I run OpenVPN servers for our commercial VPN app. The mobile client grabs an .ovpn file from our API and connects. Right now, I log the standard connection metrics (auth success/fail, TLS handshakes, basic connectivity).
We have a recurring issue: A user connects successfully to the VPN, but the specific site they want to access is geo-blocked or has blacklisted our VPN IP (e.g., streaming services). The user assumes the VPN is broken and leaves a 1-star review.
My manager wants me to trace this on the server side. He wants the server logs to somehow identify when a connected user fails to access their intended site so we can troubleshoot it.
I told him this is a terrible idea and a massive overhead. Because of HTTPS, we can’t see if the site served a 403 "VPN Blocked" page – we just see encrypted packets flowing. To even guess at failures, I'd have to log DNS queries or sniff SNI headers (which kills our no-logs privacy stance) or do heavy DPI which will choke the servers.
How do other VPN providers handle this? I’m thinking synthetic monitoring (curling popular sites from the server IPs and exporting to Prometheus) or pushing client-side telemetry in the app.
Has anyone dealt with this exact management request before?
Source: r/OpenVPN · by /u/grizzthe13th