# VPN Network Setup Examples

> Hands-on SoftEther VPN topology examples - site-to-site tunnels, remote access, cascade connections, and linking branch office networks over the internet

Source: https://opennix.org/en/docs/softether-vpn/manual/softether-vpn-network-examples/

## VPN Network Setup Examples

This chapter provides practical examples of building various types of VPN networks with SoftEther VPN.

### VPN Types

VPN topologies can be divided into three main types:

#### PC-to-PC VPN

- Simple connection between two computers
- Minimal configuration
- Suitable for personal use

#### Remote Access VPN

- Connects remote users to a corporate network
- Central VPN server
- Multiple client connections

#### LAN-to-LAN VPN

- Connects geographically separated networks
- Permanent tunnels between offices
- Transparent connectivity for all devices

### General Concepts and Background

Before configuring any type of VPN, you need to understand the following concepts:

#### IP Addressing in a VPN

**Virtual IP addresses:**

- Each VPN client is assigned a virtual IP address
- Virtual addresses must belong to a separate subnet
- It is recommended to use private ranges (RFC 1918)

**Address allocation examples:**
```
Corporate network:      192.168.1.0/24
VPN clients:           192.168.10.0/24  
Branch 1:              192.168.20.0/24
Branch 2:              192.168.30.0/24
```

#### DHCP in a VPN

SoftEther VPN can provide IP addresses to clients through:

- **SecureNAT**: built-in DHCP server
- **Local Bridge**: using an existing DHCP server
- **Static addresses**: manual assignment

#### Routing

**Automatic routing:**

- The VPN Client automatically creates routes to the virtual network
- All traffic can be forced through the VPN

**Manual routing:**
```bash
# Windows - add a static route
route add 192.168.1.0 mask 255.255.255.0 192.168.10.1

# Linux - add a static route  
ip route add 192.168.1.0/24 via 192.168.10.1
```

### Creating a PC-to-PC VPN

This is the simplest VPN type, connecting two computers directly.

#### Architecture

```
Computer A ←→ Internet ←→ Computer B
    (Client)                    (Server)
```

#### Step 1: Configure the VPN Server (Computer B)

```bash
# Connect to the server
vpncmd localhost /server

# Create a Virtual Hub
HubCreate PCTOPC /PASSWORD:hubpass

# Switch to the created Hub
Hub PCTOPC

# Create a user for Computer A
UserCreate computerA /REALNAME:"Computer A User"
UserPasswordSet computerA /PASSWORD:pctopcpass

# Enable SecureNAT for automatic network configuration
SecureNatEnable

# Configure DHCP (optional)
DhcpSet /START:192.168.30.10 /END:192.168.30.200 /MASK:255.255.255.0 /GW:192.168.30.1
```

#### Step 2: Configure the VPN Client (Computer A)

```bash
# Connect to the client
vpncmd localhost /client

# Create a virtual adapter
NicCreate "PC to PC Connection"

# Create the VPN connection
AccountCreate "Connect to Computer B" /SERVER:computer-b-ip:443 /HUB:PCTOPC /USERNAME:computerA /NICNAME:"PC to PC Connection"

# Set the password
AccountPasswordSet "Connect to Computer B" /PASSWORD:pctopcpass

# Connect
AccountConnect "Connect to Computer B"
```

#### Step 3: Verify the Connection

On both computers, check:

```bash
# Windows
ipconfig
ping 192.168.30.1

# Linux  
ip addr show
ping 192.168.30.1
```

### Creating a Remote Access VPN (PC to LAN)

This VPN type lets remote users connect to a corporate network.

