Logging traffic through home router per user

Question

I'm sharing a flat with 3 others and the internet service is under my name.

Is it possible to log the traffic generated by all users such that, in case if one of my roommates does something nefarious online, I'd have a log to show myself clean. Perhaps a log of destination IPs per user login.

Could I forward all traffic to a transparent proxy? But then I'm not sure if I could group the traffic by user/login.

Any idea appreciated.

Answer 1

On a technical level, yes, it is possible. Indeed, you'd have to use a transparent routing proxy. There's a few ways of doing that, here's two of them:

• Spoof the MAC address of the CPE in your LAN, so that all requests are sent to your proxy. Then just redirect the allowed traffic towards the original MAC address. Not easy to work around if not network-savvy (you'd need to edit the CAM table of the station).
• Put the proxy directly in front of the CPE and make it the new gateway for the whole LAN. If there's WiFi, you'd have to deactivate it on the CPE, create an access point on the proxy and bridge the WiFi and ethernet interfaces. Cannot be worked around unless using an encrypted tunnel (but the negotiation exchange would still pass in clear, so possible to block).

Adding an authentication level would just be using a captive portal + local authentication, also on the proxy. A lot of distributions allow this natively (like IPCop and the likes).

On a legal level, can't say. It depends on your country I'd say, but in most cases, like Daniel said, I think user's express consent would suffice. Although you have to know that in certain countries you are responsible for your connection, whoever uses it.