OpenVPN Support Forum

I have openvpn server 2.3.2 compiled from source installed on a centos 6 box.
- configured to auth using openldap.
- it works perfectly as far as i've seen and there are no problems.

my question is how can i limit the bandwidth used per month and also limit the rate of each account.
for instance
i have in ldap

• users: user1,2,3[...]
  groups: light,standard,unlimited

i would like to set light to 500KB/s max rate and 20GB quota, standard to a little more and unlimited to well, unlimited.

and connection wise, how can i limit the number of connection a certain user can have simultaneously ? and for that matter can i configure the server to deny such behavior ? ie each user is allowed only one connection from any one place at a time.

also for stats, i'd like a counter for the total bandwidth (up or down) used by each user
where do i begin ? are there any documents detailing on how to do this ? i know it's not your standard setup but since the openldap community couldn't care (nor should they) less about openvpn configuring it's not common sense to post on their mailing lists for help.

Thanks in advance.

*edited*

Details of the connection are available through the script hooks and status output, which I'll describe below. QoS is something you need to set up on your host OS and possibly interface with via a script that OpenVPN calls for client connections. Besides the script hook, QoS has nothing to do with OpenVPN and everything to do with your OS configuration.

On disconnect, env-vars are set that, among other things, contain bandwidth transferred in both directions. What you do with this data is up to you, but for a basic user logging example, see a github project component of mine at this link. What you choose to do with this value is up to you (you could add it to a total of data transferred for the month and do extra accounting, store it in a log, or a SQL database, or LDAP, etc. This is for you to script and figure out.)

Stats of connections that are live can be viewed through the management interface (see --management in the manpage) by sending a `status` command, or by looking at the logs openvpn generates when given a SIGUSR2 signal. You could use this if you require polling the bandwidth used before disconnection.

As for QoS, you should read the LARTC Howto, and specifically their section on QoS. If you want each client to have their own QoS setup, you will need to use the --client-connect and --client-disconnect scripts to dynamically add and remove qdiscs and filters depending on what you require. Note that netfilter can also classify directly, which can be easier to write rules for than dealing with the tc-filters syntax; you can read about qdisc classification with netfilter in its documentation for the CLASSIFY target.

In the tc documentation, check out the htb qdisc (tc-htb(8) manpage) as such a setup might be what you're looking for to set up a tree of rate quotas. Besides calling relevant tc and possibly iptables commands, none of this has much to do with OpenVPN directly, so reference the LARTC docs for details managing this part of the setup.

Sorry to raise this thread from the grave, but can I use these scripts on a Windows Server? If yes, how? Are there now any scripts that can monitor clients' bandwidth usage per month and disallow them to connect if the limit is reached?