#### Architecture

```
Remote employee ←→ Internet ←→ VPN Server ←→ Corporate LAN
     (VPN Client)                   (in the office)   (192.168.1.0/24)
```

#### Step 1: Configure the VPN Server in the Office

```bash
# Connect to the server
vpncmd localhost /server

# Create the corporate Hub
HubCreate CORPORATE /PASSWORD:corppass

# Switch to the Hub
Hub CORPORATE

# Create user groups
GroupCreate employees /NOTE:"Regular employees"
GroupCreate management /NOTE:"Management group"

# Configure policies for employees
GroupPolicySet employees /NAME:MaxConnection /VALUE:3
GroupPolicySet employees /NAME:TimeOut /VALUE:300
GroupPolicySet employees /NAME:MaxUpload /VALUE:1000000
GroupPolicySet employees /NAME:MaxDownload /VALUE:5000000

# Create users
UserCreate john /GROUP:employees /REALNAME:"John Smith" /NOTE:"Sales Manager"
UserPasswordSet john /PASSWORD:johnpass

UserCreate alice /GROUP:management /REALNAME:"Alice Johnson" /NOTE:"IT Director"  
UserPasswordSet alice /PASSWORD:alicepass

# Create a local bridge to the corporate network
exit
BridgeCreate CORPORATE /DEVICE:"Local Area Connection"
```

#### Step 2: Configure the Clients

**John's client:**
```bash
vpncmd localhost /client

NicCreate "Company VPN"

AccountCreate "Corporate Access" /SERVER:vpn.company.com:443 /HUB:CORPORATE /USERNAME:john /NICNAME:"Company VPN"

AccountPasswordSet "Corporate Access" /PASSWORD:johnpass

AccountConnect "Corporate Access"
```

#### Step 3: Advanced Server Configuration

**Configuring access lists:**
```bash
Hub CORPORATE

# Allow access to the file server for management only
AccessAdd /RULENAME:"File Server Access" /PRIORITY:100 /SRC_USERNAME:management /DEST_IP:192.168.1.10 /ACTION:allow

# Block P2P traffic for everyone
AccessAdd /RULENAME:"Block P2P" /PRIORITY:200 /DEST_PORT:6881-6999 /PROTOCOL:TCP /ACTION:deny
```

**Configuring logging:**
```bash
# Log connections
LogEnable connection /SWITCH:yes

# Log security events
LogEnable security /SWITCH:yes
```

### Creating a LAN-to-LAN VPN (Using an L2 Bridge)

This VPN type connects two or more local networks, creating a single distributed network at Layer 2.

#### Architecture

```
Office A (192.168.1.0/24) ←→ VPN Bridge ←→ Internet ←→ VPN Server ←→ Office B (192.168.1.0/24)
```

#### Scenario: Connecting the Main Office to a Branch

**Main office:**

- Network: 192.168.1.0/24
- VPN Server installed on a server
- Local bridge to the corporate network

**Branch office:**

- Network: 192.168.1.0/24 (the same subnet!)
- VPN Bridge to connect to the main office
- Transparent extension of the corporate network

#### Step 1: Configure the VPN Server (Main Office)

```bash
# Configure the server
vpncmd localhost /server

# Create a Hub for connecting to the branch
HubCreate BRANCH_NETWORK /PASSWORD:branchpass

# Switch to the Hub
Hub BRANCH_NETWORK

# Create a user for the branch VPN Bridge
UserCreate branch_bridge /REALNAME:"Branch Office Bridge" /NOTE:"Automatic branch connection"
UserPasswordSet branch_bridge /PASSWORD:bridge_secret_2024

# Create a local bridge to the corporate network
exit
BridgeCreate BRANCH_NETWORK /DEVICE:"Local Area Connection"
```

#### Step 2: Configure the VPN Bridge (Branch Office)

```bash
# Connect to the Bridge
vpncmd localhost /bridge

# Create a cascade connection to the main office
CascadeCreate "MainOffice" /SERVER:hq.company.com:443 /HUB:BRANCH_NETWORK /USERNAME:branch_bridge

# Set the password for the cascade
CascadePasswordSet "MainOffice" /PASSWORD:bridge_secret_2024

# Configure additional parameters
CascadeSet "MainOffice" /KEEPALIVE:yes /USECOMPRESS:yes

# Create a local bridge to the branch network
BridgeCreate LocalBranch /DEVICE:"Local Area Connection"

# Bring the cascade online
CascadeOnline "MainOffice"
```

#### Step 3: Verify Connectivity

Once configured, computers at the branch should have direct access to the main office resources:

```bash
# From the branch, ping the main office server
ping 192.168.1.10

# Access shared folders
\\192.168.1.10\shared

# Work with corporate applications
# (no additional configuration required)
```

### Creating a LAN-to-LAN VPN (Using L3 IP Routing)

This approach creates a Layer 3 connection between networks with different IP subnets.

