How to Install SoftEther VPN Server on Ubuntu 24.04

Estimated reading: 10 minutes 254 views

SoftEther VPN (Virtual Private Network) is open-source software developed by the SoftEther VPN Project. It is a versatile solution that supports various VPN protocols and features. SoftEther VPN can be installed on various operating systems, including Windows, Linux, macOS, FreeBSD, and Solaris.

SoftEther VPN on a VPS offers a versatile and secure VPN solution, enabling users to protect their privacy, bypass restrictions, and securely access remote resources over the internet. Whether for personal or business use, SoftEther VPN provides a powerful tool for ensuring secure and private online communication.

This tutorial will show you how to install SoftEther VPN on Ubuntu 24.04.

Step 1 – Install SoftEther VPN

First, install the required packages using the following command:

apt-get install build-essential gnupg2 gcc make -y

Next, download the SoftEther VPN Server package from the official website. You can use wget to download the package directly from the command line:

wget https://www.softether-download.com/files/softether/v4.44-9807-rtm-2025.04.16-tree/Linux/SoftEther_VPN_Server/64bit_-_Intel_x64_or_AMD64/softether-vpnserver-v4.44-9807-rtm-2025.04.16-linux-x64-64bit.tar.gz

Once the download is complete, extract the contents of the package using the following command:

tar -xvzf softether-vpnserver-v4.44-9807-rtm-2025.04.16-linux-x64-64bit.tar.gz

Change to the vpnserver directory.

cd vpnserver/

Install the following dependency packages on the server.

apt install -y gcc binutils gzip libreadline-dev libssl-dev libncurses5-dev libncursesw5-dev libpthread-stubs0-dev

Then run the following command to start the build process.

make

Now make will make two binaries from the source code.

  • vpnserver: The server binary.
  • vpncmd: SoftEther VPN command line management utility

It will also check if your server environment can be used to run the EtherVPN server. As you can see, my server passed the check.

To keep the file system tidy and clean, it’s recommended to move the vpnserver directory to /opt/.

cd ..

mv vpnserver /opt/softether

Step 2: Create Systemd Service Unit

The VPN server can be started with:

/opt/softether/vpnserver start

Stop it with:

/opt/softether/vpnserver stop

To make the SoftEther VPN server automatically start at boot time, we can create a systemd service unit for it.

nano /etc/systemd/system/softether-vpnserver.service

Add the following lines to this file.

[Unit]
Description=SoftEther VPN Server
After=network.target

[Service]
Type=forking
ExecStart=/opt/softether/vpnserver start
ExecStop=/opt/softether/vpnserver stop
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Press Ctrl+O, then Enter to save the file. Press Ctrl+X to exit the Nano command line text editor. Then start the VPN server with the following command.

systemctl start softether-vpnserver

Enable auto-start at boot time.

systemctl enable softether-vpnserver

You can check its status with:

systemctl status softether-vpnserver

Sample output:

Step 3: Open Ports In the VPS Firewall

If there’s a firewall running on your server, then you will need to open several ports. For example, if you use UFW, then run the following command.

ufw allow 80,443,992,1194,555/tcp
ufw allow 1194,51612,53400,56452,40085/udp

Step 4: Configure SoftEther VPN Server

Now we need to use vpncmd To configure SoftEther VPN Server.

/opt/softether/vpncmd

Choose 1 to configure the VPN server.

  • The admin console is listening on port 5555. Enter 127.0.0.1:5555 to access the admin console.
  • Then press Enter to skip Virtual Hub selection.
  • By default, the password for the admin console is empty. We need to set a password by executing the ServerPasswordSet command.

Next, we need to configure a virtual hub in SoftEtherVPN. We can use the default virtual hub named DEFAULT.

Hub DEFAULT

Then create a VPN account with the following command. Replace username with your preferred username.

UserCreate greencloud

You will be asked to enter a group name, full name, and user description. You can press Enter to leave them empty.

Set a password for this user.

UserPasswordSet greencloud

Run the following command to enable virtual NAT and DHCP server function; otherwise, VPN clients won’t be able to get an IP address from the VPN server.

