How to centrally restrict access to satellite Internet?

Question

Computer networks

There are several objects with limited satellite connection, good persuasion does not help, and everything is pumped out very quickly. There is no possibility to install a separate PC for each object. There is an idea to create a virtual machine, deploy Kerio or a similar system on it, perhaps something free, so that the router at the facility clings to this system via VPN and traffic is already being restricted on it, so it will be centralized. Maybe someone came across in practice, or there is an easier way to block everything superfluous so that 100 GB do not fly apart in 2 weeks.

Answer 1

If you have routers - just block via DNS.
Set up a blacklisted DNS forwarder anywhere - for example ADGuard Home.
Deny all routers access to any DNS other than your DNS forwarder.
On it, block unwanted DNS records.
It will not help for a long time, since DNS over HTTPS, etc. appears in browsers. But in theory, on routers, all public DNS such as Google, cloudflare, etc. you can just ban them by their ip addresses and they will not work.
Or, from the same routers, drive all traffic through VPN to any point with good and unlimited Internet, where you can already manage traffic. You can manage it through any proxy like squid.

Answer 2

At one time, at work, a similar task was solved by squid proxy. Everyone who needed the Internet received an account on a proxy server, the proxy itself limited the number of megabytes available to the user.

Answer 3

I used to do that. At the exit was a mikrotik router. I set up a vpn server on it, started accounts for everyone, severely cut traffic speed in queues, plus at the level of dns settings I looked at what to close.
Thus, you can see and understand which of the users is eating up traffic for non-working purposes, and punish with a ruble. I once had this problem solved exactly like this!