vpn归档 - KB记录与收集站

Linux

How to Install SoftEther VPN Server on Ubuntu 20.04

2022年7月26日

SoftEther VPN is a free, open source and one of the most powerful multi-protocol VPN software. It can be installed on all major operating systems including, Windows, Linux, Mac, FreeBSD and Solaris. It is simple, easy to use and developed by the University of Tsukuba in Japan. It is an alternative to OpenVPN and Microsoft’s VPN servers and can integrate from OpenVPN to SoftEther VPN smoothly.

SoftEther VPN Prerequisites

Two servers running Ubuntu 20.04 server, one for VPN server and one for VPN client.
A root password is configured on both servers.

1.Install Required Dependency

First, it is a good idea to update your system’s package cache to the latest version. Run the following command to update all package cache.

apt-get update -y

Copy

Once your system is updated, install other required dependencies using the following command:

apt-get install build-essential gnupg2 gcc make -y

Copy

Once all the dependencies are installed, you can proceed to the next step.

2.Install SoftEther VPN on Ubuntu 20.04

First, go to the SoftEther VPN download page and download the latest version using the following command:

wget http://www.softether-download.com/files/softether/v4.38-9760-rtm-2021.08.17-tree/Linux/SoftEther_VPN_Server/64bit_-_Intel_x64_or_AMD64/softether-vpnserver-v4.38-9760-rtm-2021.08.17-linux-x64-64bit.tar.gz

Copy

Sample output:

HTTP request sent, awaiting response... 200 OK
Length: 7529219 (7.2M) [application/x-gzip]
Saving to: ‘softether-vpnserver-v4.38-9760-rtm-2021.08.17-linux-x64-64bit.tar.gz’

softether-vpnserver-v4.38-9760-rtm- 100%[==================================================================>]   7.18M  1.01MB/s    in 10s

2021-10-15 08:36:37 (704 KB/s) - ‘softether-vpnserver-v4.38-9760-rtm-2021.08.17-linux-x64-64bit.tar.gz’ saved [7529219/7529219]

Copy

Once the download is completed, extract the downloaded file using the following command:

tar -xvzf softether-vpnserver-v4.38-9760-rtm-2021.08.17-linux-x64-64bit.tar.gz

Copy

Next, navigate to the extracted directory and install the SoftEther VPN using the following command:

cd vpnserver
make

Copy

Once the installation has been finished, you will get the following output:

*** PacketiX VPN Server HTML5 Web Administration Console (NEW) ***
This VPN Server / Bridge has the built-in HTML5 Web Administration Console.

After you start the server daemon, you can open the HTML5 Web Administration Console is available at

https://127.0.0.1:5555/
or
https://ip_address_of_the_vpn_server:5555/

This HTML5 page is obviously under construction, and your HTML5 development contribution is very appreciated.

--------------------------------------------------------------------

make[1]: Leaving directory '/root/vpnserver'

Copy

Next, go back to your home directory and move the extracted directory to /ust/local directory:

cd ..
mv vpnserver /usr/local/

Copy

Next, set proper permission to vpnserver directory:

cd /usr/local/vpnserver/
chmod 600 *
chmod 700 vpnserver
chmod 700 vpncmd

Copy

Once you are finished, you can proceed to the next step.

3.Create a Systemd Service File for SoftEther VPN

Next, you will need to create a systemd service file to manage the SoftEther VPN service. You can create it using the following command:

nano /etc/init.d/vpnserver

Copy

Add the following lines:

#!/bin/sh
# chkconfig: 2345 99 01
# description: SoftEther VPN Server
DAEMON=/usr/local/vpnserver/vpnserver
LOCK=/var/lock/subsys/vpnserver
test -x $DAEMON || exit 0
case "$1" in
start)
$DAEMON start
touch $LOCK
;;
stop)
$DAEMON stop
rm $LOCK
;;
restart)
$DAEMON stop
sleep 3
$DAEMON start
;;
*)
echo "Usage: $0 {start|stop|restart}"
exit 1
esac
exit 0

Copy

Save and close the file then create required directory and set proper permission to the systemd service file using the command below:

mkdir /var/lock/subsys
chmod 755 /etc/init.d/vpnserver

Copy

Next, start the SoftEther VPN with the following command:

/etc/init.d/vpnserver start

Copy

You will get the following output:

The SoftEther VPN Server service has been started.

Let's get started by accessing to the following URL from your PC:

https://69.28.88.203:5555/
  or
https://69.28.88.203/

Note: IP address may vary. Specify your server's IP address.

