Setting up SoftEther VPN server

Steve - AK0M

Can anyone point me to instructions on installing and setting up SoftEther VPN server on a Raspberry Pi 4, to support remote operation to my Flex?

This would involve bridging setup.

Steve AK0M

Mike-VA3MW

Steve, if you search here on the community, there are lots of discussion on it.

I think that Ria had some good notes on it.

Steve - AK0M

Mike, I have found a lot of references on the community but they are either quite old or for platforms other than the Pi. Many references to folks running it on a pi, though.
I did find Ria’s scripts, they are 7 years old and hard coded to an earlier version of SoftEther than available now. So, best I can do so far, I am working through her scripts line by line to understand what they are doing and make any adjustments for the Pi Bullseye environment and recent Softether release. I have to learn/relearn some Linux along the way as well, and some of the VPN networking terminology is new to me also. It’s slow and tedious and I am not real confident my final outcome will work. Also I am referring to the Linux install instructions for Softether.
So I was hoping that someone who has done all this recently could give me some guidance.

Steve AK0M

WX7Y

Back in 2016 before SmartLink, Ria, N2RJ shared a couple Scripts with the group, one for the server and one for the Remote unit for Softether on a couple of RaspPi, I have no Idea if Ria is still willing to share a updated to these two scripts but I can tell you these JUST WORKED.

I don't know if Ria is still on the Flex groups but it would be very nice if she was and could come up with a update to the Scripts that would work on the updated Pi OS for some of us who lack the ability to figure it out our selves, I for one would be very interested in updating to a couple of Rasp 5's or 4B.

Right now I have a OLD laptop that has the Remote config on it that is on it's last leg and the Server running on a Windows OLD NUC computer because my Pi's gave up and stopped working a while ago.

I now have a problem getting my Iphone and IPad to connect to my Softether server since the last IOS update so I can't run my PGXL, TGXL, AntGen, or NodeRed at home from my IOS devices if I don't have the Port opened on my router which I really don't need to and I don't like using tailscale or other out of my control to service which are Level 3 VPN and NOT Level 2.

73 and have a

Bret / WX7Y

Mike-VA3MW

I tried to find my notes, but I can't, however the steps are the same. You do need something to host the client/server on at either end. And, if you want to use a Maestro, it needs to be a client to some other host.

What is exactly you wish to do? Describe what your goals are.

WX7Y

I found this from a few years ago (Oct. 3rd 2016) on SoftEther script for the Raspberry Pi and the original EMAIL Ria sent out with a Script attached.

Attached Script attached to the bottom:

[[[ Hi Ali,

Attached is the script. Please follow the below instructions. You should start with a fresh install of raspbian on your pi if possible.

To use:

Upload it to your Raspberry Pi using SCP/SFTP. You can use a program such as WinSCP for this. You may have to enable SSH from raspi-setup to do this.

Once it is uploaded, go to the directory where you uploaded it and type:

tar xzvf vpnsetup.tar.gz
cd vpnsetup
./vpninstall.sh

It will prompt you for a few basic things to do the setup:

1. An admin password for your VPN server
2. An IPSEC secret (can be anything you choose)
3. username
4. password
5. dynamic DNS hostname.

After that it will do everything else automatically.

It will then come back and tell you how to set up your router and clients.

If you have any questions, please let me know.

And please do let me know how it works out. If it works for you, you're more than welcome to share it.

73
Ria, N2RJ ]]]

vpnsetup.tar.gz

And here is the latest:

The SoftEther Server CAN be run very well using a Raspberry Pi 3B or preferably a Pi4 It only requires a couple open ports through your Network router and you can use the "vpnazure.net" to usually find a way through a firewall. I have had one online for many years.It can talk to Apple, MAC, IOS and Windows Operating systems using the SoftEther Client software or the built in VPN Client.
Back before SmartLink Ria N2RJ  wrote a Linux script for the Pi for both the server and for a client so you can Plug into the Pi's Ethernet port and run your Maestro or whatever device you want to tunnel back to the home network.   HERE IS THE LINK   It requires an up and running Raspberry Pi  3B or 4 with Higher the RAM memory the better.

