softethervpn / softethervpn

Cross-platform multi-protocol VPN software. Pull requests are welcome. The stable version is available at https://github.com/SoftEtherVPN/SoftEtherVPN_Stable.

SoftEther VPN

	Badges
GitLab CI
Coverity Scan
Cirrus CI

• SoftEther VPN
• BOARD MEMBERS OF THIS REPOSITORY
• SOFTETHER VPN ADVANTAGES
• Installation
  • For FreeBSD
  • For Windows
  • From binary installers (stable channel)
  • Build from Source code
• About HTML5-based Modern Admin Console and JSON-RPC API Suite
  • Built-in SoftEther VPN Server HTML5 Ajax-based Web Administration Console
  • Built-in SoftEther Server VPN JSON-RPC API Suite
• TO CIRCUMVENT YOUR GOVERNMENT'S FIREWALL RESTRICTION
• SOURCE CODE CONTRIBUTION
• DEAR SECURITY EXPERTS

SoftEther VPN (Developer Edition Master Repository)

• An Open-Source Cross-platform Multi-protocol VPN Program https://www.softether.org/

This repository has experimental codes. Pull requests are welcome.

Stable Edition is available on https://github.com/SoftEtherVPN/SoftEtherVPN_Stable which the non-developer user can stable use.

Please note that some features are not available in Stable Edition.

Source code packages (.zip and .tar.gz) and binary files of Stable Edition are also available:
https://www.softether-download.com/

Copyright (c) all contributors on SoftEther VPN project in GitHub. Copyright (c) Daiyuu Nobori, SoftEther Project at University of Tsukuba, and SoftEther Corporation.

---

The development of SoftEther VPN was supported by the MITOH Project, a research and development project by Japanese Government, subsidized by Ministry of Economy, Trade and Industry of Japan, administrated by Information Promotion Agency. https://www.ipa.go.jp/english/humandev/

---

Icons8 kindly supported the project by gifting a license which allows to edit and redistribute their icons.

Please note that you are not allowed to redistribute those icons outside of this repository.

The developers of SoftEther VPN love Icons8's work and kindly ask the users to support them as much as possible.

---

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

SoftEther VPN ("SoftEther" means "Software Ethernet") is one of the world's most powerful and easy-to-use multi-protocol VPN software.

SoftEther VPN runs on Windows, Linux, Mac, FreeBSD and Solaris.

SoftEther VPN supports most of widely-used VPN protocols including SSL-VPN, WireGuard, OpenVPN, IPsec, L2TP, MS-SSTP, L2TPv3 and EtherIP by the single SoftEther VPN Server program.

More details on https://www.softether.org/.

BOARD MEMBERS OF THIS REPOSITORY

Daiyuu Nobori (Since Jan 2, 2014) https://github.com/dnobori

Moataz Elmasry (Since Nov 6, 2017) https://github.com/moatazelmasry2

Zulyandri Zardi (Since Nov 6, 2017) https://github.com/zulzardi

Alex Maslakov (Since Nov 6, 2017) https://github.com/GildedHonour

Davide Beatrici (Since Jul 21, 2018) https://github.com/davidebeatrici

Ilya Shipitsin (Since Jul 21, 2018) https://github.com/chipitsine

SOFTETHER VPN ADVANTAGES

• Supporting all popular VPN protocols by the single VPN server: SSL-VPN (HTTPS) WireGuard OpenVPN IPsec L2TP MS-SSTP L2TPv3 EtherIP
• Free and open-source software.
• Easy to establish both remote-access and site-to-site VPN.
• SSL-VPN Tunneling on HTTPS to pass through NATs and firewalls.
• Revolutionary VPN over ICMP and VPN over DNS features.
• Resistance to highly-restricted firewall.
• Ethernet-bridging (L2) and IP-routing (L3) over VPN.
• Embedded dynamic-DNS and NAT-traversal so that no static nor fixed IP address is required.
• AES 256-bit and RSA 4096-bit encryptions.
• Sufficient security features such as logging and firewall inner VPN tunnel.
• User authentication with RADIUS and NT domain controllers.
• User authentication with X.509 client certificate.
• Packet logging.
• 1Gbps-class high-speed throughput performance with low memory and CPU usage.
• Windows, Linux, Mac, Android, iPhone, iPad and Windows Phone are supported.
• The OpenVPN clone function supports legacy OpenVPN clients.
• IPv4 / IPv6 dual-stack.
• The VPN server runs on Windows, Linux, FreeBSD, Solaris and Mac OS X.
• Configure All settings on GUI.
• Multi-languages (English, Japanese and Simplified-Chinese).
• No memory leaks. High quality stable codes, intended for long-term runs. We always verify that there are no memory or resource leaks before releasing the build.
• More details at https://www.softether.org/.

