn traffic using any tool?

Generally not. If it's possible with the VPN your clients are using, you should swap right now to one based on a non vulnerable application, authentication mechanism or protocol!! (as far as I know, those three can be the causes that leads to a VPN beeing vulnerable)

or is it possible using by checking logs of vpn client

I don't think that any VPN provides such log level. If you provide more details I'll edit the answer after doing some research, but I strongly doubt this part of the answer will turn into a YES.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.