# Troubleshooting and Advanced Guide

> Troubleshoot SoftEther VPN - resolve connection issues, configure firewalls, optimize performance, and tune advanced parameters

Source: https://opennix.org/en/docs/softether-vpn/manual/softether-vpn-troubleshooting/

## Troubleshooting

#### Connection Problems

**Symptom: VPN Client cannot connect to the server**

Possible causes and solutions:

1. **Network connectivity issues**
   ```bash
   # Check server reachability
   ping vpn.company.com
   telnet vpn.company.com 443
   ```

2. **Blocked by the firewall**
   ```bash
   # Windows - check firewall rules
   netsh advfirewall firewall show rule name="SoftEther VPN"
   
   # Linux - check iptables
   sudo iptables -L | grep 443
   ```

3. **Invalid credentials**
   ```bash
   # Check the user on the server
   vpncmd localhost /server /hub:MYHUB /cmd:UserGet username
   ```

#### Performance Problems

**Symptom: Slow VPN connection speed**

Diagnostics and optimization:

1. **Check data compression**
   ```bash
   # Enable compression on the client
   AccountSet "Connection Name" /USECOMPRESS:yes
   ```

2. **Configure UDP acceleration**
   ```bash
   # Enable UDP acceleration
   AccountSet "Connection Name" /USEUDP:yes
   ```

3. **Optimize encryption**
   ```bash
   # Use faster encryption
   AccountSet "Connection Name" /ENCRYPTNAME:RC4-MD5
   ```

#### Authentication Problems

**Symptom: Authentication errors when connecting**

1. **Check the user status**
   ```bash
   vpncmd localhost /server /hub:MYHUB /cmd:UserGet john
   ```

2. **Reset the user password**
   ```bash
   UserPasswordSet john /PASSWORD:newpassword
   ```

3. **Check group policies**
   ```bash
   GroupPolicyGet employees
   ```

#### 11.1.4 Local Bridge Problems

**Symptom: Local bridge does not forward traffic**

1. **Check the bridge status**
   ```bash
   BridgeList
   ```

2. **Check the network adapter**
   ```bash
   # Windows
   ipconfig /all
   
   # Linux
   ip link show
   ```

3. **Network adapter access rights**
   ```bash
   # Linux - check permissions
   sudo chmod 666 /dev/net/tun
   ```

#### DNS Problems

**Symptom: Name resolution over the VPN does not work**

1. **Check DNS settings in SecureNAT**
   ```bash
   DhcpGet
   ```

2. **Manually configure DNS on the client**
   ```bash
   # Windows
   netsh interface ip set dns "VPN Connection" static 8.8.8.8
   
   # Linux
   echo "nameserver 8.8.8.8" > /etc/resolv.conf
   ```

#### NAT Traversal Problems

**Symptom: Connection cannot be established because of NAT/firewall**

1. **Force TCP usage**
   ```bash
   AccountSet "Connection" /USEUDP:no
   ```

2. **Configure an HTTP proxy**
   ```bash
   AccountProxySet "Connection" /TYPE:http /SERVER:proxy.company.com:8080
   ```

3. **Use alternative ports**
   ```bash
   # Connect over port 80 or 8080
   AccountSet "Connection" /SERVER:vpn.company.com:80
   ```

## Useful Information

#### Dynamic DNS and NAT Traversal

SoftEther VPN includes built-in support for dynamic DNS:

```bash
# Configure a dynamic DNS hostname
DynamicDnsSetHostname myvpnserver

# Check the assigned hostname
DynamicDnsGetHostname
```

#### IPv6 Tunneling

Configuring IPv6 support over the VPN:

```bash
# Enable IPv6 in SecureNAT
NatSet /ENABLEIPV6:yes

# Configure IPv6 DHCP
DhcpSet /IPV6_PREFIX:2001:db8::/64 /IPV6_PREFIX_LEN:64
```

#### Wake on LAN over the VPN

Remotely powering on computers over the VPN:

```bash
# Send a Magic Packet over the VPN
vpncmd localhost /tools
SendWakeOnLan 01:23:45:67:89:AB
```

#### Connection Monitoring

A script for monitoring active VPN sessions:

```bash
#!/bin/bash
# monitor_vpn.sh

while true; do
    echo "=== VPN Sessions at $(date) ==="
    vpncmd localhost /server /hub:CORPORATE /cmd:SessionList | grep "Session Name"
    echo "================================"
    sleep 60
done
```

#### Automatic Configuration Backup

```bash
#!/bin/bash
# backup_config.sh

DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_DIR="/backup/vpn/"

mkdir -p $BACKUP_DIR

vpncmd localhost /server /cmd:ConfigGet /SAVEFILE:${BACKUP_DIR}/config_${DATE}.backup

# Remove old backups (older than 30 days)
find $BACKUP_DIR -name "config_*.backup" -mtime +30 -delete
```

## General Additional Information

#### Compatibility with Antivirus Software

SoftEther VPN is compatible with most antivirus solutions. If problems arise:

1. Add the VPN executables to the antivirus exclusions
2. Allow VPN traffic through the antivirus firewall
3. Temporarily disable proactive protection for testing

