Network Configuration

At this point you want to give your VPN server a static IP address if you did not already do this. If you don't do that, you risk your server becoming unreachable in case your local DHCP server assigns it a new IP. As an alternative, you can check your DHCP configuration. Some DHCP servers allow you to make reservations. You can use that to have it always assign the same IP to your VPN server.

You also want to open at least one (but preferrably all) TCP ports shown in the main window in your firewall and forward them on your router if they need forwarding. If you want to accept OpenVPN connections, forward at least one UDP port also. You can configure OpenVPN UDP ports with the "OpenVPN" button in the bottom right corner.

You normally don't want to change the ports, but the configuration window allows you to add and remove ports as you want. By default, SoftEther listens on 443, 992, 1194 and 5555. Port 443 is the one that SoftEther VPN clients will default to. If you remove that port, your users have to select another port number. SoftEther makes no distinction between VPN types. All TCP ports accept all VPN types. However, most L2TP and SSTP implementations don't allow users to set the ports. Depending on the protocols you enabled, you have to forward additional ports that are not explicitly listed in the management window.

• L2TP: TCP(1701), UDP(500), UDP(4500)
• MS-SSTP: TCP(443)

SSTP is enabled by default. You can disable it on the bottom right in the main window.

UDP Hole Punching

This VPN server supports NAT traversal via UDP hole punching. This means that it will try to abuse how UDP works to forward ports if you don't do this yourself. Whether NAT traversal is in effect or not, can be seen by connecting to the server from a VPN client. If NAT traversal is in effect and was used to make the connection, a message will be displayed on the client. To disable this feature, change bool DisableNatTraversal false to bool DisableNatTraversal true in the ServerConfiguration section of the configuration file. How to edit the file is shown in the next chapter.

Disabling dynamic DNS

If you want to disable the integrated dynamic DNS client, you can do so by editing the configuration.

Note: Disabling dynamic DNS also disables VPN Azure support.

1. Click "Edit Config" in the main window, then click "Save to File"
2. Open the file in a text editor and find the DDnsClient section
3. Edit the configuration by changing the line bool Disabled false to bool Disabled true
4. Click "Import File and Apply" to load the changed file
5. Exit and restart the server manager
6. You will find the button "Dynamic DNS" grayed out

Note: you cannot edit the file directory in the "Edit Config File" window itself, however, you can edit the real config file in the installation directory if you shut down the VPN server service before editing.

Backup and Restore

It's generally a good idea to create a backup of your server configuration. To do so, use the "Edit Config" button in the main window to back up and restore the configuration to a file.

Note: Be careful when you use this feature to copy the configuration from one server to another. Configuration that is bound to hardware (for example a bridged adapter) will likely not apply properly on another server. For the purpose of redundancy, consider using the "Clustering Configuration" in the main window instead.

Operating a CA

Operating a CA is recommended if you opt for certificate based authentication. This chapter explains how to do this with XCA. XCA is a CA that can run under all common operating systems and is fairly easy to operate.

Download

You can download XCA via Gitload. For Windows, there's an msi (installer) and a zip (portable).

Creating a Database

XCA can use common SQL servers as backend as well as SQLite file based database. For simplicity, this documentation focuses on the SQLIte method as it requires no other dependencies.

Create a new database in the file menu. You will be prompted to specify a file name, then you will have to enter a password to protect private keys. This should be very strong (20+ characters).

Creating the CA Certificate

Creating a CA certificate is simple.

1. In the "Certificate" tab of the main window, click on "New Certificate"
2. Select the "CA" template in the lowest drop-down
3. Click "Apply All"
4. Fill out the fields in the "Subject" tab. Minimum is the "Internal Name" (this is how it's displayed in XCA) and the "commonName" (how it's displayed in the certificate).
5. Click on "Generate a new key". Name the key any way you like (preferrably like the certificate) and select type "RSA" and size "4096 bit"
6. Click on "Create" (this can take a few seconds)
7. (Optional) In the "Extensions" tab, set the duration. 10 Years for a CA certificate is good but you can increase it if you want. You can optionally select "Midnight" to get a nicer timestamp.
8. (Optional) If you plan on working with revocation lists, Use the "Edit" button next to the "X509v3 CRL Distribution Points" text box to set the URL where the revocation list will be available. This URL should be reachable by all software that comes in contact with the certificate.
9. (Optional) Change the "Netscape Comment" field in the "Netscape" tab. The comment is part of the certificate, so don't enter any information you don't want to be public.
10. Click "OK" to generate the certificate

⚠ CAUTION ⚠

SoftEther only undestands RSA certificates. Do not use elliptic curve certificates, and only use "RSA" as the key type.

Exporting the CA Certificate

Select the CA certificate in the main window, and click "Export".

Change the name if you want to (this has no effect on the certificate) and select any path you like. Make sure the export format is set to "PEM (*.crt)"

The CA certificate is public information. It's usually a good idea to have this certificate present in an easily accessible location, for example a web server.

Using the CA Certificate

This certificate can now be imported into the VPN server and the VPN client.

