Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    SoftEther VPN Port from FreeBSD 10.3 Release 3 Repository

    Scheduled Pinned Locked Moved pfSense Packages
    15 Posts 7 Posters 18.4k Views 1 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N Offline
      n3by
      last edited by

      How did you configured ?
      to bind to wan IP or to local host ( me I suggest to use local host (127.0.0.1) and then nat/redirect traffic from wan on that port/protocol to localhost ).

      5.3.8 Coexistence of VPN Bridge and VPN Server

      SoftEther VPN beginning users often make the mistake of installing both VPN Server and VPN Bridge on the same computer, which creates conflicting operations. Just as the descriptions of VPN Server and VPN Bridge are separate in this manual, there is no reason to install both VPN Server and VPN Bridge on the same computer.

      Because VPN Server has a function for creating a local bridge between a Virtual Hub and a physical network, the Virtual Hub of VPN Server can be connected to a physical network adapter using Layer 2 on VPN Server alone. To make this type of connection, you do not need to use VPN Bridge.

      Do not install VPN Server and VPN Bridge on the same computer.

      https://www.softether.org/4-docs/1-manual/5._SoftEther_VPN_Bridge_Manual/5.3_Differences_between_VPN_Server_and_VPN_Bridge

      1 Reply Last reply Reply Quote 0
      • P Offline
        Paint
        last edited by

        @n3by:

        How did you configured ?
        to bind to wan IP or to local host ( me I suggest to use local host (127.0.0.1) and then nat/redirect traffic from wan on that port/protocol to localhost ).

        5.3.8 Coexistence of VPN Bridge and VPN Server

        SoftEther VPN beginning users often make the mistake of installing both VPN Server and VPN Bridge on the same computer, which creates conflicting operations. Just as the descriptions of VPN Server and VPN Bridge are separate in this manual, there is no reason to install both VPN Server and VPN Bridge on the same computer.

        Because VPN Server has a function for creating a local bridge between a Virtual Hub and a physical network, the Virtual Hub of VPN Server can be connected to a physical network adapter using Layer 2 on VPN Server alone. To make this type of connection, you do not need to use VPN Bridge.

        Do not install VPN Server and VPN Bridge on the same computer.

        https://www.softether.org/4-docs/1-manual/5._SoftEther_VPN_Bridge_Manual/5.3_Differences_between_VPN_Server_and_VPN_Bridge

        I created a bridge from the virtual hub in softether to my LAN pfsense interface

        –--- UPDATE ------

        there is no need to create a bridge on the softether interface

        pfSense i5-4590
        940/880 mbit Fiber Internet from FiOS
        BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
        Netgear R8000 AP (DD-WRT)

        1 Reply Last reply Reply Quote 0
        • P Offline
          Paint
          last edited by

          @Paint:

          This is a how-to install the SoftEther VPN Server on your pfSense 2.3 machine running FreeBSD 10.3 RELEASE 3

          PLEASE FOLLOW THESE INSTRUCTIONS AT YOUR OWN RISK
          The pfSense wiki urges against manually installing FreeBSD ports from mirrors other than the native pfSense repositories.

          PLEASE CONSIDER YOURSELF WARNED
          I would definitely backup of your entire config file via the Diagnostics -> Backup & Restore page, at the very least, before following these instructions.

          PLEASE FOLLOW THESE INSTRUCTIONS AT YOUR OWN RISK

          Here are some reasons why I prefer SoftEther over OpenVPN:

          • Why SoftEther VPN: https://www.softether.org/1-features

          • Layer-2 Ethernet-based VPN: https://www.softether.org/1-features/4._Fast_Throughput_and_High_Ability

          • Security and Reliability: https://www.softether.org/1-features/3._Security_and_Reliability

          • Fast Throughput and High Ability: https://www.softether.org/1-features/4._Fast_Throughput_and_High_Ability

          While SoftEther does provide some new features like packet obfuscation, I do find it faster on my i7 than the OpenVPN package.
          I would be curious to see other people's performance as we start to test, and if the results are good, we can convert this package in the native pfSense 2.3 library.

          Lets get started!!!