#### Optimization for Different Connection Types

**For mobile connections:**
```bash
AccountSet "Mobile" /USECOMPRESS:yes /USEENCRYPT:yes /HALF_CONNECTION:yes
```

**For high-speed connections:**
```bash
AccountSet "HighSpeed" /USEUDP:yes /UDP_ACCELERATION:yes /USECOMPRESS:no
```

**For unreliable connections:**
```bash
AccountSet "Unreliable" /KEEPALIVE:yes /UDP_ACCELERATION:no /RETRY_INTERVAL:5
```

#### Integration with Active Directory

Configuring authentication through Active Directory:

```bash
# Configure RADIUS authentication for AD
RadiusServerAdd 192.168.1.100 /SECRET:radiussecret /PORT:1812

# Enable RADIUS authentication for users
UserCreate ad_user /AUTH:radius
```

#### Configuring SSL Certificates

Using your own SSL certificates:

```bash
# Load your own certificate
ServerCertSet /LOADCERT:server.crt /LOADKEY:server.key

# Create a self-signed certificate
MakeCert /CN:vpn.company.com /OU:"IT Department" /O:"Company Inc" /C:US /EXPIRES:2030-12-31 /SAVECERT:vpn.crt /SAVEKEY:vpn.key
```

#### Load Balancing

Configuring multiple servers to distribute the load:

```bash
# On the load balancer (for example, HAProxy)
# backend vpn_servers
#     balance roundrobin
#     server vpn1 192.168.1.10:443 check
#     server vpn2 192.168.1.11:443 check
#     server vpn3 192.168.1.12:443 check
```

## Additional Security Information

#### Protection Against Viruses and Worms

SoftEther VPN does not provide antivirus protection on its own, but you can implement additional security measures:

1. **Integration with IDS/IPS systems**
2. **Traffic filtering at the Access List level**
3. **Logging and monitoring of suspicious activity**

#### Security Policies

Recommended security policies:

```bash
# Limit the session duration
GroupPolicySet employees /NAME:TimeOut /VALUE:3600

# Limit the number of simultaneous connections
GroupPolicySet employees /NAME:MaxConnection /VALUE:2

# Block certain protocols
AccessAdd /RULENAME:"Block P2P" /DEST_PORT:6881-6999 /ACTION:deny
```

#### Auditing and Compliance

To comply with corporate security requirements:

1. **Enable detailed logging**
2. **Regularly analyze connection logs**
3. **Configure notifications for suspicious activity**
4. **Conduct regular configuration audits**

## Additional Information About Communication Protocols

####  Support for Various Protocols

SoftEther VPN supports transmitting various network protocols:

- **IP (IPv4/IPv6)** - the primary protocol
- **IPX/SPX** - for legacy Novell applications
- **NetBEUI** - for legacy Microsoft networks
- **AppleTalk** - for Apple networks (deprecated)

#### Multicast

SoftEther VPN supports forwarding multicast traffic:

```bash
# Enable multicast support in the Virtual Hub
# (enabled by default)
```

#### VoIP and Video Conferencing

Optimization for VoIP applications:

```bash
# Prioritize VoIP traffic
AccessAdd /RULENAME:"VoIP Priority" /DEST_PORT:5060 /PROTOCOL:UDP /PRIORITY:high
```

## Additional Compatibility Information

#### Compatibility with Other VPN Solutions

SoftEther VPN can operate simultaneously with:
- **Cisco AnyConnect**
- **OpenVPN clients**
- **IPsec VPN**
- **PPTP clients**

#### Migration from Other VPN Solutions

**Migration from OpenVPN:**
1. SoftEther VPN supports OpenVPN clients directly
2. Configure the appropriate Listener on port 1194
3. Import your existing certificates

**Migration from IPsec:**
1. Configure L2TP/IPsec support
2. Use equivalent pre-shared keys
3. Gradually move clients over to SoftEther

#### Compatibility with Mobile Devices

SoftEther VPN supports connections from:
- **iOS devices** (via L2TP/IPsec)
- **Android devices** (via OpenVPN or L2TP/IPsec)
- **Windows Mobile**
- **BlackBerry**

---

## Conclusion

This complete SoftEther VPN guide provides comprehensive information for deploying, configuring, and administering VPN infrastructure of any scale.

### Key Advantages of SoftEther VPN

- **High performance** - optimized algorithms and protocols
- **Maximum compatibility** - support for many VPN protocols  
- **Ease of deployment** - intuitive management tools
- **Scalability** - from small networks to enterprise solutions
- **Free to use** - a fully featured solution with no restrictions

### Implementation Recommendations

1. **Start with a test deployment** - explore the capabilities on a small network
2. **Plan the architecture** - think through the topology and security requirements
3. **Automate processes** - use vpncmd to script tasks
4. **Monitor performance** - regularly analyze logs and statistics
5. **Keep it up to date** - track updates and new features

### Additional Resources

- **Official website**: https://www.softether.org/
- **Documentation**: https://www.softether.org/4-docs/
- **Community**: forums and user groups
- **Technical support**: through official channels