On the server, you can import it in the hub manager. You have to import the certificate into every hub you want it to be valid for, using the "Trusted CA Certificates" button.

On the client, press CTRL+R or select the appropriate option in the "Tools" menu of the client manager. Importing the certificate is optional but it avoids a security prompt for when the user makes the first VPN connection.

Creating the Server Certificate

The server certificate is used for clients to ensure that they are talking to the appropriate machine.

1. Use the "New Certificate" button
2. In the "Source" tab, make sure your CA certificate is selected in the "Signing" box.
3. Select the TLS_server template and click "Apply all"
4. In the "Subject" tab, fill out all values you want. The "commonName" value should be the domain name that you're going to assign this VPN server. If you want to work with IP addresses only, use the internal host name instead.
5. Don't forget to generate another private key in the lower part of the tab. Use the same type and size parameters as you did for the CA certificate.
6. In the "Extensions" tab you can again configure different certificate settings. Be aware that TLS certificates that are longer than one year will no longer be accepted by modern browsers.
7. If the certificate should be valid for more than one domain name, or should be valid for IP addresses, use the "Edit" button next to the "X509v3 Subject Alternative Name" box to add additional entries. If you add at least one entry, make sure the "Copy Common Name" box is checked. It should be as it's part of the template you applied.
8. Click "OK" to create the certificate

Using the TLS Certificate

The TLS certificate can now be imported into the VPN server. To do so, you need to export the certificate and the key. Exporting the certificate is identical to exporting the CA certificate, so check the chapter above.

Exporting the key is almost identical. Select the key that matches your certificate in the "Private Keys" tab adn click "Export". Enter a name and a path. Make sure the format is "PEM private (*.pem)" and click "OK"

Now on the server, import the certificate in the server manager (not the hub manager) using the "Encryption and Network" button.

Creating the VPN Template

It's a good idea to create a template for VPN user certificates. When the first certificate expires and you have to issue a new one, you will likely have forgotten the original settings, so a template will help in that regards.

Templates can be changed at any time, but be aware that this will not change the contents of already issued certificates.

Using a Pre-made Template

Copy all the code in the box below, then in the "Templats" tab, right click into the empty area and select "Paste PEM Data", then "Import All". Note: The "Internal Name" will be empty, you can double click the template after importing it and assign it a name. The name is displayed in the "Template" drop down box whenever you create a certificate. The pre-made template has all the proper key usages already selected.

-----BEGIN XCA TEMPLATE-----
AAADUAAAAAowAAAAABsAAAAMAHYAYQBsAGkAZABOAAAAAgAyAAAAEgB2AGEAbABp
AGQATQBpAGQAbgAAAAIAMAAAAAwAdgBhAGwAaQBkAE0AAAACADIAAAAMAHMAdQBi
AEsAZQB5AAAAAgAxAAAAFABzAHUAYgBBAGwAdABOAGEAbQBlAAAAAAAAAB4AbgBz
AFMAcwBsAFMAZQByAHYAZQByAE4AYQBtAGUAAAAAAAAAHgBuAHMAUgBlAHYAbwBj
AGEAdABpAG8AbgBVAHIAbAAAAAAAAAAYAG4AcwBSAGUAbgBlAHcAYQBsAFUAcgBs
AAAAAAAAABIAbgBzAEMAbwBtAG0AZQBuAHQAAAAUAFYAUABOACAAQwBsAGkAZQBu
AHQAAAAUAG4AcwBDAGUAcgB0AFQAeQBwAGUAAAACADUAAAAaAG4AcwBDAGEAUABv
AGwAaQBjAHkAVQByAGwAAAAAAAAAIgBuAHMAQwBBAFIAZQB2AG8AYwBhAHQAaQBv
AG4AVQByAGwAAAAAAAAAEgBuAHMAQgBhAHMAZQBVAHIAbAAAAAAAAAAoAG4AbwBX
AGUAbABsAEQAZQBmAGkAbgBlAGQARQB4AHAARABhAHQAZQAAAAIAMAAAABQAawB1
AEMAcgBpAHQAaQBjAGEAbAAAAAIAMAAAAAwAawBlAHkAVQBzAGUAAAAEADIAOQAA
ABQAaQBzAHMAQQBsAHQATgBhAG0AZQAAAAAAAAAWAGUAawB1AEMAcgBpAHQAaQBj
AGEAbAAAAAIAMAAAAA4AZQBLAGUAeQBVAHMAZQAAADQAZQBtAGEAaQBsAFAAcgBv
AHQAZQBjAHQAaQBvAG4ALAAgAGkAcABzAGUAYwBVAHMAZQByAAAADgBjAHIAbABE
AGkAcwB0AAAAAAAAAAQAYwBhAAAAAgAyAAAAFABiAGMAQwByAGkAdABpAGMAYQBs
AAAAAgAxAAAAEgBiAGEAcwBpAGMAUABhAHQAaAAAAAAAAAAOAGEAdQB0AGgASwBl
AHkAAAACADAAAAAUAGEAdQB0AGgASQBuAGYAQQBjAGMAAAAAAAAADgBhAGQAdgBf
AGUAeAB0AAAAAAAAABQATwBDAFMAUABzAHQAYQBwAGwAZQAAAAIAMA==
-----END XCA TEMPLATE-----

