Documentation
SoftEther VPN Manual
SoftEther VPN Manual
VPN Network Setup Examples

VPN Network Setup Examples

VPN Network Setup Examples

This chapter provides practical examples of building various types of VPN networks with SoftEther VPN.

VPN Types

VPN topologies can be divided into three main types:

PC-to-PC VPN

  • Simple connection between two computers
  • Minimal configuration
  • Suitable for personal use

Remote Access VPN

  • Connects remote users to a corporate network
  • Central VPN server
  • Multiple client connections

LAN-to-LAN VPN

  • Connects geographically separated networks
  • Permanent tunnels between offices
  • Transparent connectivity for all devices

General Concepts and Background

Before configuring any type of VPN, you need to understand the following concepts:

IP Addressing in a VPN

Virtual IP addresses:

  • Each VPN client is assigned a virtual IP address
  • Virtual addresses must belong to a separate subnet
  • It is recommended to use private ranges (RFC 1918)

Address allocation examples:

Corporate network:      192.168.1.0/24
VPN clients:           192.168.10.0/24  
Branch 1:              192.168.20.0/24
Branch 2:              192.168.30.0/24

DHCP in a VPN

SoftEther VPN can provide IP addresses to clients through:

  • SecureNAT: built-in DHCP server
  • Local Bridge: using an existing DHCP server
  • Static addresses: manual assignment

Routing

Automatic routing:

  • The VPN Client automatically creates routes to the virtual network
  • All traffic can be forced through the VPN

Manual routing:

# Windows - add a static route
route add 192.168.1.0 mask 255.255.255.0 192.168.10.1

# Linux - add a static route  
ip route add 192.168.1.0/24 via 192.168.10.1

Creating a PC-to-PC VPN

This is the simplest VPN type, connecting two computers directly.

Architecture

Computer A ←→ Internet ←→ Computer B
    (Client)                    (Server)

Step 1: Configure the VPN Server (Computer B)

# Connect to the server
vpncmd localhost /server

# Create a Virtual Hub
HubCreate PCTOPC /PASSWORD:hubpass

# Switch to the created Hub
Hub PCTOPC

# Create a user for Computer A
UserCreate computerA /REALNAME:"Computer A User"
UserPasswordSet computerA /PASSWORD:pctopcpass

# Enable SecureNAT for automatic network configuration
SecureNatEnable

# Configure DHCP (optional)
DhcpSet /START:192.168.30.10 /END:192.168.30.200 /MASK:255.255.255.0 /GW:192.168.30.1

Step 2: Configure the VPN Client (Computer A)

# Connect to the client
vpncmd localhost /client

# Create a virtual adapter
NicCreate "PC to PC Connection"

# Create the VPN connection
AccountCreate "Connect to Computer B" /SERVER:computer-b-ip:443 /HUB:PCTOPC /USERNAME:computerA /NICNAME:"PC to PC Connection"

# Set the password
AccountPasswordSet "Connect to Computer B" /PASSWORD:pctopcpass

# Connect
AccountConnect "Connect to Computer B"

Step 3: Verify the Connection

On both computers, check:

# Windows
ipconfig
ping 192.168.30.1

# Linux  
ip addr show
ping 192.168.30.1

Creating a Remote Access VPN (PC to LAN)

This VPN type lets remote users connect to a corporate network.

Architecture

Remote employee ←→ Internet ←→ VPN Server ←→ Corporate LAN
     (VPN Client)                   (in the office)   (192.168.1.0/24)

Step 1: Configure the VPN Server in the Office

# Connect to the server
vpncmd localhost /server

# Create the corporate Hub
HubCreate CORPORATE /PASSWORD:corppass

# Switch to the Hub
Hub CORPORATE

# Create user groups
GroupCreate employees /NOTE:"Regular employees"
GroupCreate management /NOTE:"Management group"

# Configure policies for employees
GroupPolicySet employees /NAME:MaxConnection /VALUE:3
GroupPolicySet employees /NAME:TimeOut /VALUE:300
GroupPolicySet employees /NAME:MaxUpload /VALUE:1000000
GroupPolicySet employees /NAME:MaxDownload /VALUE:5000000

# Create users
UserCreate john /GROUP:employees /REALNAME:"John Smith" /NOTE:"Sales Manager"
UserPasswordSet john /PASSWORD:johnpass

UserCreate alice /GROUP:management /REALNAME:"Alice Johnson" /NOTE:"IT Director"  
UserPasswordSet alice /PASSWORD:alicepass

# Create a local bridge to the corporate network
exit
BridgeCreate CORPORATE /DEVICE:"Local Area Connection"

Step 2: Configure the Clients

John’s client:

vpncmd localhost /client

NicCreate "Company VPN"