Comparison with Stable Edition

Protocol	Stable Edition (SE)	Developer Edition (DE)	Comment
SSL-VPN	✅	✅
OpenVPN	✅	✅	AEAD mode is supported in DE only.
IPsec	✅	✅
L2TP	✅	✅
MS-SSTP	✅	✅
L2TPv3	✅	✅
EtherIP	✅	✅
WireGuard	❌	✅
IKEv2	❌	❌

Feature	Stable Edition (SE)	Developer Edition (DE)	Comment
Password Authentication	✅	✅
RADIUS / NT Authentication	✅	✅
Certificate Authentication	⚠️	✅	SE supports the feature in SSL-VPN only.
IPv6-capable VPN Tunnel	⚠️	✅	SE supports IPv6 in L2 VPN tunnels only.
IPv4 Route Management	✅	✅	Windows clients only
IPv6 Route Management	❌	✅	Windows clients only
TLS Server Verification	⚠️	✅	In SE you need to specify the exact certificate or CA to verify. DE can perform standard TLS verification and use the system CA store.
Dual-stack Name Resolution	⚠️	✅	SE attempts in IPv6 only after IPv4 has failed.
ECDSA Certificates Import	❌	✅
Runs on Windows XP and Earlier	✅	❌
Compatible with SoftEther VPN 1.0	✅	❌
AES-NI Hardware Acceleration	⚠️	✅	SE requires intel_aes_lib to enable AES-NI, so x86 only. In DE, enabled by default as long as processor supports it (at least x86 and ARM).

Installation

For FreeBSD

SoftEther VPN in FreeBSD Ports Collection is maintained by Koichiro Iwao (@metalefty).

Binary package can be installed by pkg:

pkg install softether5

Alternatively, it can be built & installed by ports:

make install -C /usr/ports/security/softether5

To run SoftEther VPN Server:

service softether_server start

To configure SoftEther VPN Server startup on boot:

sysrc softether_server_enable=yes

Also SoftEther VPN Stable Edition and RTM version are available on FreeBSD.

For Windows

Nightly builds (choose appropriate platform, then find binaries or installers as artifacts)

From binary installers (stable channel)

Those can be found under https://www.softether-download.com/ There you can also find SoftEtherVPN source code in zip and tar formats.

Build from Source code

see BUILD_UNIX or BUILD_WINDOWS

There are two flavours of SoftEtherVPN source code:

1. Unstable. Found under https://github.com/SoftEtherVPN/SoftEtherVPN
2. Stable. Found under https://github.com/SoftEtherVPN/SoftEtherVPN_Stable

About HTML5-based Modern Admin Console and JSON-RPC API Suite

Built-in SoftEther VPN Server HTML5 Ajax-based Web Administration Console

We are developing the HTML5 Ajax-based Web Administration Console (currently very limited, under construction) in the embedded HTTPS server on the SoftEther VPN Server.

Access to the following URL from your favorite web browser.

https://<vpn_server_hostname>:<port>/admin/

For example if your VPN Server is running as the port 5555 on the host at 192.168.0.1, you can access to the web console by:

https://192.168.0.1:5555/admin/

Note: Your HTML5 development contribution is very appreciated. The current HTML5 pages are written by Daiyuu Nobori (the core developer of SoftEther VPN). He is obviously lack of HTML5 development ability. Please kindly consider to contribute for SoftEther VPN's development on GitHub. Your code will help every people running SoftEther VPN Server.

Built-in SoftEther Server VPN JSON-RPC API Suite

The API Suite allows you to easily develop your original SoftEther VPN Server management application to control the VPN Server (e.g. creating users, adding Virtual Hubs, disconnecting a specified VPN sessions).

You can access to the latest SoftEther VPN Server JSON-RPC Document on GitHub.

• Almost all control APIs, which the VPN Server provides, are available as JSON-RPC API. You can write your own VPN Server management application in your favorite languages (JavaScript, TypeScript, Java, Python, Ruby, C#, ... etc.)
• If you are planning to develop your own VPN cloud service, the JSON-RPC API is the best choice to realize the automated operations for the VPN Server.
• No need to use any specific API client library since all APIs are provided on the JSON-RPC 2.0 Specification. You can use your favorite JSON and HTTPS client library to call any of all APIs in your pure runtime environment.
• Also, the SoftEther VPN Project provides high-quality JSON-RPC client stub libraries which define all of the API client stub codes. These libraries are written in C#, JavaScript and TypeScript. The Node.js Client Library for VPN Server RPC (vpnrpc) package is also available.

TO CIRCUMVENT YOUR GOVERNMENT'S FIREWALL RESTRICTION

Because SoftEther VPN is overly strong tool to build a VPN tunnel, some censorship governments want to block your access to the source code of SoftEther VPN, by abusing their censorship firewalls.

To circumvent your censor's unjust restriction, SoftEther VPN Project distributes the up-to-date source code on all the following open-source repositories:

• GitHub https://github.com/SoftEtherVPN/SoftEtherVPN

  $ git clone https://github.com/SoftEtherVPN/SoftEtherVPN.git
  

• GitLab (mirrored from GitHub) https://gitlab.com/SoftEther/VPN

  $ git clone https://gitlab.com/SoftEther/VPN.git
  

• OneDev (mirrored from GitHub) https://code.onedev.io/SoftEther/VPN

  $ git clone https://code.onedev.io/SoftEther/VPN.git
  

We hope that you can reach one of the above URLs at least!

SOURCE CODE CONTRIBUTION

Your contribution to SoftEther VPN Project is much appreciated. Please send patches to us through GitHub.