Copy

Next, enable the SoftEther VPN service to start at system reboot:

update-rc.d vpnserver defaults

Copy

4.Configure SoftEther VPN Server

Next, change the directory to /usr/local/vpnserver and configure the SoftEther VPN using the following command:

cd /usr/local/vpnserver
./vpncmd

Copy

You will be asked to select VPN component:

By using vpncmd program, the following can be achieved.

1. Management of VPN Server or VPN Bridge
2. Management of VPN Client
3. Use of VPN Tools (certificate creation and Network Traffic Speed Test Tool)

Select 1, 2 or 3: 1

Copy

Type 1 and press Enter twice. You will get the following output:

Specify the host name or IP address of the computer that the destination VPN Server or VPN Bridge is operating on.
By specifying according to the format 'host name:port number', you can also specify the port number.
(When the port number is unspecified, 443 is used.)
If nothing is input and the Enter key is pressed, the connection will be made to the port number 8888 of localhost (this computer).
Hostname of IP Address of Destination:

If connecting to the server by Virtual Hub Admin Mode, please input the Virtual Hub name.
If connecting by server admin mode, please press Enter without inputting anything.
Specify Virtual Hub Name:
Connection has been established with VPN Server "localhost" (port 443).

You have administrator privileges for the entire VPN Server.

Copy

Next, run the following command to set a password:

ServerPasswordSet

Copy

You should see the following output:

ServerPasswordSet command - Set VPN Server Administrator Password
Please enter the password. To cancel press the Ctrl+D key.

Password: **********
Confirm input: **********


The command completed successfully.

Copy

Next, run the following command to create a hub and set a password:

HubCreate myhub

Copy

You will get the following output:

HubCreate command - Create New Virtual Hub
Please enter the password. To cancel press the Ctrl+D key.

Password: **********
Confirm input: **********


The command completed successfully.

Copy

Next, enter to the hub using the following command:

Hub myhub

Copy

Sample output:

Hub command - Select Virtual Hub to Manage
The Virtual Hub "myhub" has been selected.
The command completed successfully.

VPN Server/myhub>

Copy

Next, allow the hub to work as a virtual LAN, run the following command:

SecureNatEnable

Copy

Sample output:

SecureNatEnable command - Enable the Virtual NAT and DHCP Server Function (SecureNat Function)
The command completed successfully.

Copy

Next, create a VPN user with the following command:

UserCreate vpnuser

Copy

Sample output:

UserCreate command - Create User
Assigned Group Name:

User Full Name: VPN User

User Description: IT

The command completed successfully.

Copy

Next, set a password for VPN user using the command below:

UserPasswordSet vpnuser

Copy

Sample output:

UserPasswordSet command - Set Password Authentication for User Auth Type and Set Password
Please enter the password. To cancel press the Ctrl+D key.

Password: **********
Confirm input: **********


The command completed successfully.

Copy

Next, enable the IPsec to get Multi-Protocol working using the following command:

IPsecEnable

Copy

Answer all the questions as shown below:

IPsecEnable command - Enable or Disable IPsec VPN Server Function
Enable L2TP over IPsec Server Function (yes / no): yes

Enable Raw L2TP Server Function (yes / no): yes

Enable EtherIP / L2TPv3 over IPsec Server Function (yes / no): yes

Pre Shared Key for IPsec (Recommended: 9 letters at maximum): vpnserver

Default Virtual HUB in a case of omitting the HUB on the Username: myhub

The command completed successfully.

Copy

Finally, exit from the VPN configuration wizard using the following command:

exit

Copy

5.Configure UFW Firewall

If the UFW firewall is installed and configured in your system then you will need to allow ports 443, 5555, 992 and 1194 through the firewall. You can allow them with the following command:

ufw allow 443/tcp
ufw allow 5555/tcp
ufw allow 992/tcp
ufw allow 1194/udp

Copy

Once all the required rules are added, reload the UFW firewall using the following command:

ufw reload

Copy

Also Read

What is a Squid Proxy Cache Server? (Features Explained)

1.Install SoftEther VPN Client

At this point, the SoftEther VPN server is installed and running. Now, you will need to install the SoftEther VPN client on the Client machine.
First, install the required dependencies using the following command:

apt-get install build-essential gnupg2 gcc make -y

Copy

Next, download the latest version of the SoftEther VPN client using the following command:

wget http://www.softether-download.com/files/softether/v4.38-9760-rtm-2021.08.17-tree/Linux/SoftEther_VPN_Client/64bit_-_Intel_x64_or_AMD64/softether-vpnclient-v4.38-9760-rtm-2021.08.17-linux-x64-64bit.tar.gz

