Extract number of users connected to IPSsec/L2tpd server

ipsecl2tppoint-to-point-protocolzabbix

We have a new corporate VPN server running Ipsec (Openswan) + xl2tpd + pppd. When a user connects, pppd runs the /etc/ppp/auth-up script which logs the time and username that has connected to /var/log/pppstats. However, on our older OpenVPN system we were able to finger the OpenVPN daemon to query the number of currently connected users and this is a metric which our management require to be reported via our Zabbix monitoring servers.

It would seem relying on the log file to analyze the number of connected users to be extremely unreliable since if a user shuts down their machine without terminating the connection then we have an eternally connected user. Any ideas on how this metric could be extracted reliably as possible?

Best Answer

One option would be to check the output of netstat. Even something as simple as this should work (it would probably need updating for the exact service names:

netstat -ano | grep poptop | wc -l

Related Solutions

Linux – OpenSwan IPSec phase #2 complications

You'll want to get the remote end to enable NAT-T on their end of the connection as well.

IPSec communication cryptographically signs the entire packet - any change to the IP header will invalidate that signature. NAT works by rewriting the source and/or destination IP fields; having NAT on either end of the connection means that every packet is having the header changed in transit; the source is changed on packets leaving your 192.168 network, and the destination is changed on inbound packets.

NAT-T counteracts this by encapsulating the entire ESP packet in a new UDP packet. The UDP packet can safely have its headers mangled to the satisfaction of any NAT devices, while the ESP payload will make the entire trip unchanged. The remote node will need to enable this to protect the packets they're sending your way from the NAT modifications, and you'll both need to be allowing UDP port 4500.

This may not be the only issue in the configuration of the VPN tunnel, but it would certainly explain a malformed payload message; give it a shot, and let us know if any further issues come up!

ASA 5505 stops local internet when connected to VPN

Which client software are you using to connect? Split tunneling is set up, but I believe you'll need to be connecting with the Cisco client software for it to function.

Anyway, to get the VPN client's internet traffic to make it out to the internet, looks like all you need is:

same-security-traffic permit intra-interface
nat (outside) 1 192.168.30.0 255.255.255.0

Best Answer

Related Solutions

Linux – OpenSwan IPSec phase #2 complications

ASA 5505 stops local internet when connected to VPN

Related Topic