[SOLVED] SoftEther VPN: A replacement for openVPN?

[QuentinC]

Hello !

I've heard about SoftEther, and tried to configure it on my router.
As a simple test, I'm trying to build a bridged VPN to my LAN.

I can connect to the VPN using either the SoftEther client or SSTP fine, and I'm able to reach machines on my LAN. But I've not been able to reach the router itself this way...

I'm suspecting an ARP problem as the client appears this way on the ARP table:
"  at (incomplete) on re1 expired [ethernet] "

On the LAN machines, the VPN client has it's MAC address...

Is there some settings on OPNsense that may block this ?

Thanks !

Quentin Canel

[Mena42]

I just tried Softether vpn. It did work with some issues at times just for my pc and not for my router to supply my whole house with. But I would caution everyone that after 2 months of use. I get a message from my isp today and they stopped my internet service do to downloads they saw on my account. Ask yourself this if it is free n they do keep logs that tell on you. Why just change the IP address. No one I know wants a vpn to just change the IP address. It is for privacy , so no will know what you are doing period. I wouldn't tell anyone to use this service. I made this account just to spread this experience.

[ChrisH]

I actually switched back from SoftEther to ZeroTier. ZT is SO much easier to configure and the documentation is much more straightforward. Looking back now SoftEther is needlessly complicated on so many levels.

TBH I didn't even know there was a OPNsense plugin for SoftEther...

And I never did like the SoftEther concept of bridging the local networks to my VPN server only to sort out all the broadcasts etc. there and only pass on the relevant packets to the other virtual switches. ZT does good plain old routing and it just works.

[mimugmail]

For SoftEther ist only a package, not a plugin (with UI). ZT has everything in it.
Also SoftEther hasn't received updates for long time .. I wouldnt advise to use it.

[phoenix]

SoftEther has received updates recently (but not the FreeBSD port) and the project itself has now been split into a LTS (stable) version and a development version with community developers, this should give some more traction to it moving forward. For those reasons and because of the age of the FreeBSD port I stopped using it on OPNsense and now use SoftEther on a VM in my LAN, I don't have any problems connecting  to it nor getting access to any of my machines, which is what I was trying to achieve,

[xinnan]

I checked out softether a few times over the years and recently.  The simplest and easiest setup I ever saw was too complicated.  I'm sure it works fine, but with openvpn for ease of use and ipsec for those who dislike openvpn, softether falls into the "why bother" category for me.  Id consider it if it were incorporated into opnsense much the same way openvpn is.  Otherwise, not worth fussing with for me. 

[phoenix]

There was no problem for me implementing it as an OPNsense plugin, a few simple commands had it up and working in no time but the only problem was the age of the port. We use whatever works for us and I've no problem with that, I was just pointing out that there was a newer version available and it does work as described. FWIW, I've always had problems with openVPN hence the reason I switched to SoftEtherVPN.

[xinnan]

What kind of problems did openvpn give you?

[phoenix]

Just general problems configuring it and problems setting up the client and getting it to connect. To be fair it was probably just me that was the problem. As soon as I tried SoftEtherVPN from an on-line tutorial I had it compiled and installed within a short while, exported the config for OpenVPN, imported that into the Android OpenVPN client and away it went. I've been a fan ever since and now build an rpm for my CentOs server, install it with appropriate systemd units and it takes a very short while to do that and upgrade versions.

[xinnan]

The thing I like about openvpn is I can take your average idiot (and some below average ones), and export a client.  Just tell them to double click it and boom....   They are all set.  I've yet to meet the person who can't double click a file, so I'm a big fan of openvpn.  Generally speaking as soon as you say "OK - Now type this in...", you have already lost 90% of people.