Copy

Once the download is completed, extract the downloaded file with the following command:

tar -xvzf softether-vpnclient-v4.38-9760-rtm-2021.08.17-linux-x64-64bit.tar.gz

Copy

This will extracts all contents in to the vpnclient directory. Next, create a directory to store VPN client script.

mkdir /root/vpnscript

Copy

Next, go visit the VPN script download page and download all scripts using the following command.

cd /root/vpnscript
wget https://raw.githubusercontent.com/mfaizanse/intellexlab-files/main/softether-vpn-client/remove-client.sh
wget https://raw.githubusercontent.com/mfaizanse/intellexlab-files/main/softether-vpn-client/setup-client.sh
wget https://raw.githubusercontent.com/mfaizanse/intellexlab-files/main/softether-vpn-client/vpn-connect.sh
wget https://raw.githubusercontent.com/mfaizanse/intellexlab-files/main/softether-vpn-client/vpn-disconnect.sh
wget https://raw.githubusercontent.com/mfaizanse/intellexlab-files/main/softether-vpn-client/vpn_config

Copy

Once all the scripts are downloaded, set proper permission to the downloaded script:

chmod 755 *

Copy

Next, edit the vpn_config file and define your VPN client directory, VPN server IP, VPN username, and local gateway IP.

nano vpn_config

Copy

Add the following lines as per your configuration:

CLIENT_DIR="/root/vpnclient"
NIC_NAME="nic1"
ACCOUNT_NAME="vpnuser"
VPN_HOST_IPv4="vpn-server-ip"
LOCAL_GATEWAY="gateway-ip-of-client-machine"

Copy

Save and close the file then setup the VPN client using the following command:

./setup-client.sh

Copy

You will be asked to provide your VPN server IP, port, Hub name, VPN username, Virtual adapter name and password as shown below:

Connected to VPN Client "localhost".

VPN Client>AccountCreate vpnuser
AccountCreate command - Create New VPN Connection Setting
Destination VPN Server Host Name and Port Number: 69.28.88.203:443

Destination Virtual Hub Name: myhub

Connecting User Name: vpnuser

Used Virtual Network Adapter Name: nic1

The command completed successfully.

vpncmd command - SoftEther VPN Command Line Management Utility
SoftEther VPN Command Line Management Utility (vpncmd command)
Version 4.38 Build 9760   (English)
Compiled 2021/08/17 22:32:49 by buildsan at crosswin
Copyright (c) SoftEther VPN Project. All Rights Reserved.

Connected to VPN Client "localhost".

VPN Client>AccountPassword vpnuser
AccountPasswordSet command - Set User Authentication Type of VPN Connection Setting to Password Authentication
Please enter the password. To cancel press the Ctrl+D key.

Password: **********
Confirm input: **********


Specify standard or radius: radius

The command completed successfully.

Copy

Next, connect to the VPN server using the following script:

./vpn-connect.sh

Copy

Once you are connected successfully, you will get the following output:

Stopping the SoftEther VPN Client service ...
SoftEther VPN Client service has been stopped.
The SoftEther VPN Client service has been started.
vpncmd command - SoftEther VPN Command Line Management Utility
SoftEther VPN Command Line Management Utility (vpncmd command)
Version 4.38 Build 9760   (English)
Compiled 2021/08/17 22:32:49 by buildsan at crosswin
Copyright (c) SoftEther VPN Project. All Rights Reserved.

Connected to VPN Client "localhost".

VPN Client>AccountConnect vpnuser
AccountConnect command - Start Connection to VPN Server using VPN Connection Setting
The command completed successfully.

vpncmd command - SoftEther VPN Command Line Management Utility
SoftEther VPN Command Line Management Utility (vpncmd command)
Version 4.38 Build 9760   (English)
Compiled 2021/08/17 22:32:49 by buildsan at crosswin
Copyright (c) SoftEther VPN Project. All Rights Reserved.

Connected to VPN Client "localhost".

VPN Client>AccountList
AccountList command - Get List of VPN Connection Settings
Item                        |Value
----------------------------+-------------------------------------------
VPN Connection Setting Name |vpnuser
Status                      |Connected
VPN Server Hostname         |69.28.88.203:443 (Direct TCP/IP Connection)
Virtual Hub                 |myhub
Virtual Network Adapter Name|nic1
The command completed successfully.