Creating a VPN Client Certificate

This process is very similar to the TLS certificate

1. Select "New Certificate" in the "Certificates" tab.
2. In the "Source" tab, select your CA certificate in the "Signing" box
3. Apply your VPN client template (use "Apply All")
4. In the "Subject" tab, give the certificate an internal name, and write the VPN user name into the "commonName" field
5. Create a 4096 bit RSA key for this certificate
6. In the "Extensions" tab, change the duration as needed. Note, that when the certificate is about to expire, you have to create a new one for continued VPN access by this user. Don't set the duration too short or you will end up having to issue lots of certificates. The provided template uses 2 years. The certificate validity period is a good method to grant someone access for a limited time only.

Using the Client Certificate

The client certificate can be supplied as authentication mechanism in the VPN client. Check the chapters below for how to configure the client and how to distribute pre-made settings for your users.

Working with Signing Requests

A proper CA never comes into contact with the private key of the user certificates. This reduces the chance of key compromise, but it depends on the user to retain a copy of the key and to generate a signing request.

Creating a Signing Request

One of the easiest ways to create such a request is using OpenSSL. The user has to use these two commands to create a private key and a request. The request (not the private key) is to be sent to you. The request command will ask the user various questions. None of the information is really important as we can override them on the CA.

openssl genrsa -out private.key 4096
openssl req -new -key private.key -out request.csr

Using a Signing Request

After the request has been sent to you, you can import it in the "Certificate signing requests" tab. The request will then appear in the list as "Unhandled"

To convert the request into a certificate, right click the request and select "Sign"

This brings up the certificate creation window. The top part has the signing request filled in.

1. Deselect the "Copy extensions from the request" checkbox
2. Select the "Modify subject of the request" checkbox
3. Select your CA certificate in the "Signing" box
4. Apply the VPN client template. Use the "Apply extensions" button only if you want to preserve the "Subject" data from the signing request.
5. In the "Subject" tab, correct any misinformation. Make sure the "commonName" field exactly matches the VPN user name.
6. Check any other tabs and make changes as you deem appropriate.
7. Click "OK" to sign the certificate.

Note: Apart from the public key, any value from the signing request can be overridden by you.

After signing, the request will appear as "Signed" now. The certificate can be exported and sent to the user.
Note: You can't export the private key, since there is none. The user is already in possession of the key.

You can delete the signing request once you are done, but there is no real reason to do so because it serves as kind of a history.

Using RSA Public Keys

Instead of using a signing request (as it is done for a proper CA), you can also just use public keys. The user has to type these two commands and send you the pub.key file:

openssl genrsa -out private.key 4096
openssl rsa -pubout < private.key > pub.key

To import the key, copy the contents of the file to the clipboard, then use the "Import PEM Data" context menu option in XCA to import the key.

After that, create the certificate as you would with an RSA private key. The difference is that instead of generating a key, you select the imported key.

Resetting Adapters and IP

If your operating system resets some network settings, it might also reset the priority (metric) of the adapter. If you find that VPN connections are opened without issues, but they're not used by your machine, check that the network card metric is set to 1, and if it's not, set it to that value. Consult the instructions for your operating system on how to do this.

Deploying VPN Connections

The best way to depoly VPN connections is to use remote control for the client. This is explained further below. As an alternative, you can create and configure a VPN connection the way you want it, then right click the entry in the VPN list and export it. You can then import it into another client using the "Connect" menu.

This will not export/import the CA list (see "Tools" menu or press CTRL+R)

Restricting the Client

In a work environment you might want to restrict the VPN client. To do so, use "Tools > Switch Operation mode"

In most cases, you want to switch to "Easy Mode" to not overwhelm the user. Enable the setting locker and enter a secure password.

Switching to easy mode is not required, and users can switch back to the normal mode at any point. They will not be able to add/edit/delete VPN connections until they confirm the password and disable the setting locker.

A shortcut can be placed on the user desktop to make connecting to the VPN even simpler.

A VPN connection can be set as "startup connection" in the context menu. This makes the VPN connect automatically at system start before the first user logs in.

Remote Management

The VPN client, like the server, can be managed remotely. This should only be enabled if remote management is desired, for example in a corporate environment.

Installing Remote Tools

The remote administration tools are part of the regular VPN client installer. You only have to install them if you don't have the VPN client itself installed locally. The remote administration tools are installed together with the regular client installation. You don't have to install the tools on the client that is being remotely connected to.

To create a shortcut for remote management, duplicate the regular VPN client desktop shortcut, and add /remote to the command line.

Enabling Remote Management

In the client, go to "Tools > Options" and check the "Allow Remote Management of VPN Client Service" checkbox, then click "OK"

After enabling remote management, press CTRL+P (or use the appropriate "Tools" menu option) to set a password. Check the checkbox to use the password, and optionally to only require the password for remote management. If you don't check the second checkbox, you have to enter the password each time you start the client.