#### Architecture

```
Office A (192.168.1.0/24) ←→ VPN Server ←→ Internet ←→ VPN Server ←→ Office B (192.168.2.0/24)
                              (Router)                      (Router)
```

#### Scenario: Connecting Offices with Different Subnets

**Main office:**

- Local network: 192.168.1.0/24
- VPN subnet: 192.168.100.0/24

**Branch office:**

- Local network: 192.168.2.0/24  
- VPN subnet: 192.168.200.0/24

#### Step 1: Configure the Main Office

```bash
# Configure the VPN Server
vpncmd localhost /server

# Create a Hub for routing
HubCreate ROUTING /PASSWORD:routepass

Hub ROUTING

# Create a user for the branch
UserCreate branch_router /REALNAME:"Branch Router Connection"
UserPasswordSet branch_router /PASSWORD:router_pass_2024

# Enable SecureNAT for the local office
SecureNatEnable

# Configure DHCP for the main office
DhcpSet /START:192.168.100.10 /END:192.168.100.100 /MASK:255.255.255.0 /GW:192.168.100.1

# Configure virtual NAT
NatSet /MTU:1500 /LOG:yes

# Create a virtual L3 switch
exit
Layer3Add L3SW

# Add an interface to the Hub
Layer3IfAdd L3SW /HUB:ROUTING /IP:192.168.100.1 /MASK:255.255.255.0

# Add a route to the branch network
Layer3TableAdd L3SW /NETWORK:192.168.2.0 /MASK:255.255.255.0 /GATEWAY:192.168.100.200
```

#### Step 2: Configure the Branch Office

```bash
# Configure the branch VPN Server as a client
vpncmd localhost /server

# Create a local Hub
HubCreate LOCAL /PASSWORD:localpass

Hub LOCAL

# Enable SecureNAT for the branch
SecureNatEnable
DhcpSet /START:192.168.200.10 /END:192.168.200.100 /MASK:255.255.255.0 /GW:192.168.200.1

# Create a cascade connection to the main office
exit
Hub ROUTING
CascadeCreate "HeadQuarters" /SERVER:hq.company.com:443 /HUB:ROUTING /USERNAME:branch_router
CascadePasswordSet "HeadQuarters" /PASSWORD:router_pass_2024
CascadeOnline "HeadQuarters"

# Configure the L3 switch for the branch
Layer3Add BRANCH_L3SW
Layer3IfAdd BRANCH_L3SW /HUB:LOCAL /IP:192.168.200.1 /MASK:255.255.255.0
Layer3IfAdd BRANCH_L3SW /HUB:ROUTING /IP:192.168.200.200 /MASK:255.255.255.0

# Add a route to the main office
Layer3TableAdd BRANCH_L3SW /NETWORK:192.168.1.0 /MASK:255.255.255.0 /GATEWAY:192.168.100.1
```

#### Step 3: Configure Routing on the Workstations

**Main office:**
```bash
# Add a route to the branch
route add 192.168.2.0 mask 255.255.255.0 192.168.100.1
```

**Branch office:**
```bash
# Add a route to the main office
route add 192.168.1.0 mask 255.255.255.0 192.168.200.1
```

### Mixed VPN: LAN-to-LAN and Remote Access

A comprehensive configuration that combines office interconnection with remote employees.