AccountCreate "Corporate Access" /SERVER:vpn.company.com:443 /HUB:CORPORATE /USERNAME:john /NICNAME:"Company VPN"

AccountPasswordSet "Corporate Access" /PASSWORD:johnpass

AccountConnect "Corporate Access"

Step 3: Advanced Server Configuration

Configuring access lists:

Hub CORPORATE

# Allow access to the file server for management only
AccessAdd /RULENAME:"File Server Access" /PRIORITY:100 /SRC_USERNAME:management /DEST_IP:192.168.1.10 /ACTION:allow

# Block P2P traffic for everyone
AccessAdd /RULENAME:"Block P2P" /PRIORITY:200 /DEST_PORT:6881-6999 /PROTOCOL:TCP /ACTION:deny

Configuring logging:

# Log connections
LogEnable connection /SWITCH:yes

# Log security events
LogEnable security /SWITCH:yes

Creating a LAN-to-LAN VPN (Using an L2 Bridge)

This VPN type connects two or more local networks, creating a single distributed network at Layer 2.

Architecture

Office A (192.168.1.0/24) ←→ VPN Bridge ←→ Internet ←→ VPN Server ←→ Office B (192.168.1.0/24)

Scenario: Connecting the Main Office to a Branch

Main office:

  • Network: 192.168.1.0/24
  • VPN Server installed on a server
  • Local bridge to the corporate network

Branch office:

  • Network: 192.168.1.0/24 (the same subnet!)
  • VPN Bridge to connect to the main office
  • Transparent extension of the corporate network

Step 1: Configure the VPN Server (Main Office)

# Configure the server
vpncmd localhost /server

# Create a Hub for connecting to the branch
HubCreate BRANCH_NETWORK /PASSWORD:branchpass

# Switch to the Hub
Hub BRANCH_NETWORK

# Create a user for the branch VPN Bridge
UserCreate branch_bridge /REALNAME:"Branch Office Bridge" /NOTE:"Automatic branch connection"
UserPasswordSet branch_bridge /PASSWORD:bridge_secret_2024

# Create a local bridge to the corporate network
exit
BridgeCreate BRANCH_NETWORK /DEVICE:"Local Area Connection"

Step 2: Configure the VPN Bridge (Branch Office)

# Connect to the Bridge
vpncmd localhost /bridge

# Create a cascade connection to the main office
CascadeCreate "MainOffice" /SERVER:hq.company.com:443 /HUB:BRANCH_NETWORK /USERNAME:branch_bridge

# Set the password for the cascade
CascadePasswordSet "MainOffice" /PASSWORD:bridge_secret_2024

# Configure additional parameters
CascadeSet "MainOffice" /KEEPALIVE:yes /USECOMPRESS:yes

# Create a local bridge to the branch network
BridgeCreate LocalBranch /DEVICE:"Local Area Connection"

# Bring the cascade online
CascadeOnline "MainOffice"

Step 3: Verify Connectivity

Once configured, computers at the branch should have direct access to the main office resources:

# From the branch, ping the main office server
ping 192.168.1.10

# Access shared folders
\\192.168.1.10\shared

# Work with corporate applications
# (no additional configuration required)

Creating a LAN-to-LAN VPN (Using L3 IP Routing)

This approach creates a Layer 3 connection between networks with different IP subnets.

Architecture

Office A (192.168.1.0/24) ←→ VPN Server ←→ Internet ←→ VPN Server ←→ Office B (192.168.2.0/24)
                              (Router)                      (Router)

Scenario: Connecting Offices with Different Subnets

Main office:

  • Local network: 192.168.1.0/24
  • VPN subnet: 192.168.100.0/24

Branch office:

  • Local network: 192.168.2.0/24
  • VPN subnet: 192.168.200.0/24

Step 1: Configure the Main Office

# Configure the VPN Server
vpncmd localhost /server

# Create a Hub for routing
HubCreate ROUTING /PASSWORD:routepass

Hub ROUTING

# Create a user for the branch
UserCreate branch_router /REALNAME:"Branch Router Connection"
UserPasswordSet branch_router /PASSWORD:router_pass_2024

# Enable SecureNAT for the local office
SecureNatEnable

# Configure DHCP for the main office
DhcpSet /START:192.168.100.10 /END:192.168.100.100 /MASK:255.255.255.0 /GW:192.168.100.1

# Configure virtual NAT
NatSet /MTU:1500 /LOG:yes

# Create a virtual L3 switch
exit
Layer3Add L3SW

# Add an interface to the Hub
Layer3IfAdd L3SW /HUB:ROUTING /IP:192.168.100.1 /MASK:255.255.255.0

# Add a route to the branch network
Layer3TableAdd L3SW /NETWORK:192.168.2.0 /MASK:255.255.255.0 /GATEWAY:192.168.100.200