SecureNatEnable

Next, we need to configure the NAT for VPN users by executing the DhcpSet command.

DhcpSet

You will be asked a series of questions. Use the following settings.

  • Start Point for Distributed Address Band: 192.168.30.10
  • End Point for Distributed Address Band: 192.168.30.200
  • Subnet Mask: 255.255.255.0
  • Lease Limit (Seconds): 7200
  • Default Gateway: 192.168.30.1
  • DNS Server 1: 192.168.30.1
  • DNS server 2: 1.0.0.1
  • Domain Name: Press Enter to skip.
  • Save Log: yes

To log out of the admin console, run

exit

Step 5: Install a DNS Resolver on the Server

Since we specify the VPN server as the DNS server for clients, we need to run a DNS resolver on the VPN server. We can install the bind9 DNS server.

apt install -y bind9

Once it’s installed, BIND will automatically start. You can check its status with:

systemctl status named

Sample output:

If it’s not running, start it with:

systemctl start named

Edit the BIND DNS server’s configuration file.

nano /etc/bind/named.conf.options

Add the following line to allow VPN clients to send recursive DNS queries.

allow-recursion { 127.0.0.1; 192.168.30.0/24; };

Save and close the file. Then edit the /etc/default/named files.

sudo nano /etc/default/named

Add -4 to the OPTIONS to ensure BIND can query root DNS servers.

OPTIONS="-u bind -4"

Save and close the file.

By default, BIND enables DNSSEC, which ensures that DNS responses are correct and not tampered with. However, it might not work out of the box due to trust anchor rollover and other reasons. To make it work properly, we can rebuild the managed key database with the following commands.

rndc managed-keys destroy
rndc reconfig

Restart BIND9 for the changes to take effect.

systemctl restart named

Then you need to run the following command to allow VPN clients to connect to port 53.

ufw insert 1 allow in from 192.168.30.0/24

Step 6: Obtain a Trusted TLS Certificate from Let’s Encrypt

SoftEtherVPN server creates a self-signed TLS certificate during the installation process, but we will use a Let’s Encrypt certificate. The advantage of using a Let’s Encrypt certificate is that it’s free, easier to set up, and trusted by VPN client software.

Run the following commands to install the Let’s Encrypt client (certbot) from the default Ubuntu repository.

apt install -y certbot

To check the version number, run

certbot --version

Sample output:

I recommend using  webroot a plugin to obtain a  TLS certificate.

First, you need to create a virtual host for softethergreencloud.izviet.net.

Nginx

You are using Nginx, then

apt-get install nginx
systemctl start nginx
nano /etc/nginx/conf.d/softethergreencloud.example.net.conf

Paste the following lines into the file.

server {
      listen 80;
      server_name softethergreencloud.example.net;

      root /var/www/html/;

      location ~ /.well-known/acme-challenge {
         allow all;
      }
}

Save and close the file. Then create the web root directory.

mkdir -p /var/www/html

Set www-data (Nginx user) as the owner of the web root.

chown www-data:www-data /var/www/html -R

Reload Nginx for the changes to take effect.

systemctl reload nginx

Once the virtual host is created and enabled, run the following command to obtain a Let’s Encrypt certificate using the webroot plugin.

certbot certonly --webroot --agree-tos --key-type rsa --email [email protected] -d softethergreencloud.example.net -w /var/www/html

Step 7: Install the Let’s Encrypt TLS Certificate in SoftEther VPN Server

Log in to the VPN admin console as root.

/opt/softether/vpncmd 127.0.0.1:5555

Choose 1 to manage the VPN server. You will need to enter the password set in step 2.

Then run the following command to set the TLS Certificate and private key of the VPN server.

ServerCertSet

Enter the following path for the certificate.

/etc/letsencrypt/live/softethergreencloud.example.net/fullchain.pem

Enter the following path for the private key.

