Softether with DNSMasq on Debian 11

What is SoftEther

A Free Cross-platform Multi-protocol VPN program, as an academic project from University of Tsukuba. It is a single server which support SSL-VPN (HTTPS) and 6 major VPN protocols (OpenVPN, IPsec, L2TP, MS-SSTP, L2TPv3 and EtherIP). I would like to also highlight the VPN over ICMP and VPN over DNS feature if you are inside a very strict network.

VPS Setup Guide

This post doesn’t use SecureNAT.

On physical server, local bridge will perform better than SecureNAT
DO NOT enable both local bridge and SecureNAT at the same time. Packets will loop infinitly and make your server 100% CPU usage.
Requirement: VPS

Use a freshly installed Debian-11. My sample VM shape was:

Spec:RAM: 2048M
Disk Space: 20GB
CPU: 2vCPU
OS:Debian-11 bit (minimal)

Before installing SoftEther Server let us install some prerequisite.

apt-get update
apt-get install build-essential

Download Softether VPN for linux-

cd /opt
wget https://www.softether-download.com/files/softether/v4.43-9799-beta-2023.08.31-tree/Linux/SoftEther_VPN_Server/64bit_-_Intel_x64_or_AMD64/softether-vpnserver-v4.43-9799-beta-2023.08.31-linux-x64-64bit.tar.gz
tar zxf softether-vpnserver-v4.43-9799-beta-2023.08.31-linux-x64-64bit.tar.gz
cd vpnserver
make

Read the Agreement and press 1 three times.

Then we move the dir to /usr/local/

cd ..
mv vpnserver /usr/local
cd /usr/local/vpnserver/
chmod 600 *
chmod 700 vpncmd
chmod 700 vpnserver
nano /etc/init.d/vpnserver

paste the following content to nano

### BEGIN INIT INFO
# Provides: vpnserver
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start daemon at boot time
# Description: Enable Softether by daemon.
### END INIT INFO
DAEMON=/usr/local/vpnserver/vpnserver
LOCK=/var/lock/subsys/vpnserver
test -x $DAEMON || exit 0
case "$1" in
start)
$DAEMON start
touch $LOCK
;;
stop)
$DAEMON stop
rm $LOCK
;;
restart)
$DAEMON stop
sleep 3
$DAEMON start
;;
*)
echo "Usage: $0 {start|stop|restart}"
exit 1
esac
exit 0

Save and Exit. After that we enable the service

chmod 755 /etc/init.d/vpnserver
mkdir /var/lock/subsys
update-rc.d vpnserver defaults
/etc/init.d/vpnserver start
cd /usr/local/vpnserver/

Then we need to do a checking.

./vpncmd
3
check

You should get 4 “Pass”. We need to set the server admin password

./vpncmd
1
Enter
Enter
VPN Server>ServerPasswordSet

Enter the admin password. I do the setting on a windows client. It is running. Install it, run it, click New setting. Input ip and password.

Then connect to it. On successful login, it will pop up Easy Setup

easy setupCheck Remote Access Server and Next

Yes

Enter Virtual Hub name

Setup L2TPCheck Enable L2TP Server Function and input your own pre-share key

AzureWe disable Azure VPN

Create User

Then we need to create a new user. This is trivial.

Softether using local bridge

To start with you need Softether installed and setup. You can follow the guide on Softether on VPS

Local bridge Setup
Network setup
VPN Server IP: 192.168.7.1
VPN Client IP Range: 192.168.7.50-192.168.7.60
Tap Device name: tap_soft

From here we go to the “Local Bridge Setting”

First we choose the Virtual Hub. It should be only one for normal setup.

Then we check the tap device box.

After that we type in the name of the tap device(I use soft here for simplicity).

Create Local Bridge

After the creation of the local bridge we jump back to our server. And run

# ifconfig tap_soft

It should show you something similar to this

Check on the server

Because we are not going to use SecureNAT and SecureDHCP. We need to install a DHCP server on our VPS. We are going to use dnsmasq as our DHCP server.

# apt-get install dnsmasq

Now edit the /etc/dnsmasq.conf file. Add these 3 lines at the end.

interface=tap_soft
dhcp-range=tap_soft,192.168.7.50,192.168.7.60,12h
dhcp-option=tap_soft,3,192.168.7.1

The above 3 lines are used to enable the dhcp server on interface tap_soft. Next step we need a new set of init script which will config tap interface for us when Softether start up.

nano /etc/init.d/vpnserver

#!/bin/sh
### BEGIN INIT INFO
# Provides: vpnserver
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start daemon at boot time
# Description: Enable Softether by daemon.
### END INIT INFO
DAEMON=/usr/local/vpnserver/vpnserver
LOCK=/var/lock/subsys/vpnserver
TAP_ADDR=192.168.7.1

test -x $DAEMON || exit 0
case "$1" in
start)
$DAEMON start
touch $LOCK
sleep 1
/sbin/ifconfig tap_soft $TAP_ADDR
;;
stop)
$DAEMON stop
rm $LOCK
;;
restart)
$DAEMON stop
sleep 3
$DAEMON start
sleep 1
/sbin/ifconfig tap_soft $TAP_ADDR
;;
*)
echo "Usage: $0 {start|stop|restart}"
exit 1
esac
exit 0

Then we need to enable NAT on linux server. Add this file to /etc/sysctl.d/ to enable ipv4 forwarding.

/etc/sysctl.d/ipv4_forwarding.conf

net.ipv4.ip_forward = 1

Apply the sysctl run

# sysctl --system

Then we add a POSTROUTING rule to iptables

# iptables -t nat -A POSTROUTING -s 192.168.7.0/24 -j SNAT --to-source [YOUR VPS IP ADDRESS]

To make our iptables rule survive after reboot install iptables-persistent

# apt-get install iptables-persistent

After all the above setting, restart the vpnserver then we are good to go.

# /etc/init.d/vpnserver restart
# /etc/init.d/dnsmasq restart

You’re done. Now starti testing.

Src:
https://blog.lincoln.hk/blog/2013/03/19/softether-on-vps/
https://blog.lincoln.hk/blog/2013/05/17/softether-on-vps-using-local-bridge/

SoftEther VPN Setup with Dnsmasq and port forwarding

Leave a Reply