DEAR SECURITY EXPERTS

If you find a bug or a security vulnerability please kindly inform us about the problem immediately so that we can fix the security problem to protect a lot of users around the world as soon as possible.

Our e-mail address for security reports is: softether-vpn-security at softether.org

Please note that the above e-mail address is not a technical support inquiry address. If you need technical assistance, please visit https://www.softether.org/ and ask your question on the users forum.

softethervpn's Issues

icmp tunnel

Hello, i use icmp tunnel on windows7 . and my server is win 2003.

many times connection disconnects. and give me error 13.
also when i check ping to my server it is ok.
why connection disconnects?

iptables rules?

How to stop logging in "SoftetherVPN Client(Windows)"?

C:\ProgramFIles\Softether vpn clientlog

Is there any way to stop creating a log files?

(I'm stop using your VPN software now because of "limitation")

Make include guards unique

I find that include guards like "ACCOUNT_H" and "CM_H" are too short for the safe reuse of your header files.

vpnserver crashed on osx

Hello, I run vpnserver on the mac (OS X v10.9.2). Two weeks ago I upgraded to softether-vpnserver-v4.06-9433-beta-2014.03.21-macos-x64-64bit and now the machine rebooted to probably a memory leak...

Crashlog:

Wed Apr  2 11:33:37 2014
panic(cpu 2 caller 0xffffff802fe5220d): "zalloc: zone map exhausted while allocating from zone socket, likely due to memory leak in zone socket (5847679040 total bytes, 6142520 elements allocated)"@/SourceCache/xnu/xnu-2422.90.20/osfmk/kern/zalloc.c:2494
Backtrace (CPU 2), Frame : Return Address
0xffffff8201bebc80 : 0xffffff802fe22fa9 
0xffffff8201bebd00 : 0xffffff802fe5220d 
0xffffff8201bebe00 : 0xffffff80302114d6 
0xffffff8201bebe20 : 0xffffff8030211642 
0xffffff8201bebe70 : 0xffffff8030211a7d 
0xffffff8201bebeb0 : 0xffffff803021e4a0 
0xffffff8201bebf10 : 0xffffff803021e380 
0xffffff8201bebf50 : 0xffffff803023e363 
0xffffff8201bebfb0 : 0xffffff802fef3b26 

BSD process name corresponding to current thread: vpnserver

Mac OS version:
13C64

Kernel version:
Darwin Kernel Version 13.1.0: Thu Jan 16 19:40:37 PST 2014; root:xnu-2422.90.20~2/RELEASE_X86_64
Kernel UUID: 9FEA8EDC-B629-3ED2-A1A3-6521A1885953
Kernel slide: 0x000000002fc00000
Kernel text base: 0xffffff802fe00000
System model name: Macmini6,2 (Mac-F65AE981FFA204ED)

System uptime in nanoseconds: 1265482024335001

vm objects:54092416
vm object hash entri:8241600
VM map entries:2739760
pv_list:10481664
vm pages:294577704
kalloc.64:8769600
kalloc.128:6762496
kalloc.256:3567616
kalloc.512:1503232
kalloc.1024:1478656
kalloc.4096:5382144
kalloc.8192:4833280
mem_obj_control:3529856
ipc ports:2766240
threads:1396560
socket:5847679040
vnodes:63162480
namecache:24830880
HFS node:86224640
HFS fork:28979200
cluster_write:1235784
decmpfs_cnode:8205120
buf.4096:2105344
buf.8192:129990656
ubc_info zone:19838016
vnode pager structur:8221400
Kernel Stacks:3047424
PageTables:65167360
Kalloc.Large:31890996

Backtrace suspected of leaking: (outstanding bytes: 2895032)
0xffffff802fe51d13
0xffffff80302114d6
0xffffff8030211642
0xffffff8030211a7d
0xffffff803021e4a0
0xffffff803021e380
0xffffff803023e363

