Install SoftEther VPN
on Debian / Ubuntu

SoftEther VPN is a powerful, free, open-source multi-protocol VPN server developed as part of a research project at the University of Tsukuba, Japan. It supports SSL-VPN, L2TP/IPsec, OpenVPN, Microsoft SSTP, L2TPv3 and EtherIP — all from a single server instance.

Before you begin, make sure you have:

• A server running Debian 11/12 or Ubuntu 22.04/24.04 (64-bit recommended)
• Root or sudo access on the server
• A public IP address (or a domain pointing to it) for client connections
• Basic familiarity with the Linux command line
• Ports 443, 992, 1194, 5555 open in your firewall / cloud security group

Update your package index and install the required libraries:

sudo apt update && sudo apt upgrade -y

sudo apt install -y \
  build-essential \
  libreadline-dev \
  libssl-dev \
  zlib1g-dev \
  wget \
  curl

These packages provide the build tools and SSL libraries required to compile and run SoftEther VPN.

Download the latest SoftEther VPN Server for Linux from the official website. Always grab the latest stable build from softether-download.com.

# Navigate to your home or opt directory
cd /usr/local/src

# Download the latest VPN Server build (x86_64 Linux)
# Replace the URL below with the latest version from the download page
wget https://github.com/SoftEtherVPN/SoftEtherVPN_Stable/releases/download/v4.43-9799-beta/softether-vpnserver-v4.43-9799-beta-2023.08.31-linux-x64-64bit.tar.gz

Extract the archive:

tar -xvzf softether-vpnserver-*.tar.gz
cd vpnserver

SoftEther uses a make-based build process that prompts you to accept the license agreement during compilation.

# Compile — you will be prompted to read and accept the license
make

# Move to a permanent location
sudo mv /usr/local/src/vpnserver /usr/local/vpnserver

# Set correct permissions
sudo chmod 600 /usr/local/vpnserver/*
sudo chmod 700 /usr/local/vpnserver/vpnserver
sudo chmod 700 /usr/local/vpnserver/vpncmd

Create a systemd unit file so SoftEther starts automatically on boot and can be managed with standard systemctl commands.

sudo nano /etc/systemd/system/vpnserver.service

Paste the following unit file content:

[Unit]
Description=SoftEther VPN Server
After=network.target auditd.service

[Service]
Type=forking
ExecStart=/usr/local/vpnserver/vpnserver start
ExecStop=/usr/local/vpnserver/vpnserver stop
KillMode=process
Restart=on-failure

[Install]
WantedBy=multi-user.target

Enable and start the service:

sudo systemctl daemon-reload
sudo systemctl enable vpnserver
sudo systemctl start vpnserver
sudo systemctl status vpnserver

SoftEther is configured through vpncmd — a command-line management tool. Launch it on the server itself:

sudo /usr/local/vpnserver/vpncmd

At the menu, follow these prompts:

1. Type 1 to select VPN Server or VPN Bridge
2. Press Enter to connect to localhost (default)
3. Press Enter to skip the Virtual Hub name (connects as administrator)
4. Type ServerPasswordSet and press Enter to set the admin password
5. Enter and confirm your new admin password
6. Type HubCreate VPN to create a virtual hub named VPN
7. When prompted, set a hub password (or leave blank for no hub password)
8. Type Hub VPN to switch into the new hub

Create a user account

# Create a user (replace "alice" with your desired username)
UserCreate alice /GROUP:none /REALNAME:"Alice" /NOTE:"VPN user"

# Set a password for the user
UserPasswordSet alice

Enable L2TP/IPsec

# Enable L2TP/IPsec with a Pre-Shared Key (replace "mypresharedkey")
IPsecEnable /L2TP:yes /L2TPRAW:no /ETHERIP:no /PSK:mypresharedkey /DEFAULTHUB:VPN

Enable SecureNAT (virtual NAT + DHCP)

SecureNatEnable

Type exit to leave vpncmd.

Open the required ports with ufw (or your preferred firewall):

# SoftEther SSL-VPN / SSTP
sudo ufw allow 443/tcp

# SoftEther alternate SSL port
sudo ufw allow 992/tcp

# OpenVPN
sudo ufw allow 1194/udp

# L2TP/IPsec
sudo ufw allow 500/udp
sudo ufw allow 4500/udp
sudo ufw allow 1701/udp

# Admin GUI port (optional — restrict to your IP in production)
sudo ufw allow 5555/tcp

sudo ufw reload

For clients to route internet traffic through the VPN, the server needs IP forwarding enabled:

# Enable IPv4 forwarding
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf

# Apply immediately (no reboot required)
sudo sysctl -p

Verify the setting took effect:

cat /proc/sys/net/ipv4/ip_forward
# Expected output: 1

SoftEther supports multiple connection methods. Use whichever protocol is natively available on your client device.

L2TP/IPsec (iOS, Android, Windows, macOS)

SoftEther VPN Client (Windows)

1. Download and install the SoftEther VPN Client
2. Create a new VPN connection
3. Enter your server's IP / hostname and port 443
4. Select the VPN hub
5. Log in with your username and password

Check the service log

sudo journalctl -u vpnserver -f

Check SoftEther's own log files

ls /usr/local/vpnserver/server_log/
tail -f /usr/local/vpnserver/server_log/vpn_YYYYMMDD.log

Common issues

SoftEther VPN is a free, open-source project with a rich academic and community history. Here is a full overview of the people and organisations behind it.

Founder & Core Developer

Notable Contributors

Academic Origin

SoftEther VPN was originally developed as a research project at the University of Tsukuba, Japan, under the supervision of the SoftEther Project lab. The name SoftEther stands for Software Ethernet — reflecting the project's goal of implementing full Ethernet-level networking entirely in software.

Government & Institutional Support

License

SoftEther VPN is released under the Apache License 2.0, effective from January 21, 2019 (switched from GPLv2). This means you are free to use, modify, and distribute the software, including for commercial purposes, as long as you comply with the license terms.

Copyright (c) all contributors on SoftEther VPN project in GitHub.
Copyright (c) Daiyuu Nobori, SoftEther Project at University of Tsukuba,
              and SoftEther Corporation. All Rights Reserved.

Official Links