          Here are the requirements for the SoftEther VPN Package as listed on the FreeBSD 10.3 Release 3 Ports mirror:
          http://pkg.freebsd.org/freebsd:10:x86:64/release_3/All/

          gettext-runtime-0.19.8.1, gmake-4.2.1_1, indexinfo-0.2.4, libiconv-1.14_9, openssl-1.0.2_15,1

          Please run the following commands via the shell to ensure all of the following packages are included. I recommend running each command one at a time to monitor any issues.

          pkg install vim
pkg install help2man
pkg install gettext-runtime
pkg install gmake
pkg install indexinfo
pkg install libiconv
pkg install pfSense-pkg-Shellcmd
pkg add http://pkg.freebsd.org/freebsd:10:x86:64/release_3/All/openssl-1.0.2_11.txz
pkg add http://pkg.freebsd.org/freebsd:10:dx86:64/release_3/All/softether-4.18.9570_1.txz
rehash

          We now need to create a rc.d file so that the pfSense rc.d system picks up the pkg:

          echo '#!/bin/sh' > /usr/local/etc/rc.d/vpnserver.sh
echo '# This file was automatically generated' >> /usr/local/etc/rc.d/vpnserver.sh
echo '# by the pfSense service handler.' >> /usr/local/etc/rc.d/vpnserver.sh
echo ' ' >> /usr/local/etc/rc.d/vpnserver.sh
echo 'rc_start() {' >> /usr/local/etc/rc.d/vpnserver.sh
echo '        /usr/local/etc/rc.d/softether_server onestart &' >> /usr/local/etc/rc.d/vpnserver.sh
echo '}' >> /usr/local/etc/rc.d/vpnserver.sh
echo ' ' >> /usr/local/etc/rc.d/vpnserver.sh
echo 'rc_stop() {' >> /usr/local/etc/rc.d/vpnserver.sh
echo '        /usr/local/etc/rc.d/softether_server onestop &' >> /usr/local/etc/rc.d/vpnserver.sh
echo '        sleep 2' >> /usr/local/etc/rc.d/vpnserver.sh
echo '        /usr/bin/killall vpnserver' >> /usr/local/etc/rc.d/vpnserver.sh
echo ' ' >> /usr/local/etc/rc.d/vpnserver.sh
echo '}' >> /usr/local/etc/rc.d/vpnserver.sh
echo ' ' >> /usr/local/etc/rc.d/vpnserver.sh
echo 'case $1 in' >> /usr/local/etc/rc.d/vpnserver.sh
echo '       start)' >> /usr/local/etc/rc.d/vpnserver.sh
echo '                rc_start' >> /usr/local/etc/rc.d/vpnserver.sh
echo '               ;;' >> /usr/local/etc/rc.d/vpnserver.sh
echo '        stop)' >> /usr/local/etc/rc.d/vpnserver.sh
echo '                rc_stop' >> /usr/local/etc/rc.d/vpnserver.sh
echo '               ;;' >> /usr/local/etc/rc.d/vpnserver.sh
echo '        restart)' >> /usr/local/etc/rc.d/vpnserver.sh
echo '                rc_stop' >> /usr/local/etc/rc.d/vpnserver.sh
echo '                rc_start' >> /usr/local/etc/rc.d/vpnserver.sh
echo '                ;;' >> /usr/local/etc/rc.d/vpnserver.sh
echo 'esac' >> /usr/local/etc/rc.d/vpnserver.sh

chmod +x /usr/local/etc/rc.d/vpnserver.sh

          This is no longer required when using the above rc.d file (starting using onestart versus start)
          We will then need to create an rc.conf.local file so that pfSense picks up the server rc.d file:
          echo "#softether_server" >> /etc/rc.conf.local
          echo "softether_server_enable=""YES"" " >> /etc/rc.conf.local
          Then run service softether_server rcvar to confirm that the rc.conf.local file changes were recognized.

          Lastly, you will need to configure the server using the SoftEther VPN Server Manager for Windows:  http://www.softether-download.com/en.aspx?product=softether

          Feel free to post additional how to's below to enhance this thread for various VPN configurations. Please be aware you will definitely need to setup some firewall rules and possibly some outbound NAT rules.

          There are many posts on Google explaining on how to setup a SoftEther server.

          On a separate note, does anyone know how to properly get this to show up in the Services -> Service Watchdog -> Add screen? Thanks!