last loaded kext at 1159169069404764: com.apple.driver.AppleIntelMCEReporter    104 (addr 0xffffff7fb1cfa000, size 49152)
last unloaded kext at 1159260141562406: com.apple.driver.AppleIntelMCEReporter  104 (addr 0xffffff7fb1cfa000, size 32768)
loaded kexts:
com.Cycling74.driver.Soundflower    1.6.6
com.FTDI.driver.FTDIUSBSerialDriver 2.2.18
com.apple.filesystems.smbfs 2.0.1
com.apple.filesystems.autofs    3.0
com.apple.iokit.IOBluetoothSerialManager    4.2.3f10
com.apple.driver.AGPM   100.14.15
com.apple.driver.ApplePlatformEnabler   2.0.9d1
com.apple.driver.X86PlatformShim    1.0.0
com.apple.driver.AudioAUUC  1.60
com.apple.iokit.IOUserEthernet  1.0.0d1
com.apple.Dont_Steal_Mac_OS_X   7.0.0
com.apple.driver.AppleHWAccess  1
com.apple.driver.AppleMikeyHIDDriver    124
com.apple.driver.AppleUpstreamUserClient    3.5.13
com.apple.driver.AppleMCCSControl   1.1.12
com.apple.driver.AppleHDA   2.6.0f1
com.apple.driver.AppleIntelHD4000Graphics   8.2.4
com.apple.driver.AppleIntelFramebufferCapri 8.2.4
com.apple.driver.AppleMikeyDriver   2.6.0f1
com.apple.driver.AppleLPC   1.7.0
com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 4.2.3f10
com.apple.driver.AppleSMCPDRC   1.0.0
com.apple.driver.AppleThunderboltIP 1.1.2
com.apple.driver.AppleIRController  325.7
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0d1
com.apple.BootCache 35
com.apple.driver.XsanFilter 404
com.apple.iokit.IOAHCIBlockStorage  2.5.1
com.apple.driver.AppleSDXC  1.5.2
com.apple.driver.AppleUSBHub    666.4.0
com.apple.iokit.AppleBCM5701Ethernet    3.8.1b2
com.apple.driver.AirPort.Brcm4331   700.20.22
com.apple.driver.AppleFWOHCI    4.9.9
com.apple.driver.AppleAHCIPort  3.0.0
com.apple.driver.AppleUSBEHCI   660.4.0
com.apple.driver.AppleUSBXHCI   670.4.0
com.apple.driver.AppleACPIButtons   2.0
com.apple.driver.AppleRTC   2.0
com.apple.driver.AppleHPET  1.8
com.apple.driver.AppleSMBIOS    2.1
com.apple.driver.AppleACPIEC    2.0
com.apple.driver.AppleAPIC  1.7
com.apple.driver.AppleIntelCPUPowerManagementClient 216.0.0
com.apple.nke.applicationfirewall   153
com.apple.security.quarantine   3
com.apple.driver.AppleIntelCPUPowerManagement   216.0.0
com.apple.kext.triggers 1.0
com.apple.iokit.IOSCSIArchitectureModelFamily   3.6.6
com.apple.iokit.IOBluetoothFamily   4.2.3f10
com.apple.driver.DspFuncLib 2.6.0f1
com.apple.vecLib.kext   1.0.0
com.apple.iokit.IOAudioFamily   1.9.5fc2
com.apple.kext.OSvKernDSPLib    1.14
com.apple.iokit.IOSerialFamily  10.0.7
com.apple.driver.AppleHDAController 2.6.0f1
com.apple.iokit.IOHDAFamily 2.6.0f1
com.apple.iokit.IOFireWireIP    2.2.6
com.apple.iokit.IOSurface   91
com.apple.iokit.IOAcceleratorFamily2    98.14
com.apple.AppleGraphicsDeviceControl    3.4.35
com.apple.driver.AppleSMBusController   1.0.11d1
com.apple.driver.AppleSMBusPCI  1.0.12d1
com.apple.iokit.IONDRVSupport   2.4.1
com.apple.iokit.IOGraphicsFamily    2.4.1
com.apple.driver.X86PlatformPlugin  1.0.0
com.apple.driver.AppleSMC   3.1.8
com.apple.iokit.IOBluetoothHostControllerUSBTransport   4.2.3f10
com.apple.driver.IOPlatformPluginFamily 5.7.0d10
com.apple.driver.AppleUSBHIDMouse   180.9
com.apple.driver.AppleHIDMouse  180.9
com.apple.driver.AppleUSBHIDKeyboard    170.15
com.apple.driver.AppleHIDKeyboard   170.15
com.apple.driver.AppleUSBMergeNub   650.4.0
com.apple.driver.AppleThunderboltDPInAdapter    3.1.7
com.apple.driver.AppleThunderboltDPAdapterFamily    3.1.7
com.apple.driver.AppleThunderboltPCIDownAdapter 1.4.5
com.apple.iokit.IOUSBHIDDriver  660.4.0
com.apple.driver.AppleUSBComposite  656.4.1
com.apple.driver.CoreStorage    380
com.apple.driver.AppleThunderboltNHI    2.0.1
com.apple.iokit.IOThunderboltFamily 3.2.7
com.apple.iokit.IOEthernetAVBController 1.0.3b4
com.apple.driver.mDNSOffloadUserClient  1.0.1b5
com.apple.iokit.IO80211Family   630.35
com.apple.iokit.IONetworkingFamily  3.2
com.apple.iokit.IOFireWireFamily    4.5.5
com.apple.iokit.IOUSBUserClient 660.4.2
com.apple.iokit.IOAHCIFamily    2.6.5
com.apple.iokit.IOUSBFamily 675.4.0
com.apple.driver.AppleEFINVRAM  2.0
com.apple.driver.AppleEFIRuntime    2.0
com.apple.iokit.IOHIDFamily 2.0.0
com.apple.iokit.IOSMBusFamily   1.1
com.apple.security.sandbox  278.11
com.apple.kext.AppleMatch   1.0.0d1
com.apple.security.TMSafetyNet  7
com.apple.driver.AppleKeyStore  2
com.apple.driver.DiskImages 371.1
com.apple.iokit.IOStorageFamily 1.9
com.apple.iokit.IOReportFamily  23
com.apple.driver.AppleFDEKeyStore   28.30
com.apple.driver.AppleACPIPlatform  2.0
com.apple.iokit.IOPCIFamily 2.9
com.apple.iokit.IOACPIFamily    1.4
com.apple.kec.corecrypto    1.0
com.apple.kec.pthread   1
Model: Macmini6,2, BootROM MM61.0106.B03, 4 processors, Intel Core i7, 2.3 GHz, 16 GB, SMC 2.8f0
Graphics: Intel HD Graphics 4000, Intel HD Graphics 4000, Built-In, 1024 MB
Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1600 MHz, 0x830B, 0x4D3253384736344342384842354E2D444920
Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1600 MHz, 0x830B, 0x4D3253384736344342384842354E2D444920
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x10E), Broadcom BCM43xx 1.0 (5.106.98.100.22)
Bluetooth: Version 4.2.3f10 13477, 3 services, 23 devices, 1 incoming serial ports
Network Service: Ethernet, Ethernet, en0
Serial ATA Device: APPLE HDD HTS541010A9E662, 1 TB
Serial ATA Device: Corsair Force GS, 480,1 GB
USB Device: Hub
USB Device: Keyboard Hub
USB Device: Apple Optical USB Mouse
USB Device: Apple Keyboard
USB Device: Hub
USB Device: Hub
USB Device: IR Receiver
USB Device: BRCM20702 Hub
USB Device: Bluetooth USB Host Controller
USB Device: FT232R USB UART
Thunderbolt Bus: Mac mini, Apple Inc., 23.4

