Documentation
SoftEther VPN Manual
SoftEther VPN Manual
SoftEther vpncmd Command-Line Management Guide

SoftEther vpncmd Command-Line Management Guide

vpncmd is a powerful command-line utility for managing all components of SoftEther VPN.

vpncmd Overview

vpncmd is officially known as the “SoftEther VPN Command Line Management Utility”. It is cross-platform software that runs exclusively from the command line.

vpncmd capabilities:

  • Full VPN Server management
  • VPN Client configuration
  • VPN Bridge management
  • Automation through scripts
  • Remote administration

vpncmd Operating Modes

VPN Server management mode


# Connecting to the local server
vpncmd localhost /SERVER

# Connecting to a remote server with a password
vpncmd vpn.company.com:443 /SERVER /PASSWORD:adminpass

# Connecting to a specific Virtual Hub
vpncmd localhost /SERVER /HUB:MYHUB /PASSWORD:hubpass

VPN Client management mode


# Connecting to the local client
vpncmd localhost /CLIENT

# Connecting to a remote client
vpncmd client.company.com /CLIENT /PASSWORD:clientpass

VPN Bridge management mode


# Connecting to the local bridge
vpncmd localhost /BRIDGE

# Connecting to a remote bridge
vpncmd bridge.company.com /BRIDGE /PASSWORD:bridgepass

Interactive and Batch Modes

Interactive mode


# Starting interactive mode
vpncmd

# Selecting the management mode in interactive mode
1. Management of VPN Server or VPN Bridge
2. Management of VPN Client
3. Use of VPN Tools

Batch mode


# Running a single command
vpncmd localhost /SERVER /CMD:ServerInfoGet

# Running a command script
vpncmd localhost /SERVER /IN:commands.txt

VPN Server Management Commands

General server commands


# Server information
ServerInfoGet

# Server status
ServerStatusGet

# List of listener ports
ListenerList

# Creating a listener port
ListenerCreate 1194 /ENABLE:yes

# Reloading the server
Flush

Virtual Hub management


# List of Virtual Hubs
HubList

# Creating a Virtual Hub
HubCreate NEWHUB /PASSWORD:hubpass

# Deleting a Virtual Hub
HubDelete OLDHUB

# Virtual Hub status
StatusGet

User management


# List of users
UserList

# Creating a user
UserCreate john /GROUP:employees /REALNAME:"John Smith" /NOTE:"IT Department"

# Deleting a user
UserDelete john

# Setting a user password
UserPasswordSet john /PASSWORD:newpassword

# User information
UserGet john

Group management


# List of groups
GroupList

# Creating a group
GroupCreate employees /NOTE:"Employee Group"

# Deleting a group
GroupDelete employees

# Configuring group policies
GroupPolicySet employees /NAME:MaxConnection /VALUE:3
GroupPolicySet employees /NAME:TimeOut /VALUE:300
GroupPolicySet employees /NAME:MaxMac /VALUE:16
GroupPolicySet employees /NAME:MaxIP /VALUE:16
GroupPolicySet employees /NAME:MaxUpload /VALUE:1000000
GroupPolicySet employees /NAME:MaxDownload /VALUE:1000000

Certificates and PKI


# Creating a certificate
MakeCert /CN:"VPN Server" /SERIAL:1 /EXPIRES:2025-12-31

# Loading a certificate from a file
ServerCertSet /LOADCERT:server.crt /LOADKEY:server.key

# Viewing the installed certificate
ServerCertGet

# Creating a certificate authority
CaAdd /CN:"Company CA" /SERIAL:1 /EXPIRES:2030-12-31

# List of CA certificates
CaList

Access control


# List of access rules
AccessList

# Adding an access rule
AccessAdd /RULENAME:"Allow HTTPS" /PRIORITY:100 /SRC_IP:any /DEST_IP:any /DEST_PORT:443 /PROTOCOL:TCP /ACTION:allow

# Deleting an access rule
AccessDelete 1

# Enabling/disabling a rule
AccessEnable 1
AccessDisable 1

SecureNAT features


# Enabling SecureNAT
SecureNatEnable

# Disabling SecureNAT
SecureNatDisable

# SecureNAT status
SecureNatStatusGet

# Configuring the virtual DHCP server
DhcpSet /START:192.168.30.10 /END:192.168.30.200 /MASK:255.255.255.0 /GW:192.168.30.1 /DNS:8.8.8.8 /DNS2:8.8.4.4 /DOMAIN:company.local /LEASE:7200

# DHCP table listing
DhcpTable

# Configuring the virtual NAT
NatEnable
NatDisable
NatStatusGet

# Configuring the NAT table
NatSet /MTU:1500 /LOG:yes /SAVE:yes

Local bridges


# List of local bridges
BridgeList

# Creating a local bridge
BridgeCreate MYHUB /DEVICE:"Local Area Connection"

# Deleting a local bridge
BridgeDelete MYHUB

# List of available network devices
BridgeDeviceList

VPN Client Management Commands

Basic client commands


# Switching to client management mode
vpncmd localhost /CLIENT

# Client version information
VersionGet

# List of virtual adapters
NicList

# Creating a virtual adapter
NicCreate "My VPN Adapter"

# Deleting a virtual adapter
NicDelete "My VPN Adapter"

# Enabling/disabling an adapter
NicEnable "My VPN Adapter"
NicDisable "My VPN Adapter"

Connection management


# List of VPN connections
AccountList

# Creating a new connection
AccountCreate "Company VPN" /SERVER:vpn.company.com:443 /HUB:CORPORATE /USERNAME:john /NICNAME:"My VPN Adapter"

