


And if you can identify it beyond any doubt, you can as well block/throttle it rather than applying the sanctions. I've also got no idea what's the idea behind using pppoe server, can you administrative measures sound great if you are a company IT admin, but it still requires an ability to identify the forbidden kind of traffic beyond any doubt so that you could apply the administrative sanctions.
If it's the third case, you have to change the order of matching of your bandwidth limiting rules, so that the higher bandwidth was assigned for explicitely listed destinations and the lower one to all the rest. If it's the second case, why do you only have problem with one particular VPN app? There are plenty of them, and people who don't want to be spied on will simply move to the next one once you block the one they use, so at the end of the day you'd end up with the first case if you wanted to block them all. where internet access should be completely blocked, there's something wrong with your firewall rules. Does that mean that your users should have access only to the resources of that network itself but should not have any access to the internet at all, and by means of that VPN application, they can overcome the restriction and get to internet? Or that you just want/need to know what sites their visit and the VPN hides this information from you? Or that you have set some bandwidth limitations for different services, and the customers use the VPN to overcome these limitations? I'm not sure what means "unauthorized access to the internet in my network".