/etc/letsencrypt/live/softethergreencloud.example.net/privkey.pem

Log out of the admin console.

exit

Restart the VPN server.

systemctl restart softether-vpnserver

If you encounter the following error after entering the certificate and key file, it means you have obtained an ECDSA key from letsencrypt, but SofterEther currently only supports RSA keys.

The specified X509 certificate file does not contain a RSA 1024 bit or 2048 bit public key. SoftEther VPN software supports only RSA 1024 bit or 2048 bit certificates.

Step 8: Establish VPN Connection on Windows

You can use the Windows built-in tools to establish a VPN connection.

Press Windows key + I to open the Settings app. Then select Network & Internet -> VPN -> Add a VPN Connection.

Enter the VPN Connection details:

  • VPN Provider: Windows (Built-in)
  • Connection Name: SoftEther
  • Server Name or Address:  softethergreencloud.example.net (Please don’t add the https:// prefix).
  • VPN Type: Secure Socket Tunneling Protocol (SSTP)
  • Type of Sign-in info: username and password
  • Username: Your SoftEther VPN username
  • Password: Your SoftEther VPN password

Save the VPN settings, then select this VPN profile and click Connect.

Once the VPN is connected, you can open Windows PowerShell and enter the following command to check your VPN adapter.

ipconfig

As you can see, the SoftEther network adapter has been given the private IP address 192.168.30.10.

Then you should go to https://icanhazip.com to check your public IP address. If it shows your VPN server’s public IP address, that means SoftEther VPN is working properly.

Or you can install and use SoftEtherVPN Client on Windows as follows:

https://green.cloud/docs/how-to-install-and-use-softether-vpn-client-on-windows/

Install SSTP VPN Client on Linux Desktop

Debian/Ubuntu

apt install sstp-client network-manager-sstp

Fedora/CentOS/Rocky Linux/Alama Linux

dnf install sstp-client NetworkManager-sstp

Then you can run the following command to establish a VPN connection.

sstpc --cert-warn --save-server-route --user vpn_username --password vpn_password vpn.example.com:443 usepeerdns require-mschap-v2 noauth noipdefault nobsdcomp nodeflate

Then open another terminal window and run the following command to check if there is a network interface named ppp0.

ip addr

If it exists, then the VPN connections are successfully established. Next, run the following command to set the VPN server as the gateway.

route add default ppp0

Now run the following command to check your public IP address. It should show the VPN server’s public IP address.

curl https://icanhazip.com

Auto-Connect on System Startup (Linux Client)

To make SoftEther VPN client automatically connect to the server at boot time, we can create a systemd service unit.

sudo nano /etc/systemd/system/softether-vpnclient.service

Put the following lines in the file. Replace the red text.

[Unit]
  Description=SoftEther VPN Client
  After=network-online.target systemd-resolved.service
  Wants=network-online.target

[Service]
  Type=simple
  ExecStart=/usr/sbin/sstpc --cert-warn --save-server-route --user vpn_username --password vpn_password vpn.example.com:443 usepeerdns require-mschap-v2 noauth noipdefault nobsdcomp nodeflate
  ExecStartPost=/bin/bash -c 'sleep 7; route add default ppp0'
  ExecStop=pkill sstpc
  Restart=Always

[Install]
  WantedBy=multi-user.target

Save and close the file. Then enable this service so that it will start at boot time.

systemctl enable softether-vpnclient.service

To start this Systemd service immediately, run the following command. (If it doesn’t work the first time, then you can try running it again. )

systemctl start softether-vpnclient.service

To stop this Systemd service, run

systemctl stop softether-vpnclient.service

Conclusion

By following the installation and configuration steps outlined in this guide, users can set up their own SoftEther VPN Server instance on Ubuntu 24.04 and customize it according to their specific requirements. Whether you’re a small business looking to establish a secure remote access solution or an individual user wanting to protect your online privacy, SoftEther VPN provides the tools and capabilities needed to achieve these goals. Try to deploy the SoftEther VPN server on a dedicated server hosting from GreenCloud!

Share this Doc

How to Install SoftEther VPN Server on Ubuntu 24.04

Or copy link

CONTENTS

Powered By EazyDocs