Setting up a VPN with SoftEther

Assuming you have set everything up correctly on your PC, have yet set up your Router to Port Forward to your PC?

To Rick
(and Howard - for information.)

I am also contemplating using SoftEther to setup a VPN and, like you Rick, this is is also something new for me. At the moment I am successfully using Parallels to control my remote site but a VPN would appear to be a better solution for my setup .

I have studied all the documentation but I am still uncertain about the correct procedure. For example, In my setup, the remote site will be my main station and my home will be merely an access point. Should I setup a Softether VPN Server at the remote site and the Client at home, or vice versa? Or should I setup a remote (external) VPN Server and setup Clients at home AND the remote site? These question alone probably best explain my newbie status as far as VPNs are concerned.

Rich, would you be good enough to share any information you may obtain from Howard which you think could also help me (with Howard's permission , of course) either here on the Community, (preferred, as it may also assist others), or direct if you prefer. My email is winston.henry@bigpond.com

Many thanks

Winston.

Rick, have you tried to connect from another PC or laptop running the client software. I am going to download the software and try to set this up over the couple of days. I'll let you know how I get on. Winston

Never been able to get this working and I guess I'm missing something ****, how about one of you guys writing up an install guide.

There are a number of networking steps to go through to have your SoftEther setup work properly. 

When first installing SoftEther make sure you setup the VPN server and the VPN bridge. Flex Radio SmartSDR requires Ethernet broadcasts to find the 6000 series radio. Bridging allows broadcasts to pass through the VPN tunnel while routing typically does not. 

Follow these instructions:
https://www.softether.org/4-docs/2-howto/1.VPN_for_On-premise/2.Remote_Access_VPN_to_LAN 

If you are going to use the SoftEther client on a PC or Mac then pick one of the ports the server uses. I would recommend port 443 or 5555, assuming your ISP does not block these ports. You will need to configure a rule on your router to forward TCP port 443 or 5555 from your outside WAN (internet facing) interface to the internal IP address of the computer you installed the SoftEther server. Once you configure the port number you chose on the SoftEther client on a PC or Mac you should should get a connection.

If you will be using a iPad or IPhone remotely via the built-in iOS L2TP client you will need to setup additional port forwarding rules on your router. Those additional forwarded ports are:

 UDP 1701, UDP 500 and UDP 4500

Again, these ports are from your outside WAN (internet facing) interface to the internal IP address of the computer you installed the SoftEther server. 

I hope this helps!

Carmine
W1EQX

Also, first test to ensure the SoftEther server is setup correctly before configuring ports. Set up your iPad to connect to the server's internal IP address while the iPad is on the internal wireless network. This may sound counterintuitive but it will ensure that you don't have any server related configuration issues.

Once you test that the VPN does authenticate and connect internally, configure the additional L2TP/IPSec UDP ports I had indicated in my previous post and give it a try over the internet. Don't forget to to reconfigure the native L2TP VPN client to point to the external address of your router.

Carmine
W1EQX

Thanks for the clear instructions.  I had this all set up yesterday (...the day after receiving my 6300).

OK .... Success!!!!!!!!!!!!!!

After I read page 334 of 474 in the Draytek instruction book, a sightly obscure sentence told me to make sure certain VPN services were "un-checked" if one wanted to run a VPN server on the LAN side of the router.

Voila!!!  Connections!!!!!

OK.  I finally got SoftEther to work - here's how...

My setup is I have a lake house where there's no restrictions on antennas, so I placed the 6700 there. It has a (slow) Windstream DSL connection, with about 3 Mb down and .5 Mb upload - not great, but usable for the moment.

On a new "Radio PC" at the lake house, I installed SoftEther VPN Server.  I added a Local Bridge connection so the Ethernet packets on the LAN managed by the DSL modem/router can be bridged via the VPN to my home network.  SoftEther creates a "virtual Ethernet cable" tunneled through a VPN connection, which is how it bridges the two networks and allows UDP broadcasts like SmartSDR to Flex radios to get through.