          After disabling UDP Acceleration, enabling SecureNAT, adding pushed routes on the SoftEther configuration side and setting up the various Virtual IP addresses and Firewall rules required from the pfSense side, I have been able to successfully connect to the VPN over IPv4 remotely and locally!
          Initial speed tests show that I can easily push 150/150mbps over my WAN, which is the limit of my connection. Over the next few days, I will post some benchmarks and run a theoretical speed test so we can see the actual performance verses OpenVPN.

          pfSense i5-4590
          940/880 mbit Fiber Internet from FiOS
          BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
          Netgear R8000 AP (DD-WRT)

          1 Reply Last reply Reply Quote 0
          • P Offline
            Paint
            last edited by

            How to get SoftEther to show up in your Services list and the Service Watchdog Package:

            Take a backup of your /conf/config.xml file as we are about to make some changes.

            Edit the /conf/config.xml file in your favorite CLI editor (I like VIM personally).

            First, search for the installedpackages section:

            	 <installedpackages><package><name>iftop</name>
			<pkginfolink>https://forum.pfsense.org/</pkginfolink>

			<website>http://www.ex-parrot.com/~pdw/iftop/</website>
			<version>0.17_2</version>
			<configurationfile>iftop.xml</configurationfile></package> 
		 <package><name>Backup</name>

			<version>0.4_2</version>
			<configurationfile>backup.xml</configurationfile></package></installedpackages>

            You will need to add the VPN service lines below:

            		 <package><name>vpnserver</name>
			<pkginfolink>https://forum.pfsense.org/</pkginfolink>

			<website>http://www.softether-download.com/en.aspx</website>
			<version>4.18_9570</version>
			<configurationfile>vpnserver.xml</configurationfile></package>

            Next, you will need to find the service section:

            		 <service><name>snort</name>
			<rcfile>snort.sh</rcfile>
			<executable>snort</executable></service> 
		 <service><name>dnsbl</name>
			<rcfile>dnsbl.sh</rcfile>
			<executable>lighttpd_pfb</executable></service> 
		 <service><name>ntopng</name>
			<rcfile>ntopng.sh</rcfile>
			<executable>ntopng</executable></service>

            You will need to add a new section for the vpnserver (SoftEtherVPN Server):

            
		 <service><name>vpnserver</name>
				 <rcfile>vpnserver.sh</rcfile>
				 <executable>vpnserver</executable></service>

            Restart pfSense and you should be able to now add the vpnserver in the Service Watchdog menu and see the process in the WebGUI under Service Status

            pfSense i5-4590
            940/880 mbit Fiber Internet from FiOS
            BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
            Netgear R8000 AP (DD-WRT)

            1 Reply Last reply Reply Quote 0
            • B Offline
              bob.russo
              last edited by

              @Paint:

              gettext-runtime-0.19.8.1, gmake-4.2.1_1, indexinfo-0.2.4, libiconv-1.14_9, openssl-1.0.2_15,1

              should I run this in the shell ? I get an error, "gettext-runtime-0.19.8.1 command not found"

              @Paint:

              echo '#!/bin/sh' > /usr/local/etc/rc.d/vpnserver.sh

and an error here too 'event not found'
              1 Reply Last reply Reply Quote 0
              • P Offline
                Paint
                last edited by

                @bob.russo:

                @Paint:

                gettext-runtime-0.19.8.1, gmake-4.2.1_1, indexinfo-0.2.4, libiconv-1.14_9, openssl-1.0.2_15,1

                should I run this in the shell ? I get an error, "gettext-runtime-0.19.8.1 command not found"

                @Paint:

                echo '#!/bin/sh' > /usr/local/etc/rc.d/vpnserver.sh

and an error here too 'event not found'

                Hi Bob,

                No please skip over that first list of packages. I was just listing the dependencies. The other code boxes need to be run via the CLI (command line interface).

                pfSense i5-4590
                940/880 mbit Fiber Internet from FiOS
                BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                Netgear R8000 AP (DD-WRT)

                1 Reply Last reply Reply Quote 0
                • B Offline
                  bob.russo
                  last edited by

                  OK. That worked perfectly now. Awesome. Thank you.

                  Now… not really relevant to this topic, but off to figure out the firewall so the server manager can connect from the outside and set up RADIUS as domain creds wont work.

                  Thank you.

                  1 Reply Last reply Reply Quote 0
                  • P Offline
                    Paint
                    last edited by

                    @bob.russo:

                    OK. That worked perfectly now. Awesome. Thank you.

                    Now… not really relevant to this topic, but off to figure out the firewall so the server manager can connect from the outside and set up RADIUS as domain creds wont work.