Stop connection to 130.158.6.60:992 and 130.158.6.60:5004

After I install your server application, I found that your software tries to connect to
130.158.6.60:992
130.158.6.60:5004

Would you please stop spying on me? I already turn off automatic update.
So what should I do to stop this activity?

Also, what is this connection doing?

130.158.6.60
get-my-ip.nat-traversal.softether-network.net
inetnum: 130.158.0.0 - 130.158.255.255
netname: UTINS
country: JP
descr: University of Tsukuba

Please add support for IKEv2 for IPSec VPN

The current IPSec VPN is based on ISAKMP(IKEv1). Please add support to IKEv2.

You can port openswan or strongswan.

Multiple L2TP-IPsec clients behind same NAT !

It sound strange, but I have been able to establish 2 simultaneous connections from 2 clients: Win XP and Win 7 sited behind one external IP NAT.
Both are IPSec over L2tp, one is 3DES, other one is AES128 crypto.
But can not test establishing 3rd connection, because there are only 2 clients in this test net only. :)))))
That is Win XP and Win 7 is in some LAN where is NAT.
My SoftEther is in physically different net.
And the cliens has been got different IPs from specified in SecureNAT dhcp pool.
I don' t know is it an issue/ bug or a feature.

Debian packaging

debian/changelog needs to be updated every time you update the current build number src/CurrentBuild.txt or else the binaries that are created have the "wrong" version number.

Normally, on a Debian system this is easy with the dch command, but it looks like you can just edit the file with any text editor too.

For more information see Intro to Debian Packaging.

Completion of error handling

I have looked at a few source files for your current software. I have noticed that some checks for return codes are missing.

Would you like to add more error handling for return values from functions like the following?

• ElLoadConfig ⇒ ElInitConfig
• pthread_cond_init ⇒ UnixInitEvent

Request a tag

Hi,

I hope you can tag the releases as a good habit can keep your project in good status.

I'm going to package it into Fedora & EPEL.

Thanks.

SoftEther Vpn server IP is not correct in Vpn client connection properties !

Vpn server IP is lways 1.0.0.1 even if virtual host's IP is specified as 192.168.0.1.

Help please with OpenVPN client + certificates authorization

Hello. Came here to ask to solve my problem.
System: FreeBSD 9.2 x64, CentOS 6.5 x64, Ubuntu 14.04 x64 (tried all of them)
Client: Windows XP SP3 openvpn-install-2.3.4-I001-i686
SoftEther VPN Server 4.06 Build 9437

I am trying to authorise users without password, just by certificates(with OpenVPN client). Made CA certificate, installed to SoftEther, made certificate for client, added to .ovpn file and to softether. But when I try to connect always getting error:

Sun May 25 00:00:00 2014 us=15625 AUTH: Received control message: AUTH_FAILED
Sun May 25 00:00:00 2014 us=15625 TCP/UDP: Closing socket

Password auth works like a charm!

So maybe somebody figured that problem? Or how to make it work.

Logs:
http://pastebin.com/crgs6PVa
http://pastebin.com/n3qB06EH
http://pastebin.com/rXURRVqW

SE config http://pastebin.com/cFLYVub2
OVPN http://pastebin.com/AsY8H7tW

Request to add TLS auth to OpenVPN emulation

Hello SoftEtherVPN team,
I would like to request support for a feature from OpenVPN server to use a preshared key to authenticate at TLS level before initiating connection.

Here's an explanation of the feature:
https://openvpn.net/index.php/open-source/documentation/howto.html#security

Website blocking

Hello
Where can I set that some websites may not be checking out?
Mostly to block illegal sites, but I can not find this option anywhere.

vpnserver stop on CentOS 6.5 hangs sometimes

I've encountered a situation when stopping vpnserver and it would just hang. Logfile shows that it did shutdown (last line is: "The SoftEther VPN Server Engine has been successfully shutdown."). netstat -lntp shows vpnserver is not listening anymore.