Copy

After the successful connection, a new VPN interface named vpn_nic1 has been created. You can check it using the following command:

ifconfig

Copy

You will get the following output:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 69.28.85.54  netmask 255.255.254.0  broadcast 69.28.85.255
        inet6 fe80::200:45ff:fe1c:5536  prefixlen 64  scopeid 0x20<link>
        ether 00:00:45:1c:55:36  txqueuelen 1000  (Ethernet)
        RX packets 19867  bytes 74357003 (74.3 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8098  bytes 1085017 (1.0 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 854  bytes 648247 (648.2 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 854  bytes 648247 (648.2 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vpn_nic1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.30.10  netmask 255.255.255.0  broadcast 192.168.30.255
        inet6 fe80::5c86:a0ff:fe6a:a652  prefixlen 64  scopeid 0x20<link>
        ether 5e:86:a0:6a:a6:52  txqueuelen 1000  (Ethernet)
        RX packets 312  bytes 20440 (20.4 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 292  bytes 22588 (22.5 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Read

How to Install SoftEther VPN Server on Ubuntu 20.04 (cloudinfrastructureservices.co.uk)

intellexlab-files/softether-vpn-client at main · mfaizanse/intellexlab-files · GitHub

Microsoft, Other, Proxy, Tools

Softether VPN 去除开源版本的企业限制

2022年4月24日

在服务端配置过程中遇到一个问题就是不能下发明细路由，这里叫他拆分隧道。如果不处理这个问题，所有请求都会从VPN饶。

但是在SoftEther VPN下发明细路由推送的时候提示：不支持此功能。它尚未在SoftEther VPN的开源版本上实施。

解除限制方法 1 ：

编译Softethervpn的源码

主要看下源码中的限制位置，Softethervpn 4.38 Build 9760

限制代码在src/Cedar/Server.c

// The SoftEther VPN Project intentionally disables these functions for users
// in Japan and China. The reason is: Daiyuu Nobori, the chief author of
// SoftEther VPN, has been liable to observe the existing agreements and
// restrictions between him and some companies. The agreements have regulated
// the region-limited restriction to implement and distribute the above
// enterprise functions on the SoftEther VPN open-source program.
//
// Therefore, the SoftEther VPN Project distributes the binary program and
// the source code with the "SiIsEnterpriseFunctionsRestrictedOnOpenSource"
// function. This function identifies whether the SoftEther VPN Server
// program is running in either Japan or China. If the restricted region is
// detected, then the above enterprise functions will be disabled.
//
// Please note that the above restriction has been imposed only on the
// original binaries and source codes from the SoftEther VPN Project.
// Anyone, except Daiyuu Nobori, who understands and writes the C language
// program can remove this restriction at his own risk.
//
bool SiIsEnterpriseFunctionsRestrictedOnOpenSource(CEDAR *c)
{
    char region[128];
    bool ret = false;
    // Validate arguments
    if (c == NULL)
    {
        return false;
    }
 
 
    SiGetCurrentRegion(c, region, sizeof(region));
 
    if (StrCmpi(region, "JP") == 0 || StrCmpi(region, "CN") == 0)
    {
        ret = true;
    }
 
    return ret;
}

直接改为return false就行了

解除限制方法 2 ：

安装好服务端以后，修改vpnsmgr_x64和vpnserver_x64函数返回值就可以，OD载入搜索CN，JP关键字，看到或条件的比较满足条件就会触发

mov dword ptr ss:[rsp+B0],1

将1的写入，改成0的写入

实测可用

附已经修改版本

Softethervpn 4.38 Build 9760

补丁下载

链接: https://pan.baidu.com/s/1nW83Zn5IHmfuWOPVIgZfeg?pwd=qgi6

提取码: qgi6

安装服务端后，把压缩包里面的vpnserver_x64文件覆盖到安装目录里面，重启Softether服务。

x64dbg修改方法：

打开vpnserver_x64.exe

使用所有模块模式搜索字符串

在搜索框里面搜索CN，选中第二个CN

需要我们修改的位置00007FF6D7CADEFA | C78424 B0000000 01000000 | mov dword ptr ss:[rsp+B0],1

现在开始制作补丁，选中修改的内容，然后选中汇编

把原来的mov dword ptr ss:[rsp+0xB0], 0x1改成mov dword ptr ss:[rsp+0xB0], 0x0

修改成功后，开始制作补丁

点修补文件

保存后，会提示补丁应用成功

接下来就需要把受限的vpnserver_x64.exe替换成我们修改过的vpnserver_x64.exe文件就可以了。

替换的时候需要停止服务

Linux, Microsoft, Proxy, Tools

Ubuntu VPN L2TP/IPSec

2021年8月7日

Environment for this script:
System support: CentOS6+, Debian7+, Ubuntu12+
Memory requirement: ≥128M

About this script:
The terms are explained as follows
L2TP (Layer 2 Tunneling Protocol)
IPSec (Internet Protocol Security)
IKEv2 (Internet Key Exchange v2)
Currently, there are three types of IPsec that can be implemented: openswan, libreswan, and strongswan.
Libreswan is based on a fork of openswan, so now you can hardly see openswan in various distributions.
Of course there are also strongswan ones.

