Why can't I see hotspot traffic?

Question

I want to know how to manage the traffic of clients connected to my Android hotspot. Here are two main features that I want to achieve:

• Deny / allow Internet access for customers.
• Measure the amount of data consumed by the customer.

I use VpnService, which allows me to point all my device traffic to the tun interface. I see every IP packet passing through the tunnel coming from my device. But after many attempts (many days), I assumed that it was impossible to see the hotspot traffic in Android. To my knowledge, this may be because the android access point layer is below the VpnService, and packets are sent transparently from the tunnel. I'm right?

The VPN interface is built as:

mInterface = builder.setSession("MyVpnServiceSession")
        .addAddress("10.0.0.2", 32)
        .addRoute("0.0.0.0", 0)
        .establish()

Please, does anyone know how I can achieve these capabilities using (or not) VpnService or another solution?

thank

PS. The answer should work for NON-ROOTED devices