But ps aux still shows the vpnserver process running:

/usr/vpnserver/vpnserver execsvc
/usr/vpnserver/vpnserver execsvc

which is causing my initscript to hang when stopping the service. Any way to debug more?

Starting vpnserver again will add 2 new processes in addition to the old ones remaining. Basically, vpnserver process sometimes doesn't disappear.

Add system-wide hotkey for "disconnect all VPN connections"

A suggestion - Add configurable system-wide hotkey for "disconnect all VPN connections". Thanks.

Access list does not work as supposed

Hi,
it seems there is a bug with the access list and it looks realy strange ;)

For example. I have three machines.
On running softethervpn, one running softether client and one independent running a ssh-service ( listen on port 22222).
I'm on the client machine and connected to the server which is "doing" SNAT with iptables. (vpn is bridged to tap-device).

I add two rules to access list (http://07q.de/pic1) and I can't connect to the ssh-server. (and yes, I entered IP directly (no DNS needed) and also set IP manually (no DHCP needed))

If I change it to: http://07q.de/pic2 it will work,
And now its going be funny. If I simply make the range higher (http://07q.de/pic3) it will not working anymore.
So I tried to find the port where it switch from working to not-working but I cant find.
I mean with set to Port 53000 it doesn't work. So I "go down" to 52500 and it worked again.
I go up to 52750 and doen't work. Then I tried 52700 and it works. I tried 52730 and so on. But after 52749 worked, I tried 52750 again and now it also ok. If I increase the maximum destination port slowly, I can go to the 53000 and above. If I increase it a large range, it will not working anymore. Realy confusing.

Hope you understand what I tried to explanin ;)
Thanks

Please tag the releases and upload them in a github conform way

Hi @dnobori ,

I want to point out a few things that will help make softEther more accessible to you and help you get others in the open source world working on it for you.

If I try to package up the software into a package manager I have to use a really long string like this.

pkgver=4.08
_build_type=rtm
_build_num=9449
_build_date=2014.06.08

source=("http://www.softether-download.com/files/softether/v${pkgver}-${_build_num}-${_build_type}-${_build_date}-tree/Source%20Code/softether-src-v${pkgver}-${_build_num}-${_build_type}.tar.gz")

something like
http://www.softether-download.com/files/softether/softether-src-v4.08.tar.gz
would be much easier. have a look at you version numbering system.
It could be much simpler.

also when using git could you use tagging instead of committing for each version
http://git-scm.com/book/en/Git-Basics-Tagging

So instead of using commit to tell us the version number like "v4.09-9451-beta" you could actually put in a comment as to what was was added and changed.
compare this kind of message
https://github.com/SoftEtherVPN/SoftEtherVPN/commits/master
to this
https://github.com/bagder/curl/commits/master

Then with the tagging you can have

v4.09
v4.09-rc0
v4.08
v4.08-rc2
v4.08-rc1
v4.08-rc0

example look at cmake's tagging
https://github.com/Kitware/CMake/releases

These are just a few things to get you started and there is much more that can be done.
What you want is to get a community behind your project and this will help do that

I hope you like my input and I think softether is an amazing project :)

Many Thanks
Martell

Improve const-correctness

I suggest to add the key word "const" to the type specifiers for parameters like the following.

• password (function "HashAdminPassword")
• servername, hubname, adminhub, cmdline (function "NewPs")
• src (function "GetOmissionName")

Would you like to apply the advices from an article to more places in your source files?

i18n support

Currently the only way of translating the software is adding strings to the RC file.
May lead to inconsistency after resource updates etc.

I have several recommendations:

1. http://sourceforge.net/p/winmerge/patches/2332/
2. Consult the Wine project, they already have such mechanism and they allow their translators to work with PO instead of RC.

Kind regards,
Yaron Shahrabani.

Softether VPN doesn't compile on Ubuntu 13.10 64bit

Softether VPN doesn't compile on Ubuntu 13.10 64bit
Error:
gcc -DNDEBUG -DVPN_SPEED -DUNIX -DUNIX_LINUX -DCPU_64 -D_REENTRANT -DREENTRANT -D_THREAD_SAFE -D_THREADSAFE -DTHREAD_SAFE -DTHREADSAFE -D_FILE_OFFSET_BITS=64 -I./src/ -I./src/Cedar/ -I./src/Mayaqua/ -O2 -fsigned-char -m64 -c src/Mayaqua/Cfg.c -o tmp/objs/Mayaqua/Cfg.o
In file included from src/Mayaqua/Cfg.c:104:0:
./src/Mayaqua/Mayaqua.h:257:31: fatal error: readline/readline.h: No such file or directory
#include <readline/readline.h>
^
compilation terminated.
make: *** [tmp/objs/Mayaqua/Cfg.o] Error 1

Steps to reproduce:

1. sudo apt-get install gcc binutils tar gzip zlibc openssl libreadline6 libncurses5 libpthread-stubs0 libpthread-workqueue0 git libssl1.0.0 libcrypto++9 checkinstall
2. git clone https://github.com/SoftEtherVPN/SoftEtherVPN.git
3. ./configure
4. make

Where can I assign a static IP to vpn users?

