SoftEther VPN Core Architecture
To understand all the features of SoftEther VPN, you first need to study the components common to the entire system.
VPN Communication Protocol
The protocol used by SoftEther VPN for VPN communications is based on SSL version 3.0 (Secure Socket Layer). SoftEther VPN incorporates several technical innovations to increase the speed and improve the security of VPN communications.
Communication Speed
SoftEther VPN is a VPN system built around the exchange of virtual Ethernet frames over VPN between the VPN Client, VPN Server and VPN Bridge. Based on the TCP/IP protocol, the SoftEther VPN protocol performs encapsulation, encryption and transmission of virtual Ethernet frames across a physical IP network.
Performance Optimization
- Data compression: automatic compression of transmitted data
- Multithreading: use of multiple TCP connections
- Buffering: buffer size optimization for various network conditions
User Authentication
SoftEther VPN ensures security by performing strict user authentication whenever a new VPN session attempts to connect to a Virtual Hub. This prevents security breaches in which an unauthorized third party could connect without permission.
Authentication Methods
- Password authentication: simple authentication using a username and password
- Certificate authentication: use of X.509 digital certificates
- RADIUS authentication: integration with external RADIUS servers
- Windows AD integration: authentication through Active Directory
- Combined authentication: use of several methods at once
Virtual Hub
The Virtual Hub is the core unit of the VPN Server, acting as a virtual Ethernet switch. Each Virtual Hub can host many VPN sessions and functions as a separate, isolated network.
Virtual Hub Functions
- Packet switching: forwarding Ethernet frames between connected clients
- MAC address learning: automatic learning of the MAC addresses of connected devices
- VLAN support: handling tagged VLAN frames
- Traffic filtering: applying access rules and security filters
Protocols and Compatibility
SoftEther VPN supports several VPN protocols to ensure maximum compatibility:
Supported Protocols
- SSL-VPN: SoftEther’s native protocol
- OpenVPN: compatibility with OpenVPN clients
- L2TP/IPsec: support for standard L2TP over IPsec
- MS-SSTP: Microsoft Secure Socket Tunneling Protocol
- L2TPv3: Layer 2 Tunneling Protocol version 3
- Wireguard: experimental support (not recommended)
Encryption and Security
Encryption Algorithms
SoftEther VPN supports modern cryptographic algorithms:
- RC4-MD5: for compatibility (not recommended)
- AES-128-CBC: standard AES encryption
- AES-256-CBC: strengthened AES encryption
- ChaCha20-Poly1305: a modern AEAD algorithm
Integrity Verification
- HMAC-SHA1: basic integrity verification
- HMAC-SHA256: strengthened integrity verification
- Poly1305: modern integrity verification for ChaCha20
The vpncmd Command-Line Utility
vpncmd is a powerful command-line utility for managing all SoftEther VPN components.
vpncmd Operating Modes
- VPN Server management mode: for configuring and monitoring the server
- VPN Client management mode: for managing client connections
- VPN Bridge management mode: for configuring bridge connections