                    Thank you.

                    I essentially setup securenat via 192.168.1.95/24 on the softether configuration, added an IP Alias for 192.168.95.1/32 (for dns), and setup and firewall allow rules for ports I am using for SoftEther (configured via the admin client from your desktop machine: e.g., 5555,8888, 1194, etc) You do not need NAT port forwards, because the process is running directly on the pfSense firewall.

                    pfSense i5-4590
                    940/880 mbit Fiber Internet from FiOS
                    BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                    Netgear R8000 AP (DD-WRT)

                    1 Reply Last reply Reply Quote 0
                    • S Offline
                      sfhoo
                      last edited by

                      Need some help on the SoftEther. I followed your instruction to install the SoftEther, configure the SoftEther to do L2TP over IPSec. I added port forward in NAT (UDP 500, 4500). I am able to connect using native L2TP on my iphone but there is no internet access. Next thing I tried was using the iphone connect to the wifi, then connect to VPN, still no internet. Any ideas? Thanks

                      1 Reply Last reply Reply Quote 0
                      • T Offline
                        trushna
                        last edited by

                        Unfortunately that package is out of date and is no longer updated.

                        I compiled softether from the sources under FreeBSD

                        The binaries can be found here https://1drv.ms/u/s!At1fq2XtLVZvhr18B5xAsQgJtLYnWA

                        • Extract the content of the archive under /etc using the command tar -xf softether-freebsd-vpnserver-v4.24-9652.tar.gz -C /etc
                        • chmod -R +X /etc/vpnserver
                        • install shellcmd package
                        • from the services menu go into the shellcmd section
                        • add a new command /etc/vpnserver/vpnserver start
                        1 Reply Last reply Reply Quote 0
                        • P Offline
                          pfDriver
                          last edited by

                          A little update from my installation (please update to the latest pfSense release first):

                          1. Download latest build from http://www.softether-download.com/en.aspx?product=softether
                          SoftEther VPN Server (Ver 4.25, Build 9656, rtm)
                          softether-vpnserver-v4.25-9656-rtm-2018.01.15-freebsd-x64-64bit.tar.gz (5.82 MB)
                          Release Date: 2018-01-15  <latest build="">2. From the shell console:
                          [2.4.2-RELEASE][root@pfsense]/root: tar -xf softether-vpnserver-v4.25-9656-rtm-2018.01.15-freebsd-x64-64bit.tar.gz -C /etc
                          [2.4.2-RELEASE][root@pfsense]/root: pkg install help2man
                          [2.4.2-RELEASE][root@pfsense]/root: pkg install gmake
                          [2.4.2-RELEASE][root@pfsense]/root: pkg add http://pkg.freebsd.org/freebsd:11:x86:64/latest/All/openssl-1.0.2n,1.txz
                          [2.4.2-RELEASE][root@pfsense]/root: pkg add http://pkg.freebsd.org/freebsd:11:x86:64/latest/All/binutils-2.29.1,1.txz
                          [2.4.2-RELEASE][root@pfsense]/root: pkg add http://pkg.freebsd.org/freebsd:11:x86:64/latest/All/mpfr-3.1.6.txz
                          [2.4.2-RELEASE][root@pfsense]/root: pkg add http://pkg.freebsd.org/freebsd:11:x86:64/latest/All/mpc-1.0.3.txz
                          [2.4.2-RELEASE][root@pfsense]/root: pkg add http://pkg.freebsd.org/freebsd:11:x86:64/latest/All/gcc7-7.3.0.txz
                          change in /etc/vpnserver/Makefile: CC=/usr/local/bin/gcc7
                          [2.4.2-RELEASE][root@pfsense]/etc/vpnserver: ./.install.sh
                          [2.4.2-RELEASE][root@pfsense]/etc/vpnserver: ./vpnserver start
                          Services > Shellcmd > add a new command /etc/vpnserver/vpnserver start (shellcmd package should be installed in pfSense)
                          check firewall rules in pfSense
                          [2.4.2-RELEASE][root@pfsense]/etc/vpnserver: sockstat -4 -l</latest>

                          1 Reply Last reply Reply Quote 0
                          • O Offline
                            oddstan
                            last edited by

                            Hi everyone,
                            if you like softether more, why don't you support the relevant ticket to add a package.
                            just leave a message
                            https://redmine.pfsense.org/issues/9044

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.