Troubleshooting and Advanced Guide

Troubleshooting

Connection Problems

Symptom: VPN Client cannot connect to the server

Possible causes and solutions:

Network connectivity issues

# Check server reachability
ping vpn.company.com
telnet vpn.company.com 443

Blocked by the firewall

# Windows - check firewall rules
netsh advfirewall firewall show rule name="SoftEther VPN"

# Linux - check iptables
sudo iptables -L | grep 443

Invalid credentials

# Check the user on the server
vpncmd localhost /server /hub:MYHUB /cmd:UserGet username

Performance Problems

Symptom: Slow VPN connection speed

Diagnostics and optimization:

Check data compression

# Enable compression on the client
AccountSet "Connection Name" /USECOMPRESS:yes

Configure UDP acceleration

# Enable UDP acceleration
AccountSet "Connection Name" /USEUDP:yes

Optimize encryption

# Use faster encryption
AccountSet "Connection Name" /ENCRYPTNAME:RC4-MD5

Authentication Problems

Symptom: Authentication errors when connecting

Check the user status

vpncmd localhost /server /hub:MYHUB /cmd:UserGet john

Reset the user password

UserPasswordSet john /PASSWORD:newpassword

Check group policies
```
GroupPolicyGet employees
```

11.1.4 Local Bridge Problems

Symptom: Local bridge does not forward traffic

Check the bridge status
```
BridgeList
```

Check the network adapter

# Windows
ipconfig /all

# Linux
ip link show

Network adapter access rights

# Linux - check permissions
sudo chmod 666 /dev/net/tun

DNS Problems

Symptom: Name resolution over the VPN does not work

Check DNS settings in SecureNAT
```
DhcpGet
```

Manually configure DNS on the client

# Windows
netsh interface ip set dns "VPN Connection" static 8.8.8.8

# Linux
echo "nameserver 8.8.8.8" > /etc/resolv.conf

NAT Traversal Problems

Symptom: Connection cannot be established because of NAT/firewall

Force TCP usage
```
AccountSet "Connection" /USEUDP:no
```

Configure an HTTP proxy

AccountProxySet "Connection" /TYPE:http /SERVER:proxy.company.com:8080

Use alternative ports

# Connect over port 80 or 8080
AccountSet "Connection" /SERVER:vpn.company.com:80

Useful Information

Dynamic DNS and NAT Traversal

SoftEther VPN includes built-in support for dynamic DNS:

# Configure a dynamic DNS hostname
DynamicDnsSetHostname myvpnserver

# Check the assigned hostname
DynamicDnsGetHostname

IPv6 Tunneling

Configuring IPv6 support over the VPN:

# Enable IPv6 in SecureNAT
NatSet /ENABLEIPV6:yes

# Configure IPv6 DHCP
DhcpSet /IPV6_PREFIX:2001:db8::/64 /IPV6_PREFIX_LEN:64

Wake on LAN over the VPN

Remotely powering on computers over the VPN:

# Send a Magic Packet over the VPN
vpncmd localhost /tools
SendWakeOnLan 01:23:45:67:89:AB

Connection Monitoring

A script for monitoring active VPN sessions:

#!/bin/bash
# monitor_vpn.sh

while true; do
    echo "=== VPN Sessions at $(date) ==="
    vpncmd localhost /server /hub:CORPORATE /cmd:SessionList | grep "Session Name"
    echo "================================"
    sleep 60
done

Automatic Configuration Backup

#!/bin/bash
# backup_config.sh

DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_DIR="/backup/vpn/"

mkdir -p $BACKUP_DIR

vpncmd localhost /server /cmd:ConfigGet /SAVEFILE:${BACKUP_DIR}/config_${DATE}.backup

# Remove old backups (older than 30 days)
find $BACKUP_DIR -name "config_*.backup" -mtime +30 -delete

General Additional Information

Compatibility with Antivirus Software

SoftEther VPN is compatible with most antivirus solutions. If problems arise:

Add the VPN executables to the antivirus exclusions
Allow VPN traffic through the antivirus firewall
Temporarily disable proactive protection for testing

Optimization for Different Connection Types

For mobile connections:

AccountSet "Mobile" /USECOMPRESS:yes /USEENCRYPT:yes /HALF_CONNECTION:yes

For high-speed connections:

AccountSet "HighSpeed" /USEUDP:yes /UDP_ACCELERATION:yes /USECOMPRESS:no

For unreliable connections:

