any way to have log of users??

dhruvpandit

many users are misusing my bandwidth i.e. some are downloading torrents , some are spamming through vpn network.

but is there any log or some thing from which i can watch / i can get idea , that which user is connected at that time, or any user IP or so??

i am using different client config for all my clients. so if there is a way to log when a client connected and disconnected and whats his original IP, then pls tell me how to do that

maikcat

i am using different client config for all my clients. so if there is a way to log when a client connected and disconnected and whats his original IP, then pls tell me how to do that

yes from openvpn logs you can retrieve this kind of info..

but is there any log or some thing from which i can watch / i can get idea , that which user is connected at that time, or any user IP or so??

this is NOT openvpn job..

you can use a transparent proxy to pass all web traffic through it and filter it,
combined with ip tables you can restrict internet access to your users.

i have only see watchguard firewalls perfoming real time monitoring..
i am not aware for open source software that does something similar.

Michael.

dhruvpandit

maikcat wrote
i am using different client config for all my clients. so if there is a way to log when a client connected and disconnected and whats his original IP, then pls tell me how to do that

yes from openvpn logs you can retrieve this kind of info..

can you tell me how??

coz, my log file is not having any type of info of any users,
its showing total transfers only 🙁

maikcat

are you using certificates for your clients?

can you post your server config?

Michael.

dhruvpandit

here is server config

local xxx.xxx.xxx.xxx #- your_server_ip
port 53 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
crl-verify /etc/openvpn/easy-rsa/2.0/keys/crl.pem
server 1.2.3.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 4.2.2.1"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3

but in /etc/openvpn/1194.log is empty
and /etc/oepnvpn/easy-rsa/2.0/1194.log is like this

OpenVPN CLIENT LIST
Updated,Mon Nov 14 19:49:19 2011
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
demo5,117.198.200.176:53,121437877,816863062,Mon Nov 14 16:45:08 2011
client6,223.184.196.238:53,33066505,653363101,Mon Nov 14 18:41:36 2011
client19,27.60.32.7:53,42530381,933737053,Mon Nov 14 18:02:27 2011
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
1.2.5.30,client6,223.184.196.238:53,Mon Nov 14 19:49:18 2011
1.2.5.54,demo5,117.198.200.176:53,Mon Nov 14 19:49:18 2011
1.2.5.126,client19,27.60.32.7:53,Mon Nov 14 19:49:18 2011
GLOBAL STATS
Max bcast/mcast queue length,0
END

maikcat

use absolute path names for your logs,

you can also use openvpn control to access the managment console.

Michael.

dhruvpandit

maikcat wroteuse absolute path names for your logs,

do you mean i should write (IP)xx.xx.xx.xx/etc/openvpn/1194.log

you can also use openvpn control to access the managment console.

pls tell me something more about it

maikcat

do you mean i should write (IP)xx.xx.xx.xx/etc/openvpn/1194.log

nop

f.e

status /etc/openvpn/1194.log

is will create 1194.log in folder /etc/openvpn

openvpn-control is a software you can find in sourceforge and uses managment port
for communicating live with openvpn service,
just enable managment using this:

management 0.0.0.0 7505

inside server config
note that the above allows access to openvpn managment port from *any* ip..

Michael.

dazo

Generally speaking, /etc is the place for configuration files/data. You should not depend on writing to this directory on a normal basis. For logging, the proper place would be /var/log ... or if you want a more generic area for varying data /var/lib/openvpn is pretty common. If these directories does not exist, you may create them.

The reason is that /var and /etc often can be on separate harddrive partitions (or logical volumes), and if the partition which /etc lays on (usually as part of the basic /) gets filled up - you'll have a bigger task cleaning up; worst case your system will struggle to boot. If /var goes full, the system is in most cases bootable and only the applications which tries to write to this area will fail.

Of course if /etc and /var is on the same partition, you'll have a big challenge anyway if the disk goes full. However, finding out which data to delete is still easier if the same type of data is located in roughly the same area.

delirium

dhruvpandit wrotebut is there any log or some thing from which i can watch / i can get idea , that which user is connected at that time, or any user IP or so??

Yes there is.