#### Architecture

```
Remote employees ←→ Internet ←→ VPN Server ←→ Corporate network
                                     ↕
                                 Branch offices
```

#### Configuring a Multi-Purpose Server

```bash
# Create a Hub for the corporate network
HubCreate CORPORATE /PASSWORD:corppass

Hub CORPORATE

# User groups
GroupCreate remote_employees /NOTE:"Remote employees"
GroupCreate branch_connections /NOTE:"Branch connections"

# Policies for remote employees
GroupPolicySet remote_employees /NAME:MaxConnection /VALUE:2
GroupPolicySet remote_employees /NAME:TimeOut /VALUE:1800
GroupPolicySet remote_employees /NAME:MaxUpload /VALUE:2000000
GroupPolicySet remote_employees /NAME:MaxDownload /VALUE:10000000

# Policies for branches (no limits)
GroupPolicySet branch_connections /NAME:MaxConnection /VALUE:999
GroupPolicySet branch_connections /NAME:TimeOut /VALUE:0

# Create users for remote access
UserCreate john.smith /GROUP:remote_employees /REALNAME:"John Smith - Sales"
UserPasswordSet john.smith /PASSWORD:john_remote_2024

UserCreate mary.jones /GROUP:remote_employees /REALNAME:"Mary Jones - Marketing"
UserPasswordSet mary.jones /PASSWORD:mary_remote_2024

# Create users for branches
UserCreate branch_moscow /GROUP:branch_connections /REALNAME:"Moscow Branch Bridge"
UserPasswordSet branch_moscow /PASSWORD:moscow_bridge_2024

UserCreate branch_spb /GROUP:branch_connections /REALNAME:"SPB Branch Bridge"
UserPasswordSet branch_spb /PASSWORD:spb_bridge_2024

# Configure access
# Grant branches full access
AccessAdd /RULENAME:"Branch Full Access" /PRIORITY:100 /SRC_GROUP:branch_connections /ACTION:allow

# Restrict remote employees
AccessAdd /RULENAME:"Remote Web Access" /PRIORITY:200 /SRC_GROUP:remote_employees /DEST_PORT:80,443 /ACTION:allow
AccessAdd /RULENAME:"Remote Email Access" /PRIORITY:201 /SRC_GROUP:remote_employees /DEST_IP:192.168.1.20 /DEST_PORT:25,143,993,995 /ACTION:allow
AccessAdd /RULENAME:"Remote File Server" /PRIORITY:202 /SRC_GROUP:remote_employees /DEST_IP:192.168.1.10 /DEST_PORT:445 /ACTION:allow

# Create a local bridge
exit
BridgeCreate CORPORATE /DEVICE:"Local Area Connection"
```

### Creating a Large-Scale Remote Access VPN Service

Clustering is used to serve a large number of users.

#### Cluster Architecture

```
Load Balancer ←→ VPN Server 1 (Controller)
                ↕
              VPN Server 2 (Member)
                ↕  
              VPN Server 3 (Member)
```

#### Configuring the Cluster Controller

```bash
# Configure the main server (controller)
vpncmd localhost /server

# Enable cluster mode
ClusterSettingSet /CONTROLLER:yes /PASSWORD:cluster_secret_2024

# Create a Hub for users
HubCreate USERS /PASSWORD:userspass

Hub USERS

# Bulk user creation (example script)
# for i in {1..1000}; do
#   UserCreate user$i /GROUP:standard_users /REALNAME:"User $i"
#   UserPasswordSet user$i /PASSWORD:defaultpass$i
# done

# Configure policies for scaling
GroupCreate standard_users
GroupPolicySet standard_users /NAME:MaxConnection /VALUE:1
GroupPolicySet standard_users /NAME:TimeOut /VALUE:3600
GroupPolicySet standard_users /NAME:MaxUpload /VALUE:1000000
GroupPolicySet standard_users /NAME:MaxDownload /VALUE:5000000

# Enable SecureNAT with a large address pool
SecureNatEnable
DhcpSet /START:10.0.1.10 /END:10.0.10.254 /MASK:255.255.0.0 /GW:10.0.0.1 /DNS:8.8.8.8 /DNS2:8.8.4.4
```