Step 2: Configure the Branch Office

# Configure the branch VPN Server as a client
vpncmd localhost /server

# Create a local Hub
HubCreate LOCAL /PASSWORD:localpass

Hub LOCAL

# Enable SecureNAT for the branch
SecureNatEnable
DhcpSet /START:192.168.200.10 /END:192.168.200.100 /MASK:255.255.255.0 /GW:192.168.200.1

# Create a cascade connection to the main office
exit
Hub ROUTING
CascadeCreate "HeadQuarters" /SERVER:hq.company.com:443 /HUB:ROUTING /USERNAME:branch_router
CascadePasswordSet "HeadQuarters" /PASSWORD:router_pass_2024
CascadeOnline "HeadQuarters"

# Configure the L3 switch for the branch
Layer3Add BRANCH_L3SW
Layer3IfAdd BRANCH_L3SW /HUB:LOCAL /IP:192.168.200.1 /MASK:255.255.255.0
Layer3IfAdd BRANCH_L3SW /HUB:ROUTING /IP:192.168.200.200 /MASK:255.255.255.0

# Add a route to the main office
Layer3TableAdd BRANCH_L3SW /NETWORK:192.168.1.0 /MASK:255.255.255.0 /GATEWAY:192.168.100.1

Step 3: Configure Routing on the Workstations

Main office:

# Add a route to the branch
route add 192.168.2.0 mask 255.255.255.0 192.168.100.1

Branch office:

# Add a route to the main office
route add 192.168.1.0 mask 255.255.255.0 192.168.200.1

Mixed VPN: LAN-to-LAN and Remote Access

A comprehensive configuration that combines office interconnection with remote employees.

Architecture

Remote employees ←→ Internet ←→ VPN Server ←→ Corporate network
                                     ↕
                                 Branch offices

Configuring a Multi-Purpose Server

# Create a Hub for the corporate network
HubCreate CORPORATE /PASSWORD:corppass

Hub CORPORATE

# User groups
GroupCreate remote_employees /NOTE:"Remote employees"
GroupCreate branch_connections /NOTE:"Branch connections"

# Policies for remote employees
GroupPolicySet remote_employees /NAME:MaxConnection /VALUE:2
GroupPolicySet remote_employees /NAME:TimeOut /VALUE:1800
GroupPolicySet remote_employees /NAME:MaxUpload /VALUE:2000000
GroupPolicySet remote_employees /NAME:MaxDownload /VALUE:10000000

# Policies for branches (no limits)
GroupPolicySet branch_connections /NAME:MaxConnection /VALUE:999
GroupPolicySet branch_connections /NAME:TimeOut /VALUE:0

# Create users for remote access
UserCreate john.smith /GROUP:remote_employees /REALNAME:"John Smith - Sales"
UserPasswordSet john.smith /PASSWORD:john_remote_2024

UserCreate mary.jones /GROUP:remote_employees /REALNAME:"Mary Jones - Marketing"
UserPasswordSet mary.jones /PASSWORD:mary_remote_2024

# Create users for branches
UserCreate branch_moscow /GROUP:branch_connections /REALNAME:"Moscow Branch Bridge"
UserPasswordSet branch_moscow /PASSWORD:moscow_bridge_2024

UserCreate branch_spb /GROUP:branch_connections /REALNAME:"SPB Branch Bridge"
UserPasswordSet branch_spb /PASSWORD:spb_bridge_2024

# Configure access
# Grant branches full access
AccessAdd /RULENAME:"Branch Full Access" /PRIORITY:100 /SRC_GROUP:branch_connections /ACTION:allow

# Restrict remote employees
AccessAdd /RULENAME:"Remote Web Access" /PRIORITY:200 /SRC_GROUP:remote_employees /DEST_PORT:80,443 /ACTION:allow
AccessAdd /RULENAME:"Remote Email Access" /PRIORITY:201 /SRC_GROUP:remote_employees /DEST_IP:192.168.1.20 /DEST_PORT:25,143,993,995 /ACTION:allow
AccessAdd /RULENAME:"Remote File Server" /PRIORITY:202 /SRC_GROUP:remote_employees /DEST_IP:192.168.1.10 /DEST_PORT:445 /ACTION:allow

# Create a local bridge
exit
BridgeCreate CORPORATE /DEVICE:"Local Area Connection"

Creating a Large-Scale Remote Access VPN Service

Clustering is used to serve a large number of users.