AccountSet "Unreliable" /KEEPALIVE:yes /UDP_ACCELERATION:no /RETRY_INTERVAL:5

Integration with Active Directory

Configuring authentication through Active Directory:

# Configure RADIUS authentication for AD
RadiusServerAdd 192.168.1.100 /SECRET:radiussecret /PORT:1812

# Enable RADIUS authentication for users
UserCreate ad_user /AUTH:radius

Configuring SSL Certificates

Using your own SSL certificates:

# Load your own certificate
ServerCertSet /LOADCERT:server.crt /LOADKEY:server.key

# Create a self-signed certificate
MakeCert /CN:vpn.company.com /OU:"IT Department" /O:"Company Inc" /C:US /EXPIRES:2030-12-31 /SAVECERT:vpn.crt /SAVEKEY:vpn.key

Load Balancing

Configuring multiple servers to distribute the load:

# On the load balancer (for example, HAProxy)
# backend vpn_servers
#     balance roundrobin
#     server vpn1 192.168.1.10:443 check
#     server vpn2 192.168.1.11:443 check
#     server vpn3 192.168.1.12:443 check

Additional Security Information

Protection Against Viruses and Worms

SoftEther VPN does not provide antivirus protection on its own, but you can implement additional security measures:

Integration with IDS/IPS systems
Traffic filtering at the Access List level
Logging and monitoring of suspicious activity

Security Policies

Recommended security policies:

# Limit the session duration
GroupPolicySet employees /NAME:TimeOut /VALUE:3600

# Limit the number of simultaneous connections
GroupPolicySet employees /NAME:MaxConnection /VALUE:2

# Block certain protocols
AccessAdd /RULENAME:"Block P2P" /DEST_PORT:6881-6999 /ACTION:deny

Auditing and Compliance

To comply with corporate security requirements:

Enable detailed logging
Regularly analyze connection logs
Configure notifications for suspicious activity
Conduct regular configuration audits

Additional Information About Communication Protocols

Support for Various Protocols

SoftEther VPN supports transmitting various network protocols:

IP (IPv4/IPv6) - the primary protocol
IPX/SPX - for legacy Novell applications
NetBEUI - for legacy Microsoft networks
AppleTalk - for Apple networks (deprecated)

Multicast

SoftEther VPN supports forwarding multicast traffic:

# Enable multicast support in the Virtual Hub
# (enabled by default)

VoIP and Video Conferencing

Optimization for VoIP applications:

# Prioritize VoIP traffic
AccessAdd /RULENAME:"VoIP Priority" /DEST_PORT:5060 /PROTOCOL:UDP /PRIORITY:high

Additional Compatibility Information

Compatibility with Other VPN Solutions

SoftEther VPN can operate simultaneously with:

Cisco AnyConnect
OpenVPN clients
IPsec VPN
PPTP clients

Migration from Other VPN Solutions

Migration from OpenVPN:

SoftEther VPN supports OpenVPN clients directly
Configure the appropriate Listener on port 1194
Import your existing certificates

Migration from IPsec:

Configure L2TP/IPsec support
Use equivalent pre-shared keys
Gradually move clients over to SoftEther

Compatibility with Mobile Devices

SoftEther VPN supports connections from:

iOS devices (via L2TP/IPsec)
Android devices (via OpenVPN or L2TP/IPsec)
Windows Mobile
BlackBerry

Conclusion

This complete SoftEther VPN guide provides comprehensive information for deploying, configuring, and administering VPN infrastructure of any scale.

Key Advantages of SoftEther VPN

High performance - optimized algorithms and protocols
Maximum compatibility - support for many VPN protocols
Ease of deployment - intuitive management tools
Scalability - from small networks to enterprise solutions
Free to use - a fully featured solution with no restrictions

Implementation Recommendations

Start with a test deployment - explore the capabilities on a small network
Plan the architecture - think through the topology and security requirements
Automate processes - use vpncmd to script tasks
Monitor performance - regularly analyze logs and statistics
Keep it up to date - track updates and new features

Additional Resources

Official website: https://www.softether.org/
Documentation: https://www.softether.org/4-docs/
Community: forums and user groups
Technical support: through official channels

Reviewed by OpenNix LLC · Last updated on 30 July 2026

VPN Network Setup Examples VPN Network Setup Examples