Monitoring and Alerting for Self-Hosted VPNs

Author: JJustis | Published: 2025-10-21 00:55:57
Article Image 1
Part 4: Monitoring and Alerting for Self-Hosted VPNs
A private VPN is only as strong as its monitoring. Even with perfect encryption, a misconfiguration, brute-force attempt, or silent failure can expose data. This guide shows how to monitor your WireGuard or OpenVPN server using system logs, fail2ban, logwatch, and automatic email alerts — ensuring that your VPN remains reliable and tamper-resistant at all times.

1. System Logging Basics
Linux keeps valuable data about your VPN service under /var/log/. Watching these files regularly helps detect strange activity or service instability.
  • journalctl -u wg-quick@wg0 — shows all WireGuard-related events.
  • cat /var/log/syslog | grep wg0 — filters for VPN connection attempts.
  • Use logrotate to compress old logs and prevent disk overflow.

    • 2. Installing and Configuring Fail2ban
    Fail2ban blocks IP addresses that repeatedly try to connect or authenticate. It’s essential for defending against brute-force or unauthorized key attempts.
    1.apt install fail2ban
    2.Edit /etc/fail2ban/jail.local
    3.Add a custom jail for WireGuard or SSH:
    [wireguard]
    enabled = true
    filter = wireguard
    logpath = /var/log/syslog
    maxretry = 3
    bantime = 600
  • Restart the service with systemctl restart fail2ban.
  • Check active bans: fail2ban-client status.

    • 3. Creating a WireGuard Log Filter
    Since WireGuard does not use standard authentication logs, we must define a custom filter.
    File:/etc/fail2ban/filter.d/wireguard.conf
    Content:[Definition]
    failregex = .*Handshake for peer.*failed.*
  • This detects repeated failed handshakes and bans those IPs automatically.

    • 4. Setting up Logwatch Reports
    Logwatch creates daily summaries of system activity and sends them via email.
  • apt install logwatch
  • Edit /usr/share/logwatch/default.conf/logwatch.conf
  • Set MailTo = your@email.com
  • Run manually to test: logwatch --detail High --mailto your@email.com

    • 5. Enabling System Email Alerts
    You can use ssmtp or msmtp to send emails from your server when something changes.
  • apt install ssmtp mailutils
  • Configure /etc/ssmtp/ssmtp.conf with your email provider’s SMTP details.
  • Test: echo "VPN Alert Active" | mail -s "VPN Security Notice" you@example.com

    • 6. Monitoring Resource Usage
    Resource spikes may signal misuse or an attack. Monitoring tools help ensure stable performance.
  • htop or atop — track real-time CPU and memory usage.
  • vnstat — measure network traffic per interface (install with apt install vnstat).
  • df -h — check available disk space to avoid log overflow.

    • 7. Uptime and Latency Checks
    1.Install UptimeRobot or self-host HealthChecks.io.
    2.Configure a heartbeat that pings every 5 minutes via cron.
    3.If the server fails to respond, you’ll receive an alert instantly.

    8. Real-Time VPN Session Monitoring
  • Run wg show to list active peers, handshakes, and data transfer totals.
  • Use watch -n 10 wg show for continuous updates.
  • If you see unknown peers, remove their keys immediately from /etc/wireguard/wg0.conf.

    • 9. Intrusion Detection (Optional)
  • Install psad to detect port scans: apt install psad
  • Integrate with iptables to receive alerts about unusual activity.
  • Enable email_alert = Y in /etc/psad/psad.conf.

    • 10. Automation and Self-Healing Scripts
  • Create a cron job that restarts WireGuard if the interface drops:
    • */5 * * * * /usr/bin/systemctl restart wg-quick@wg0
  • Use bash scripts to verify public IP matches your VPN endpoint every few minutes.
  • If mismatch is detected, restart automatically and send alert email.

    • 11. Daily Security Routine
  • Review /var/log/syslog and /var/log/fail2ban.log.
  • Check WireGuard peer handshakes and data transfer for anomalies.
  • Ensure automatic updates and reboots are functioning as expected.
  • Monitor DNS queries via pihole -t if using Pi-hole integration.

    • 12. Long-Term Hardening
  • Use AIDE or Tripwire to detect file tampering.
  • Backup your /etc/wireguard directory regularly and store offsite.
  • Keep your kernel, systemd, and WireGuard packages up to date.
  • Document all configuration changes for forensic analysis if needed.

    • Conclusion
    Monitoring transforms a secure VPN into a resilient one. By combining logwatch, fail2ban, psad, and email notifications, you gain immediate visibility over attacks, performance drops, or connectivity failures. Automation ensures that your VPN stays online and clean — turning your private network into a self-defending digital perimeter.