Cluster Architecture

Load Balancer ←→ VPN Server 1 (Controller)
                ↕
              VPN Server 2 (Member)
                ↕  
              VPN Server 3 (Member)

Configuring the Cluster Controller

# Configure the main server (controller)
vpncmd localhost /server

# Enable cluster mode
ClusterSettingSet /CONTROLLER:yes /PASSWORD:cluster_secret_2024

# Create a Hub for users
HubCreate USERS /PASSWORD:userspass

Hub USERS

# Bulk user creation (example script)
# for i in {1..1000}; do
#   UserCreate user$i /GROUP:standard_users /REALNAME:"User $i"
#   UserPasswordSet user$i /PASSWORD:defaultpass$i
# done

# Configure policies for scaling
GroupCreate standard_users
GroupPolicySet standard_users /NAME:MaxConnection /VALUE:1
GroupPolicySet standard_users /NAME:TimeOut /VALUE:3600
GroupPolicySet standard_users /NAME:MaxUpload /VALUE:1000000
GroupPolicySet standard_users /NAME:MaxDownload /VALUE:5000000

# Enable SecureNAT with a large address pool
SecureNatEnable
DhcpSet /START:10.0.1.10 /END:10.0.10.254 /MASK:255.255.0.0 /GW:10.0.0.1 /DNS:8.8.8.8 /DNS2:8.8.4.4

Adding Servers to the Cluster

# On each additional server
vpncmd localhost /server

# Connect to the cluster
ClusterSettingSet /CONTROLLER:no /CONNECTTO:cluster-controller.company.com /PASSWORD:cluster_secret_2024

Monitoring the Cluster

# View cluster status
ClusterStatusGet

# Statistics for all servers
ClusterMemberInfoGet

Creating a Large-Scale Virtual Hub Hosting Service

Providing isolated VPN services for multiple clients.

Multi-Tenant Service Architecture

# Create a separate Hub for each client
HubCreate CLIENT_COMPANY_A /PASSWORD:companyA_admin_pass
HubCreate CLIENT_COMPANY_B /PASSWORD:companyB_admin_pass
HubCreate CLIENT_COMPANY_C /PASSWORD:companyC_admin_pass

# Configure isolation between clients
Hub CLIENT_COMPANY_A
AccessAdd /RULENAME:"Block Inter-Client" /PRIORITY:1 /SRC_IP:any /DEST_HUB:CLIENT_COMPANY_B /ACTION:deny
AccessAdd /RULENAME:"Block Inter-Client" /PRIORITY:2 /SRC_IP:any /DEST_HUB:CLIENT_COMPANY_C /ACTION:deny

# Do the same for the other clients...

# Create administrators for each client
# (clients manage only their own Hub)
AdminCreate companyA_admin /PASSWORD:adminA_pass /HUB:CLIENT_COMPANY_A
AdminCreate companyB_admin /PASSWORD:adminB_pass /HUB:CLIENT_COMPANY_B

Home PC as a VPN Relay to Secure WiFi

Using a home computer to create a secure VPN connection.

Use Case

Protecting traffic on public WiFi networks through a home VPN server.

Configuring the Home VPN Server

# Simple home server configuration
vpncmd localhost /server

HubCreate HOME_VPN /PASSWORD:homepass

Hub HOME_VPN

# Create a user for mobile devices
UserCreate mobile_user /REALNAME:"Mobile Devices Access"
UserPasswordSet mobile_user /PASSWORD:home_vpn_2024

# Enable SecureNAT for internet access
SecureNatEnable
DhcpSet /START:192.168.30.10 /END:192.168.30.100 /MASK:255.255.255.0 /GW:192.168.30.1 /DNS:8.8.8.8

# Configure port forwarding on the router for port 443

Configuring the Client for a Mobile Device

# On a laptop/phone
AccountCreate "Home VPN" /SERVER:home.dyndns.org:443 /HUB:HOME_VPN /USERNAME:mobile_user /NICNAME:"Home Connection"
AccountPasswordSet "Home VPN" /PASSWORD:home_vpn_2024
AccountConnect "Home VPN"

Using SecureNAT for Remote Access Without Permissions

Working around corporate restrictions using SecureNAT.

Scenario

An employee wants to access the corporate network, but the IT department cannot set up special routing.

Configuring a “Stealth” VPN

# Configure the server with SecureNAT
HubCreate STEALTH_ACCESS /PASSWORD:stealthpass

Hub STEALTH_ACCESS

UserCreate stealth_user /REALNAME:"Stealth Access User"
UserPasswordSet stealth_user /PASSWORD:stealth_secret_2024

# Enable SecureNAT for full access
SecureNatEnable

# Configure NAT for access to the corporate network
# SecureNAT will automatically provide access to all resources
# available to the server

# Configure thin tunneling only for corporate traffic
DhcpSet /START:172.16.1.10 /END:172.16.1.100 /MASK:255.255.255.0 /GW:172.16.1.1 

# The client will gain access to the corporate network
# through the server's NAT translation
Reviewed by OpenNix LLC · Last updated on
Installing SoftEther VPN BridgeTroubleshooting and Advanced Guide