73BretWX7Y

https://github.com/MarkZither/SoftEther-VPN-config

normancyyj

I could sure use some help setting up Softether on my windows 11 pro computer. Telus my ISP has gone and switch over to CG-NAT and now my 6600 is dead in the water for remote activity. My remote station in Victoria BC has been working flawlessly for 5.5 years up to now. Also last summer I set up a Yaesu FTDX3000 for a couple of local Hams that are shut in in apartments that can no longer operate HF because of no antenna capabilities. It now doesn't open the ports thru Remotehams.com. The more I read on here and the more I read about porting, setting up routers, VPN etc. The more confused I get. This networking stuff is way higher than my pay grade. My old brain just doesn't grasp things like it use to. I am able to completely remote desktop at my Victoria computer from here in Tucson and connect to the router/modem.

Any help getting this resolved would sure be appreciated.

Mike-VA3MW

Have you checked with Telus to see what they would charge you for a fixed IP address for home use? You might have to upgrade your services unfortunately.

SoftEther will help, but that does mean that all data has to run through a middle man server and that will add increased latency.

Are there any other ISPs in your area besides Telus?

normancyyj

There are a few ISP but unfortunately they have all told me that they have switched over to CGNAT. So far Telus is telling me it is going to cost me over $100/month because they say I need a business account, Grrrrr. There are a bunch of guys in Alberta running into the same issue.

Gord-VA7GP

Norm:

This is really bad news about Telus … I had my eye on their fiber service.

I'm currently with Rogers (Shaw) and I get both a public IPv4 and also an IPv6 address, no (CG)NAT involved. While no-one likes changing ISP, I wonder if a third-party (TekSavvy for example) or Rogers/Shaw may be palatable options for you?

normancyyj

Since I only rag chew the latency might not bother me. All digital stuff is done with my local computer at the radio sight.

normancyyj

Hi Gord, unfortunately Shaw/Rogers uses CGNAT in Victoria as well and the only way to get a static IP is to buy a business account just like Telus.

normancyyj

Gord, all the other ISP use either Telus or Shaw/Rogers. Same as TekSavvy. Had a good chat with them and they have been hearing complaints of this issue. So hopefully someone on here can walk me thru using SoftEther. Hope you are still having fun with the 6400.

normancyyj

Is there anybody in the brain trust that can help me get my 6600 working remotely again. I now have no choice but to operate thorough an ISP using CGNAT. I

DTB

Hi All,

I have no choice but to find a solution to the CGNAT problem. I lost a tree on my lot to old age and the other was finished off by hurricane Helene. I sold my entire HF station and purchased an entire Flex system and put it on a ridge at 3000 feet elevation 45 miles from my home, and there it sits. I can only listen to it remotely.

I tried Starlink with no luck. Recently we got ATT fiber service. The ATT BGW320-500 modem / router will not allow true pass through. Running a command prompt, tracert www.msn.com shows the issue with an address I don't completely understand.

I have been pointed in the direction of a VPN solution and like you all here on this site much of the information is older so I am not sure it is applicable now. I have a few questions about that may help in the search for the best solution. I have been eyeing Tailscale with Wireguard because of their support and the server is in Chicago.

1, With a VPN setup are we looking at connection to Smartlink or would this be similar to connecting using your home network?

2, Are there certain types of VPNs we need to avoid ?

3, Does this still require a Raspberry Pi?

I am available via email too; I am good on QRZ where we can work through the **** and put a successful final result here.

Thanks for reading and hope to hear from you soon.

Scott N2OG 73

Alan

Scott

You mentioned trying StarLink with no luck.

The residential StarLink uses CGNAT…..hence it will not work.

Comercial StarLink has an option to use a public IP address……this will work. This is what I use for SmartLink. I use the 50GB plan for $150 per month.

I cannot help with the software based VPNs.

If your home base has a public IP, you can use a hardware VPN with Level Two binding. Here is a link to a PepWave router that will do this. You need one on each end. Use the PepVPN option. Again, at least one end must have a public IP for this to work:

https://5gstore.com/product/13510_peplink_b_one.html

Alan. WA9WUD

Steve - AK0M

Back to my original post… most everything found so far points back to scripts and videos and tutorials from 7-10 years ago. The PI OS has evolved through several iterations since then, as has the SoftEther version with what appears to me to be some changes in procedure and configuration.
I keep hearing how simple this is to set up on a Pi, but despite a reasonable amount of technical and networking background (other than Linux being somewhat new), I am not yet successful. I leave on travel tomorrow…
Mike, my goals are to be able to connect from my Windows or Mac laptops while away, back into my home network, bridged so that it appears I am on the same subnet. That should allow me to access my NAS, my Flex, my Home Assistant server, and my other in-house devices just like I am at home.
Has anyone set up SoftEther server on a pi recently??? What were your detailed steps?
I am using a pi4 and Bullseye OS.
73, Steve AK0M

Mike-VA3MW

I think you will find those are still current other than the version of SoftEther to download.