#### Adding Servers to the Cluster

```bash
# On each additional server
vpncmd localhost /server

# Connect to the cluster
ClusterSettingSet /CONTROLLER:no /CONNECTTO:cluster-controller.company.com /PASSWORD:cluster_secret_2024
```

#### Monitoring the Cluster

```bash
# View cluster status
ClusterStatusGet

# Statistics for all servers
ClusterMemberInfoGet
```

### Creating a Large-Scale Virtual Hub Hosting Service

Providing isolated VPN services for multiple clients.

#### Multi-Tenant Service Architecture

```bash
# Create a separate Hub for each client
HubCreate CLIENT_COMPANY_A /PASSWORD:companyA_admin_pass
HubCreate CLIENT_COMPANY_B /PASSWORD:companyB_admin_pass
HubCreate CLIENT_COMPANY_C /PASSWORD:companyC_admin_pass

# Configure isolation between clients
Hub CLIENT_COMPANY_A
AccessAdd /RULENAME:"Block Inter-Client" /PRIORITY:1 /SRC_IP:any /DEST_HUB:CLIENT_COMPANY_B /ACTION:deny
AccessAdd /RULENAME:"Block Inter-Client" /PRIORITY:2 /SRC_IP:any /DEST_HUB:CLIENT_COMPANY_C /ACTION:deny

# Do the same for the other clients...

# Create administrators for each client
# (clients manage only their own Hub)
AdminCreate companyA_admin /PASSWORD:adminA_pass /HUB:CLIENT_COMPANY_A
AdminCreate companyB_admin /PASSWORD:adminB_pass /HUB:CLIENT_COMPANY_B
```

### Home PC as a VPN Relay to Secure WiFi

Using a home computer to create a secure VPN connection.

#### Use Case

Protecting traffic on public WiFi networks through a home VPN server.

#### Configuring the Home VPN Server

```bash
# Simple home server configuration
vpncmd localhost /server

HubCreate HOME_VPN /PASSWORD:homepass

Hub HOME_VPN

# Create a user for mobile devices
UserCreate mobile_user /REALNAME:"Mobile Devices Access"
UserPasswordSet mobile_user /PASSWORD:home_vpn_2024

# Enable SecureNAT for internet access
SecureNatEnable
DhcpSet /START:192.168.30.10 /END:192.168.30.100 /MASK:255.255.255.0 /GW:192.168.30.1 /DNS:8.8.8.8

# Configure port forwarding on the router for port 443
```

#### Configuring the Client for a Mobile Device

```bash
# On a laptop/phone
AccountCreate "Home VPN" /SERVER:home.dyndns.org:443 /HUB:HOME_VPN /USERNAME:mobile_user /NICNAME:"Home Connection"
AccountPasswordSet "Home VPN" /PASSWORD:home_vpn_2024
AccountConnect "Home VPN"
```

### Using SecureNAT for Remote Access Without Permissions

Working around corporate restrictions using SecureNAT.

#### Scenario

An employee wants to access the corporate network, but the IT department cannot set up special routing.

#### Configuring a "Stealth" VPN

```bash
# Configure the server with SecureNAT
HubCreate STEALTH_ACCESS /PASSWORD:stealthpass

Hub STEALTH_ACCESS

UserCreate stealth_user /REALNAME:"Stealth Access User"
UserPasswordSet stealth_user /PASSWORD:stealth_secret_2024

# Enable SecureNAT for full access
SecureNatEnable

# Configure NAT for access to the corporate network
# SecureNAT will automatically provide access to all resources
# available to the server

# Configure thin tunneling only for corporate traffic
DhcpSet /START:172.16.1.10 /END:172.16.1.100 /MASK:255.255.255.0 /GW:172.16.1.1 

# The client will gain access to the corporate network
# through the server's NAT translation
```