Set Up OpenVPN, L2TP/IPsec and SSTP VPN with SoftEther

What is SoftEther VPN

SoftEther VPN is a free, open-source VPN server that supports many protocols: OpenVPN, L2TP/IPsec, SSTP and its own SoftEther protocol. It can pass through strict firewalls, and it can create a virtual Ethernet network over the VPN (Layer 2 bridging).

What you need

• A supported operating system (Windows, Linux, macOS or FreeBSD).
• Enough CPU, RAM and bandwidth for the number of users you expect.
• Administrator rights.
• A public IP address (or a dynamic DNS name) so clients can reach the server.
• Firewall rules and port forwarding for the VPN ports.
• Basic networking knowledge.

Ports used:

Install and open the server manager

1. Go to the SoftEther VPN website (softether.org) and download SoftEther VPN Server for your system. On Windows, also download the VPN Server Manager.
2. Install it and follow the instructions. On Linux, extract the package, run make and start the server with ./vpnserver start.
3. Open SoftEther VPN Server Manager and connect to the server. Set a strong administrator password when asked.

Create a Virtual Hub

A Virtual Hub is a virtual network where your VPN users connect.

1. Click Create a Virtual Hub, or use Manage Virtual Hub.
2. Enter a name for the hub and an administrator password, then click OK.

Enable OpenVPN and SSTP

1. In the Server Manager open OpenVPN / MS-SSTP Settings.
2. Tick Enable OpenVPN Clone Server Function and set the port numbers (default UDP 1194).
3. Tick Enable Microsoft SSTP VPN Clone Server Function and set the certificate options. SSTP needs a certificate whose name matches the host name that clients use.
4. Click OK.

Enable L2TP/IPsec

1. Open IPsec / L2TP / EtherIP / L2TPv3 Settings.
2. Tick Enable L2TP Server Function (L2TP over IPsec).
3. Enter an IPsec Pre-Shared Key, and keep it secret. Choose the default Virtual Hub for the L2TP users.
4. Click OK.

Create users

1. Select the Virtual Hub and click Manage Users.
2. Click New and enter a user name and a password (or another authentication type).
3. Set the permissions you need.

Make sure the server runs

The server runs after you installed it. On Linux, use ./vpnserver start, or create a systemd service so it starts at boot. Check that the firewall allows the ports from the table above.

Set up the clients

• OpenVPN: In the Server Manager click OpenVPN / MS-SSTP Settings, then Generate a Sample Configuration File for OpenVPN Client. Import it into the OpenVPN client.
• L2TP/IPsec: Add a VPN connection in your device with the server address, the pre-shared key and the user name and password.
• SSTP: Use the built-in Windows VPN client with the type Secure Socket Tunneling Protocol (SSTP).

Quick recap

• Create a Virtual Hub and users, enable the protocols and open the ports.
• Import the generated config into the client.