The reason for updating the L2TP one-click installation script is because as various Linux distributions continue to introduce new ones, the original scripts are no longer suitable for current needs.
This script compiles and installs the latest version of libreswan to achieve IPSec (all yum installations under CentOS7), yum or apt-get to install xl2tpd, and then deploy firewall rules according to different usage methods of each release.

VPS based on OpenVZ virtualization technology needs to enable TUN/TAP to be used normally. When purchasing a VPS, please consult the service provider whether it supports enabling TUN/TAP.

OpenVZ virtual VPS requires the system kernel to support IPSec.
It is not recommended to install this script on OpenVZ VPS.

How to check whether the TUN module is supported?
Excuting an order:
cat /dev/net/tun
If the returned information is: cat: /dev/net/tun: File descriptor in bad state, it means normal

How to check whether the ppp module is supported?
Excuting an order:
cat /dev/ppp
If the return information is: cat: /dev/ppp: No such device or address, it is normal
Of course, the script will also perform a check during installation, and the script will prompt if it is not suitable for installation.

installation method:
After the root user logs in, run the following command:

wget --no-check-certificate https://raw.githubusercontent.com/teddysun/across/master/l2tp.sh
chmod +x l2tp.sh
./l2tp.sh

After execution, there will be the following interactive interface

Please input IP-Range:
(Default Range: 192.168.18):
Enter the local IP range (a local IP address assigned to the local computer after connecting to the VPS), and press Enter directly means to enter the default value of 192.168.18

Please input Username:
(Default Username: teddysun):
Username means username, that is, the first default user. Enter directly means to enter the default value teddysun

Please input teddysun’s password:
(Default Password: Q4SKhu2EXQ):
Enter the user’s password. By default, a 10-digit password containing uppercase and lowercase letters and numbers will be randomly generated. Of course, you can also specify a password.

Press any key to start…or Press Ctrl+c to cancel
Press any key to continue, if you want to cancel the installation, please press Ctrl+c

After the installation is complete, the script will execute the ipsec verify command and prompt as follows:

Export iptables settings

sudo sh -c "iptables-save > /etc/network/iptables.up.rules"

Modify settings

sudo vi /etc/network/iptables.up.rules

Change the external network IP to the internal network IP

-A POSTROUTING -s 192.168.18.0/24 -j SNAT --to-source <Intranet ip>

application

sudo iptables-apply

If you want to operate on users, you can use the following commands:
l2tp -a add user
l2tp -d delete user
l2tp -m modify the password of an existing user
l2tp -l lists all user names and passwords
l2tp -h lists help information

something else:

After the script is installed, the process has been automatically started, and the boot-up self-start has been added.
The script will rewrite the rules of iptables or firewalld.
When the script is installed, the installation log will be written to the /root/l2tp.log file immediately. If you fail to install, you can use this file to find the error message.

Connection failed：

Windows

1.The Windows 10 system L2TP connection attempt failed: ERROR because the security layer encountered a processing error when initializing the negotiation with the remote computer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters

On the “Edit” menu, click “New” -> “DWORD Value”
In the “Name” box, type ” AllowL2TPWeakCrypto “
In the “Value data” box, type “1”, and then click “OK”

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters

On the “Edit” menu, click “New” -> “DWORD Value”
In the “Name” box, type “ProhibitIpSec”
In the “Value data” box, type “1”, and then click “OK”

2. L2TP 809 error, win10 prompts that l2tp is not allowed to pass by firewalls and other devices

There are three services that need to be started (“Remote Access Auto Connection Manager”, “Remote Access Connection Manager” and “Secure Socket Tunneling Protocol Service”),

3. The network connection between the computer and the VPN server cannot be established because the remote server is not responding. This may not connect the computer…

CMD Run

REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent" /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 2 /f

4. Delete the Wan MIniport (IP) device, and then restart the system

Mac OS

The macos vpn L2TP server is not responding. Please try to connect again.

sudo vim /etc/ppp/options
plugin L2TP.ppp
l2tpnoipsec

Reference/Reprint

https://www.cnblogs.com/wangyang0210/p/14713594.html

https://blog.csdn.net/weixin_33940102/article/details/92636184

https://my.oschina.net/vcship/blog/1621796

Microsoft, Tools

Use SS/SSR to accelerate online games

2021年6月14日

https://github.com/krishuang0610/SSTap-Rule

Proxy

免费VPN

2021年3月31日

https://www.zhenleguan.com/