Troubleshooting SoftEther VPN Connections Print

Hello there! I’m Corels from Emmanuel Corels Creatives, and welcome back to our SoftEther VPN series. Today, we’re going to tackle one of the most important aspects of managing any VPN setup—troubleshooting. Even with a well-configured SoftEther VPN Server, issues can arise. In this guide, I’ll walk you through common problems and practical steps to diagnose and resolve them, covering both server and client-side considerations.

Understanding the Common Issues

When working with SoftEther VPN, you might encounter a few recurring issues:

• Connection Failures: Clients can’t connect, or the connection drops unexpectedly.
• Authentication Problems: Incorrect certificates or credentials prevent login.
• Routing and NAT Issues: Even if the VPN tunnel is established, traffic might not flow as expected.
• Performance Hiccups: Slow speeds or high latency due to misconfigurations or network congestion.

Let’s dive into how to troubleshoot each of these issues.

Step 1: Verifying the Server Status

Using vpncmd:

1. Log into your SoftEther VPN Server using the vpncmd utility:

   sudo /usr/local/softether/vpncmd
   

2. Choose option 1 for VPN Server mode.
3. Connect locally by pressing Enter when prompted for the administrator password (if none is set) or by entering the set password.
4. Check the Virtual Hub status:

   HubInfoGet
   

   This command displays the status and configuration of your active Virtual Hub. Confirm that it’s online and that your settings (such as the hub name, user list, and security settings) are correct.

Using the Management Console:

• If you’re using the SoftEther VPN Server Manager GUI, ensure that the server status indicators are green and that there are no error messages displayed.

Step 2: Troubleshooting Client Connection Failures

Certificate and Credential Verification:

• Server Certificate:
  Ensure that your server certificate is valid and properly signed. In vpncmd, you can list certificates with:

  CertificateList
  

  Confirm that your certificate shows as “signed.” If you suspect an issue, consider re-signing the certificate:

  CertificateSign ovpn-server-cert
  

• User Credentials:
  Double-check that the VPN user’s credentials (username and password) are correctly configured. In vpncmd:

  UserList
  

  You should see your user (e.g., vpnuser1) listed with the proper settings. If there’s any doubt, reset the password using:

  UserPasswordSet vpnuser1
  

  Follow the prompts to enter a new password.

Protocol Settings:

• Verify that you have enabled the proper VPN protocol for your clients (OpenVPN, L2TP/IPsec, SSTP, etc.). For example, if you’re using OpenVPN:

  OpenVpnEnable
  

  Ensure that the chosen protocol’s settings (such as port and mode) match the configuration provided to clients.

Step 3: Checking Network Connectivity

Ping and Traceroute:

• From the server, use the built-in ping command to test connectivity:

  Ping 8.8.8.8
  

  If the server can reach external addresses, the basic WAN connection is sound.
• On the client side, perform a ping to the VPN server’s public IP or domain. This helps determine if the connection issue is within the VPN tunnel or with external routing.

Firewall and NAT Settings:

• Ensure that your VPS firewall (or any external firewall) allows the necessary VPN traffic. For example, if using OpenVPN, confirm that the configured port (e.g., TCP 1194) is open.
• If using L2TP/IPsec, verify that UDP ports 500 and 4500 are allowed.
• Use the router’s firewall logging to check if VPN traffic is being blocked:

  /log print where message~"drop"
  

  Look for entries that might indicate misconfigured rules affecting VPN connections.

Step 4: Reviewing Routing and NAT

Once the VPN tunnel is established, client traffic must be properly routed:

• Routing Table Check:
  In vpncmd, use:

  AccountStatusGet vpnuser1
  

  This command provides details about the VPN session, including the IP address assigned to the client.
• NAT Considerations:
  If clients can connect to the VPN but cannot access the internet or internal resources, review your NAT settings on the VPN server or gateway. Ensure that a masquerade rule is in place for VPN client traffic:

  /ip firewall nat add chain=srcnat src-address=<VPN_Pool_Subnet> action=masquerade
  

  Replace <VPN_Pool_Subnet> with the IP range assigned to VPN clients (e.g., 10.10.10.0/24).

Step 5: Monitoring and Logs

Using Logs for Insight:

• Examine logs in vpncmd or the SoftEther Management Console to identify error messages. For example:

  /log print
  

  Look for messages that indicate authentication failures, connection timeouts, or IPsec negotiation errors.

Performance Monitoring:

• Use system monitoring tools (like the built-in resource monitor in your VPS) to check CPU and memory usage. Heavy load on the server can sometimes cause VPN instability.

Step 6: Testing with Different Clients

If one client has trouble connecting, try testing with another device or a different VPN client application. This helps determine if the issue is client-specific (e.g., due to outdated software or misconfigured settings) or if it’s a broader server-side problem.

• Windows: Use SoftEther VPN Client Manager.
• Linux: Use either the native SoftEther VPN Client or an OpenVPN client if using an OpenVPN configuration.
• macOS: Use Tunnelblick or another compatible OpenVPN client.

Final Thoughts

Troubleshooting SoftEther VPN connections involves a systematic approach: verifying server status, checking user credentials and certificates, ensuring proper network connectivity, reviewing firewall and NAT rules, and monitoring logs. With these steps, you can quickly pinpoint and resolve most common issues.

Remember, troubleshooting is as much about careful observation as it is about knowing the right commands. Practice these steps in a test environment, and over time, you’ll become adept at diagnosing and fixing issues swiftly. If you have any questions or need further assistance, feel free to reach out. Happy troubleshooting, and here’s to smooth, secure connections!

Explained with practical clarity by
Corels – Admin, Emmanuel Corels Creatives