Yes, I have setup on a PI in the last year, but I did it from memory and didn't write anything down.

Get started and if you get stuck, share a screen shot of where you are stuck. I think you'll find that not much has changed.

And, yes, you will need to turn on the VPN Azure feature.

https://youtu.be/uOP7XyRweRw?si=LOrjjfzdV4y3-z90

++++ break break +++++

You can also try TailScale for a CGNAT solution for FlexRadio. It has been done (but I haven't done it)

And, Alan, who has done it is part of this chat:

https://community.flexradio.com/discussion/8024371/easy-solution-for-double-nat-tailscale-vpn-and-smart-sdr-using-sub-net-routes

normancyyj

Is there any way to operate remotely using a remote desk top program Mike. Looks like Telus and Rogers here will only supply me a Static route able IP address if I get a business account and pay them over $100/month. Thanks

Mike-VA3MW

I pay $79/month for my remote internet site which is a Rogers site. For the extra $30/month I would pay that for the joy of having an HF quieter noise floor.

If you don't want to use any voice mode and can live with Digital, then install a PC at the remote end. Use Tailscale as the VPN (very very easy to set up) and connect to the Remote Desktop PC using RDP, AnyDesk, VNC or something similar. Then, run FT8 on the remote PC. This is what they do at the United Nations where the internet security is pretty high.

You can 'spoof' the radio UDP broadcast on your local network using TailScale such that SmartSDR thinks the radio is on the local network. I wrote a Wedge to do this and put it on GitHub but there is a bit of education, trial and error here to make it work. You are welcome to work with it and maybe with help from others as I don't have the bandwidth to help with it beyond providing what I have so far.

If you want to use SmartLink, on a CGNAT site, you can try using ZeroTier which can deal with the Layer 2 UDP traffic. It is not so plug and play.

I am not sure what your networking skills are like, but if that all sounds foreign to you then I can 100% guarantee that paying the $100/month to be much less stressful for you and SmartLink will just work.

73

normancyyj

Right now I am paying $35/month for 175g. I do operate my 6600 remotely on the digital modes with the computer beside the 6600 and have been for years, works great using Chrome Remote Desktop. I can rx audio just haven't figured out how to get TX audio to it. This is a learning process and I don't mid the challenge just annoyed that Telus did this. I can't think of anything that I cannot do here in Tucson that I can do in the shack. I will look at your stuff. Thanks

normancyyj

Unfortunately that link does not work Mike.

Mike-VA3MW

hmmm. It is the right link.

https://github.com/va3mw/FlexRadio-Broadcast-Wedge

normancyyj

I finally got it to work thanks.

normancyyj

I had to sign up to get at it, otherwise a 404 error came up.

normancyyj

Mike-VA3MW

There is several ways to make this work.

I have yet to do it, but if you had NodeRed running on the local radio lan, you could have it capture the UDP broadcast on port 4992 and if you were connected by TailScale send the broadcast to end user radio.

On the TailScale configuration, you do have to turn on the switch for "subnet router" on the node that is running on the same subnet as the radio.

I have yet to test this, but it should work.

Alan

Mike

I was think of doing this in Node-Red. Could you send me an email with the packet particuars.

I tried this by referencing the discovery packet documentation in the Flex Wiki, and it blew up all my Flex Radio devices…… and clients….what a mess.

Alan. WA9WUD

Mike-VA3MW

Yes, been there. :) I think you want to make sure you are signed out of SmartLink at the time.

What else makes it hard is Windows port restrictions. If something else uses 4992

Have a look at my python script in GitHub. I actually captured that in WireShark and told ChatGPT write me a python script. It did work.

normancyyj

Mike is it possible to use Chrome Remote Desktop to remote the 6600? It works great for the digital modes but what about SSB? I have have not had any success in getting the TX audio to work, RX is good.

Mike-VA3MW

The devil is in the details. I have never tried to run the audio through it. It might work but I would suspect that it might have issues. The part you have to figure out is how to get your Mic audio into the remote PC audio stream and them into the DAX TX Audio stream. I would also expect that CRD is very slow when it comes to real time voice communications.

I'm not saying it is impossible, but I think there are better and more reliable solutions. Of course, SmartLink is the best, but if you are dealing with CGNAT you might want to solve the networking issues. There are a number of CGNAT solutions in the community. M5KVK seemed to have a good handle on it.