One of the great things about SoftEther is it has a built-in Dynamic DNS service, which creates a DNS entry at softether.net for your Internet router.  In my case, I ended up with something like myradiopc.softether.net, which will always point to my DSL modem's IP address, even when the IP address periodically changes.  This is how I now address the lake modem when connecting to any service (VPN, RDP).

Next, on the DSL router, I added port forwarding for ports 500 (UDP), 4500 (UDP), 5555 (TCP) to the Radio PC IP address.  For the bridge connection, I added a port forwarding mapping rule to map port 8443 (TCP) to 443 on the Radio PC.  That's because port scanners look for 443 on the Internet and I'd prefer to make that port harder to find.  Also, I mapped 23389 (TCP) to 3389 so I can use Windows Remote Desktop to remote into the Radio PC.

I also have both TeamViewer and Splashtop Streamer installed, so I now have three ways to remote into the PC desktop for maintenance, in case the VPN is down for any reason. (it's a 2 hour drive to the lake house, so would prefer not to be forced to do that too often)

On my local (home) PC, I installed SoftEther VPN Bridge, then added a Local Bridge to my home network.  In the Security Rules, I blocked everything related to IPv6 and DHCP, to prevent those packets from crossing the bridge (there's a different DHCP server on each network segment I don't want cross-talking and polluting IP assignments).

This allowed SmartSDR to discover the radio!  So far so good... but cannot connect to the remote radio's IP just yet, as the radio IP address is on the lake network segment, not my local home network.  To address this, I simply added a new IP address on my home PC network adapter that's actually on my lake network.  Now this seems a bit counterintuitive, but it works because the SoftEther Bridge and Local Bridges extend the layer 2 ethernet frames of both networks - I just needed a way to create a route table entry on the local network that enabled my home PC to participate on the lake network.

Now it works!  I'm able to run SmartSDR on my home PC and operate the Flex 6700 radio remotely.

But not done quite yet... I found the audio to be choppy at first, so I went into the SoftEther Bridge settings and turned on Compression and blocked all other services that aren't required to reduce the amount of cross-bridge network chatter.

That's what worked for me.  Hope that's helpful.

Rick
KG5PJB
 

I set it up similarly but I used a Raspberry Pi as my VPN endpoint. This way the VPN is on its own hardware. 

My home network is in the class A RFC1918 CIDR anyway which most people do not use for home networks. 

The bridge took care of everything for me, I get an IP from my home DHCP server as well. 

I would try to run it on the PC you do not use SmartSDR on, for two reasons.

1. You want your SmartSDR PC dedicated to that, and no extraneous drivers/software to mess it up, especially on the network side.

2. If you ever need to reboot your SmartSDR PC, you'll remain connected while the reboot is in progress and you won't have to worry if the VPN came back up.

That does not mean it won't work on your SmartSDR PC, it's just not what I would personally do. 

SoftEther doesn't use much CPU as you can run it on a Raspberry pi or other small PC. 

If you really want to get fancy, get a Raspberry Pi and install it there. Just plug it in and forget it even exists. Consumes only a couple of watts too. $60 on amazon for the full kit...

OK guys. Help me out a little.

1. I installed the VPN Server.
2. Installed the Bridge
3. Connect server and bridge
4. Accepted the default DDNS name.
5. Set up L2tp..i think with encryption...Can't remember.
5. Added a user name and password
6. Port forwarded 443,992,1194,5555 to the PC the server is on. Checked them all at canyouseeme.com. They are open

Then I went into the iphone and GUESSED at what it wants in the different fields.  It fails to connect.
I am sure I have things wrong on both sides but don't know where to start troubleshooting.  I am an old mainframe guy so I need a little direction on how to figure out whats going on.

Any suggestions?  The iphone just saying failed to connect doesn't give me a clue where to start.

Thanks in advance for any help.

Harold