10.2 Common Concepts and Knowledge

VPN Server Reachability at The TCP/IP Level

A VPN Server must deal with connection requests from VPN Clients, VPN Bridges, and, in some situations, from other VPN Servers. Therefore, a VPN Server must be installed to a location that meets the following requirement:

• TCP/IP communication must be possible between the VPN Server and any VPN clients that wish to connect to it. (If you can go through a proxy server or change your NAT settings to allow traffic through certain TCP/IP ports to your private IP addresses then that is sufficient.)

When setting up a VPN network with older VPN protocols such as PPTP or L2TP/IPSec, the VPN server must be a computer with a public IP address to the Internet.

However with SoftEther VPN you don't have to install VPN Server on a computer with a public IP address. VPN Server will work just fine on a computer behind NAT or a firewall in your private IP address space. Please refer to section 10.2 Common Concepts and Knowledge for more details on setting up a server under these circumstances.

VPN Server Reachability At The TCP/IP Level.

VPN Server Administrator

When you install VPN Server you must first decide who will be the VPN Server administrator.

• When the administrator of the server you are about to install VPN Server on will be the same as the VPN Server administrator
  In this case you can install VPN Server yourself. Once the VPN Server install is completed you will be able to set all administrator passwords.
• When the administrator of the server you are about to install VPN Server on is not going to be the VPN Server administrator
  In this case you must request that the server's administrator (root or Administrator) install VPN Server for you. Once the installation has been completed log in locally or remotely to the VPN Server service by using the VPN server administration tool and set all administrator passwords.
  If you are going to operate VPN Server in User Mode (see section 3.2.2 User Mode for more information) and you can log into the server machine as a general user then you can use VPN Server under your own user privileges without asking the system administrator. However, this method is not recommended.

Virtual Hub Administrator

Once you have installed VPN Server you must decide how many Virtual Hubs to create, their names, and what purpose each will serve. If you wish to give Virtual Hub administrator rights to another user then set the Virtual Hub administrator password and give your administrator rights to that user. (See section 3.3.4 Administration Authority for more information.)

In most cases the VPN Server administrator will also be administrating the Virtual Hub, so there is no need to give administrator rights to another user.

Installing VPN Server Behind NAT or a Firewall

If you install VPN Server on a computer in your private network space behind NAT or a firewall, you will have to configure NAT or the firewall to forward data to specific TCP/IP ports on the VPN Server computer. Please refer to your NAT/firewall's manual, or ask your NAT/firewall administrator, to properly set up this configuration.

You must allow TCP/IP traffic to pass through at least 2 of the VPN Server TCP/IP listen ports described in section 3.3.6 Listener Ports. Under most situations we recommend you to open traffic to port 443. The reason for this is that using this port VPN Clients can easily send VPN packets through firewalls or proxy servers masked as HTTPS data.

Installing VPN Server Behind NAT or a Firewall.

Using a Reverse Proxy

Another method of installing VPN Server on a computer in your private network space is by utilizing a proxy server. If your network uses a HTTP proxy server to transmit data out to public IP addresses from your private IP addresses then it can also be configured to route data from the Internet through itself to the listen port on the VPN Server sitting in your private network space.

Things To Consider when Installing VPN Server in Your Private Network Space

When using the above methods to install VPN Server in your private network space, always make sure that equipment such as your NAT, firewall, proxy server, etc. will be able to handle the extra load. The NAT and/or firewalls built into inexpensive hardware such as generic broadband routers are usually very slow, so be careful when using these.

If the performance of this hardware is insufficient, your VPN network speed will also suffer a significant speed reduction.

Configuring Hardware that Restricts TCP/IP Traffic

With conventional firewall or NAT hardware you can configure them to allow TCP/IP traffic to pass through at least port 443 (HTTPS). However a few extremely secure networks will filter data addressed to port 443 from the Internet. In that case, if there is another port which you can route TCP/IP traffic through you can use that port to allow VPN Server to be seen from the Internet. (See section 3.3.6 Listener Ports for more information on how to change port numbers.)

If there is no way to open access to your VPN service under your network configuration you must either request for the firewall to be re-configured or set up a VPN Server computer outside the private network space.