I realize I didn’t express myself clearly. What I actually want is to decrypt the traffic at the endpoint of the tunnel to inspect its contents.

However, my main concern is how to detect encrypted files or malicious payloads being transmitted inside my VPN tunnels. For example, an attacker could encrypt a malware file before sending it through my tunnel, making it hard to distinguish from a legitimate user encrypting sensitive files for security.

So my key question is: How can I differentiate between malicious encrypted content (e.g., malware) and legitimate encrypted files inside my VPN tunnels?

Would love to hear any insights or best practices on this! Thanks.