I want to set up like this: PC1,PC2,PC3 -> SEVPNserver(123.123.123.123/wan IP)

I don't want to connect SEVPNserver's network(lan IP 10.10.50.X range)
but I want to connect to SEVPNserver itself / VPN users.

ex.
SEVSERVER 10.10.20.1
PC1(vpn connected) 10.10.20.22
PC1(vpn connected) 10.10.20.27

[ALLOW]
10.10.20.22 -> 10.10.20.1:8080 = 127.0.0.1:8080(in server side)
10.10.20.22 -> 10.10.20.1:465 = 127.0.0.1:465(in server side)
10.10.20.22 -> 10.10.20.27 (pc-to-pc)
10.10.20.22 -> 120.130.140.150 (to internet, just like a router)

[DENY]
10.10.20.22 -> 10.10.50.25

The question is,

1. Where can I set a static IP for each VPN user? (ex. 10.10.20.x range for VPN)
2. If can't, should I use SecureNAT's DHCP instead?

server has 2 NIC card.
one is 10.10.1.2 WAN(Global IP: 123.123.123.123)
second is 10.10.50.1 LAN

What the binaries in src/bin/hamcore?

Hi,

What the binaries in src/bin/hamcore? Where they were taken? What their license?

Thank you.

Issue with running on uclibc devices.

Before the source code was released, I wanted to give SoftEther a go, so I grabbed the mipsel download with your static libraries, and attempted to compile that. I use a uclibc based mipsel device, and it was apparent that the libraries had been compiled with glibc. So I downloaded an eglibc mipsel toolchain, and made a static binary, so it would run on my uclibc device.

It gave me the following error.

-- Alert: SoftEther VPN Kernel --
String Library Init Failed.
Please check your locale settings and iconv() libraries.

Now that the code was released, I recompiled everything, but with my uclibc toolchain. Once again I got the same error mentioned above.

So I think this is a uclibc specific issue. Granted you probably haven't tested this at all with uclibc before, but there are many I know from the openwrt, tomato, and dd-wrt that would like to use SoftEther on our uclibc based routers.

Build System

Hi @dnobori,

I have been watching this project since it became Open Source.
The biggest issue I can see is the manual makefile setup that is included.

To add support to more and more platforms you may want to look at using something like cmake. You will be able to remove the visual studio solutions with this also and have it all managed from one script.

Will you be accepting PR's?
I may do one for this

Many Thanks,
Martell

Minimal OpenSSL version ?

Hi !

What is the minimal required OpenSSL version ?
I just tested on an embedded linux (with debian lenny, openssl 0.9.8g from 2007 ... 😢 ) and I have the error:

-- Alert: RsaCheck() --
OpenSSL Library Init Failed. (too old?)
Please install the latest version of OpenSSL.

I have not found this info in the specifications, for instance.

Thanks !

Please add support to authenticate user based on his cert.

VPN Server/DEFAULT>UserCertSet
UserCertSet command - Set Individual Certificate Authentication for User Auth Type and Set Certificate
User Name: user1

Read X.509 certificate from file name: server.cert

Error occurred. (Error code: 143)
The Certificate Authentication function and the External Server Authentication function have not been implemented on the open-source version of SoftEther VPN yet. Choose either Anonymous Authentication or Password Authentication instead.
VPN Server/DEFAULT>

Version, OS type, and hostname is leaking

I can find some information of the server when I connect to Server from other computer(no localhost).

For example,

what type of OS
Server Hostname(equals Server name in Windows)
SoftetherVPN build version

How can I hide these information?
Clients should not know about these things. (Only an admin should know about them)
Hackers will use those information to DoS SoftetherVPN server.

Language option on Windows

Is it possible to choose languages on Windows at install time? Auto detection is not a good idea because machines never knows what user really want (e.g. I need English at a Chinese system).

Thank you.

No Wins servers are provided to Vpn clients !

No Wins servers are provided to Vpn clients with IP, DNS and so on.
That are Wins1 and Wins2.
And there is no place in either GUI panel or vpn server config where it could be specifed manually.

Maybe set true after close std decriptors???

diff --git a/src/Mayaqua/Unix.c b/src/Mayaqua/Unix.c
index fc2cbf3..ddc90e5 100644
--- a/src/Mayaqua/Unix.c
+++ b/src/Mayaqua/Unix.c
@@ -1238,7 +1238,7 @@ void UnixCloseIO()
                open("/dev/null", O_RDWR);
                dup2(0, 1);
                dup2(0, 2);
-               close_io_first = false;
+               close_io_first = true;
        }
 }

I was attacked heavily from China and JAP and I really want "Auto-BAN" function!!

Many server software has "Auto-ban" function.

"Auto-ban" ... If the user fail to login [X] times, deny it's [IP address] for [10080] hours.

I know your VPN server has IP control(Virtual Hub prop > IP Access Control list),
but this is not for me because blocking all these countries are not my option(I have a few friends in these).

So, please, add AutoBAN function...

Windows' weird connection problem

(w)

"VPN Gate Public VPN Relay Servers" missing from 4.07

after upgrade to v. 4.07, the "VPN Gate Public VPN Relay Servers" option is missing. How do I get it back?