# Deleting a connection
AccountDelete "Company VPN"

# Setting a password
AccountPasswordSet "Company VPN" /PASSWORD:mypassword /TYPE:standard

# Configuring connection parameters
AccountSet "Company VPN" /SERVER:vpn.company.com:443 /HUB:CORPORATE /USERNAME:john /KEEPALIVE:yes /USECOMPRESS:yes /USEENCRYPT:yes

# Connecting
AccountConnect "Company VPN"

# Disconnecting
AccountDisconnect "Company VPN"

# Connection status
AccountStatusGet "Company VPN"

# Detailed statistics
AccountGet "Company VPN"

Certificates on the client


# List of certificates
CertList

# Adding a certificate
CertAdd /CERTFILE:client.crt /KEYFILE:client.key

# Deleting a certificate
CertDelete 1

# Getting certificate information
CertGet 1

Proxy configuration


# Configuring an HTTP proxy
AccountProxySet "Company VPN" /TYPE:http /SERVER:proxy.company.com:8080 /USERNAME:proxyuser /PASSWORD:proxypass

# Configuring a SOCKS proxy
AccountProxySet "Company VPN" /TYPE:socks /SERVER:socks.company.com:1080

# Disabling the proxy
AccountProxyNone "Company VPN"

VPN Bridge Commands

Bridge management

# Switching to bridge management mode
vpncmd localhost /BRIDGE

# List of local bridges
BridgeList

# Creating a bridge with a physical adapter
BridgeCreate BRIDGE1 /DEVICE:"eth0"

# Creating a TAP device (Linux)
BridgeCreate BRIDGE1 /DEVICE:"tap_softether" /TAP:yes

# Deleting a bridge
BridgeDelete BRIDGE1

# List of available network devices
BridgeDeviceList

Cascade connections


# Creating a cascade connection
CascadeCreate "HQ Connection" /SERVER:hq.company.com:443 /HUB:BRANCH /USERNAME:branch_office

# Setting the cascade password
CascadePasswordSet "HQ Connection" /PASSWORD:cascadepass /TYPE:standard

# Configuring cascade parameters
CascadeSet "HQ Connection" /SERVER:hq.company.com:443 /HUB:BRANCH /USERNAME:branch_office /KEEPALIVE:yes

# Bringing the cascade online
CascadeOnline "HQ Connection"

# Taking the cascade offline
CascadeOffline "HQ Connection"

# Cascade status
CascadeStatusGet "HQ Connection"

# List of all cascades
CascadeList

# Deleting a cascade
CascadeDelete "HQ Connection"

VPN Tools

Connectivity checks

# Switching to tools mode
vpncmd /TOOLS

# Connectivity check (ping)
Check vpn.company.com

# Route tracing
TrafficClient vpn.company.com

# Performance test
TrafficServer

Certificate generation


# Creating a self-signed certificate
MakeCert /CN:"Test Certificate" /OU:"IT Department" /O:"Company Inc" /C:"US" /ST:"CA" /L:"San Francisco" /SERIAL:1 /EXPIRES:2025-12-31 /SAVECERT:test.crt /SAVEKEY:test.key

Diagnostic tools


# Network interface information
Win32_GetWinVer

# Checking OpenSSL
OpenSslVersion

# Checking IPv6
IPsecIkeClientGet

Automation and Scripting

Creating command scripts

Create a text file setup.txt with a list of commands:


# VPN server setup script
ServerPasswordSet mypassword
ListenerCreate 443
ListenerCreate 992
ListenerCreate 1194
ListenerCreate 5555

HubCreate CORPORATE /PASSWORD:hubpass
Hub CORPORATE
UserCreate john /GROUP:employees /REALNAME:"John Smith"
UserPasswordSet john /PASSWORD:userpass
SecureNatEnable

Run the script:


vpncmd localhost /SERVER /IN:setup.txt

Environment variables and parameterization

Use environment variables to parameterize scripts:


# Setting variables
export VPN_SERVER="vpn.company.com"
export VPN_PASSWORD="secretpass"

# Using them in commands
vpncmd $VPN_SERVER /SERVER /PASSWORD:$VPN_PASSWORD /CMD:ServerStatusGet

Logging and Debugging

Enabling verbose logging


# Enabling session logging
LogEnable session /SWITCH:yes

# Enabling packet logging
LogEnable packet /SWITCH:yes

# Enabling security logging
LogEnable security /SWITCH:yes

# Viewing logging settings
LogList

# Disabling logging
LogDisable session

Exporting the configuration


# Exporting the server configuration
ConfigGet /SAVEFILE:server_config.txt

# Importing a configuration
ConfigSet /IN:server_config.txt

Common Use Cases

Quick setup of a simple VPN server


#!/bin/bash
# Quick setup script

vpncmd localhost /SERVER <<EOF
ServerPasswordSet adminpassword
ListenerCreate 443
HubCreate VPN /PASSWORD:hubpass
Hub VPN
UserCreate testuser /REALNAME:"Test User"
UserPasswordSet testuser /PASSWORD:testpass
SecureNatEnable
exit
EOF

Bulk user creation

#!/bin/bash
# Creating users from a CSV file

while IFS=, read -r username realname password group; do
    vpncmd localhost /SERVER /HUB:CORPORATE <<EOF
UserCreate "$username" /GROUP:"$group" /REALNAME:"$realname"
UserPasswordSet "$username" /PASSWORD:"$password"
EOF
done < users.csv

Connection monitoring

#!/bin/bash
# Active session monitoring script

vpncmd localhost /SERVER /HUB:CORPORATE /CMD:SessionList | \
grep "Session Name" | \
wc -l | \
xargs echo "Active sessions:"
Reviewed by OpenNix LLC · Last updated on
SoftEther VPN Bridge GuideInstalling SoftEther VPN Client