Problem while connecting using Cisco VPN client

I am trying to connect to the SoftEther VPN Server using the Cisco VPN client but not able to connect. Can someone please provide some steps to so that.

Thanks in advance

Warning: comparison of unsigned expression >= 0 is always true

src/Cedar/Command.c:16526:5: warning: comparison of unsigned expression >= 0 is always true [-Wtautological-compare]
                d >= 0 && d <= 23 && e >= 0 && e <= 59 && f >= 0 && f <= 59)
                ~ ^  ~
src/Cedar/Command.c:16526:26: warning: comparison of unsigned expression >= 0 is always true [-Wtautological-compare]
                d >= 0 && d <= 23 && e >= 0 && e <= 59 && f >= 0 && f <= 59)
                                     ~ ^  ~
src/Cedar/Command.c:16526:47: warning: comparison of unsigned expression >= 0 is always true [-Wtautological-compare]
                d >= 0 && d <= 23 && e >= 0 && e <= 59 && f >= 0 && f <= 59)

Add Auto-connect

Hi,

Here is a suggestion for the VPN Gate Plugin - how about a single action (with system-wide configurable hotkey ) to auto pickup a VPN server and connect to it. When picking up a server, the program should consider it's speed, already-connected-users.

Launchpad PPA with daily builds

I've created a PPA which takes code from github and builds new versions of SoftEther VPN if there is any changes since last build. To use the ppa:

sudo apt-add-repository ppa:paskal-07/softethervpn
sudo apt-get update
sudo apt-get upgrade
sudo apt-get install softether-vpnserver

I'll be glad if Daiyuu Nobori include that information in README install section and, maybe, in documentation. Deb package builds from this very repository with rules from DEBIAN directory - if you'll need any additional info - contact me by email [email protected]

VPN Gate public VPN Relay serves

In some countries like Iran the filtering firewall blocks http://vpngate.net so the VPN Gate VPN public VPN relay servers not updated How change this url to daily mirror URLs?

Is SoftEther's VPN Protocol (Ethernet over SSL) support PFS(perfect forward secrecy)?

Is SoftEther's VPN Protocol (Ethernet over SSL) support perfect forward secrecy just like OpenVPN's tls-auth?
PFS is on SSL/TLS, which is used by OpenVPN and SoftEther's VPN Protocol.
OpenVPN with double certificate authentication in TLS mode (as implemented in Air) provides forward security. New encryption key is negotiated every hour by default ("re-keying").

Limit the asterisk user

Asterisk user is overpowered. If you manage a single radius server working with several differentent networks (departments) asterisk user cause you to login in every different network, without any kind of control on who goes where.

I'm a noob on github, put i've written a bit of code to introduce a "token" concept.

You can create in SoftEtherVPN an user like token#dep1.mydomain.com and any user in the form [email protected] will be permitted to try authentication against radius. You can now avoid that dep2 user can log on dep1 network.

Code should be compatible with original asterisk user

quivalen@0af3c76
quivalen@4c02511

sofEther VPN Protocol client to Android

Has some possibility to implement a client to Android Plataform ?
If do, how can I help ?

Unknown random UDP port

Dear Sir,

Every time I start SE it opens a random UDP port. What is the purpose of this port and how can I prevent SE opening it?

Please note that DynamicDNS and NatTraversal are disabled.

Thank you.

How to keep l2tp/ipsec connection alive with vpn server setting

Hi, sorry to bother you. I've try to search the answer in google and i am a newbie of system networking. So i'm really sorry to ask such an idiot question.

I read the document of 'KeepSet' command (https://www.softether.org/4-docs/1-manual/6._Command_Line_Management_Utility_Manual/6.3_VPN_Server_%2F%2F_VPN_Bridge_Management_Command_Reference_(For_Entire_Server)#6.3.26_.22KeepEnable.22:_Enable_the_Keep_Alive_Internet_Connection_Function), and i didn't figure it out yet.

And the reason i want to keep connection alive with vpn server setting is because iphone 5s doesn't have keep alive option. thanks for such a great software btw.

Can't login to SSTP server with MS-CHAP on Ubuntu/CentOS

MS-SSTP (Windows 7 build-in client): When selecting CHAP/MS_CHAP v2 as authentication protocols, the connection is terminated during register to the network with error 734 returned; only authenticating with PAP (Unencrypted password) was successful.

This happened on both virtual and physical servers (Ubuntu/CentOS tested) using the latest source codes from git for compiling/setup.

Translation

Could you please provide instructions on translation of SoftEther VPN? I wish to create Russian translation but couldn't clear way to do this.

"USE ONLY IN JAPAN" This project is completely USELESS

"DISCLAIMER

USE ONLY IN JAPAN. DO NOT USE IT IN OTHER COUNTRIES."

https://github.com/SoftEtherVPN/SoftEtherVPN/
Copy(evidence): https://archive.today/fKqqE

vpnclient auto routing on linux

any plan to create auto routing configuration on linux, similar to windows?

Issue on kow to quick understand this project .

hi ,
i think it's a nice project and this makes people more free to use the Internet.
so i wanna make contribution for it . but i'am a dot net developer...
what i shuld know about for this project ? just key words list is ok .i can search my self.(about lib or something like that ).thanks for open source . :)