SoftEther

What Is SoftEther?

You want a VPN you can run yourself—for remote access into a home/office network or for site-to-site links—without being forced into a single client app, a single protocol, or a single “one true way” of getting through firewalls. SoftEther is built for that problem: it’s a VPN server (plus client/bridge tools) that can accept connections using multiple VPN protocols, so different devices can connect using whatever they already support.

This is not a consumer “click-to-connect and pick a country” VPN subscription. It’s infrastructure software: you install and operate the server. Where it gets distinctive is protocol flexibility. The project’s own SoftEther VPN protocol is designed around “Ethernet over HTTPS” to blend in with ordinary HTTPS traffic patterns, and SoftEther VPN Server can also speak common protocols like OpenVPN, L2TP/IPsec, and MS-SSTP—often letting users connect with built-in OS clients instead of installing a special client.

SoftEther is open-source and distributed under the Apache License 2.0 in its current form (historically it was GPLv2). That matters if you’re evaluating it for enterprise/internal use, security review, packaging, or long-term maintainability.

SoftEther Features and Performance

SoftEther VPN Server is explicitly built as a multi-protocol VPN concentrator. Per the project’s own specifications, it supports the SoftEther VPN Protocol (Ethernet over HTTPS) as well as OpenVPN, MS-SSTP, L2TPv3/IPsec, and EtherIP/IPsec, and it includes an L2TP/IPsec server function. (VPNSpotter database specs also list OpenVPN, L2TP/IPsec, MS-SSTP, L2TPv3/IPsec, EtherIP/IPsec and the SoftEther protocol.)

A practical upside of this design: you can serve different client types from one server. Windows has built-in SSTP support; many platforms support L2TP/IPsec; OpenVPN has broad third‑party client availability; and SoftEther’s own client can connect using the SoftEther protocol when you want those specific behaviors. SoftEther’s Wikipedia entry also notes that because the server supports multiple VPN protocols (including L2TP/IPsec and MS‑SSTP), users may not need to install the SoftEther client on client computers in many scenarios.

SoftEther’s “Ethernet over HTTPS” approach is a core differentiator. The project describes SoftEther VPN as using HTTPS to establish a VPN tunnel and encapsulating Ethernet over HTTPS. If you operate in networks where outbound rules are strict and 443/TCP is the only reliable egress, that design goal is obvious.

There are also connectivity helpers aimed at real-world deployment pain: the project documents built-in Dynamic DNS and NAT Traversal functions in SoftEther VPN Server. This is aimed at the common “server is behind NAT / doesn’t have a static IP” situation. The SoftEther Project also runs a dynamic DNS service (softether.net) that it states has been provided since March 8, 2013 by the University of Tsukuba for academic purposes.

SoftEther also documents a “VPN Azure Cloud Service” function (disabled by default) intended as an additional option when NAT traversal/DDNS methods don’t work. This is one of those features you should treat as an operational dependency decision: it may help connectivity, but it also introduces reliance on an external service path.

Security architecture has a critical nuance that’s easy to miss if you just read protocol lists. In the SoftEther VPN manual section on VPN communication protocol, the project states that the SoftEther VPN protocol itself does not implement encryption and electronic signature protection at that encapsulation header level (it describes simply adding an encapsulation header to virtual Ethernet frames). In plain language: don’t assume “HTTPS-shaped” automatically means “TLS-encrypted end-to-end in the way you think” without reading exactly how your chosen mode is configured and what cryptographic protections are in effect for your deployment.

On performance claims: SoftEther publishes its own “features” material describing strong connectivity and includes internal testing comparisons between protocol modes (SoftEther VPN, L2TP/IPsec, SSTP, and OpenVPN in L2/L3 modes). That’s useful as a directional reference, but it’s not the same thing as independent benchmarking across hardware/OS/kernel crypto accelerations and internet paths. Expect real throughput to be dominated by (1) the protocol you choose, (2) CPU and crypto, (3) MTU/fragmentation, and (4) the quality of the network path.

Pricing and Plans

SoftEther VPN is free software in the sense that the source code is available and the project is open-source. The GitHub repository identifies the project as licensed under the Apache License, Version 2.0. The project also documents a license switch from GPLv2 to Apache License 2.0.

There is no official “monthly/annual” subscription plan structure on the core SoftEther VPN Project distribution in the way you’d see with a commercial consumer VPN service. In practice, your costs are operational: hosting/VPS fees (if you deploy off-site), hardware, and admin time.

Refund windows don’t apply to the software itself (there’s nothing to refund from the SoftEther project when you download/build it). If you pay for hosting or buy a managed VPN built on SoftEther from a third party, refunds are entirely dependent on that vendor—not SoftEther.

Privacy and Security Assessment

SoftEther is open-source, with current development hosted on GitHub and licensed under Apache 2.0. That’s a meaningful plus for transparency: the code can be inspected, forked, and patched.

But “privacy” here is not the same question as with a consumer VPN provider. SoftEther is a VPN platform you operate. Your privacy outcome depends on where you run the server, what you log, and what protocol/auth settings you choose.

On logging: SoftEther explicitly includes extensive logging capabilities. The project’s security/reliability documentation states that packets flowing via the Virtual Hub can be logged to disk and that administrators can keep HTTP access logs of employees using the VPN server for auditing. The Server Manual’s logging section describes that the VPN Server writes operational status logs and can log packets flowing over Virtual Hubs to help trace problems and discover unauthorized access or policy breaches. Translation: SoftEther can be privacy-friendly if you configure it that way, but it can also become an extremely detailed network surveillance box if you turn on packet logging.

On security track record: SoftEther has published security advisories. In June 2023, the project posted an advisory (SE202301) stating that it fixed six vulnerabilities (including CVE-2023-27395 and others) in cooperation with Cisco Systems. That’s the normal reality of widely deployed network daemons: vulnerabilities happen; what matters is disclosure, patching, and whether you keep up.

Jurisdiction is also different than with a VPN provider. SoftEther VPN Project is associated with the University of Tsukuba in Japan (for example, the softether.net Dynamic DNS service page states it’s provided by the SoftEther Project, University of Tsukuba, Japan). If you use project-operated auxiliary services (like DDNS), that may matter operationally and legally. If you self-host everything and disable external helper services, jurisdiction is primarily “where your server is located” and “who controls it.”

Finally, independent “no-logs audits” aren’t a native concept for a self-hosted VPN server in the way they are for commercial VPN providers. Some commercial services that use SoftEther may undergo audits, but that audit is about the service’s deployment and policy, not SoftEther as a standalone tool (and you should not treat it as transferable assurance to your own configuration).

Strengths and Limitations

Strengths

• Multi-protocol support from one server (SoftEther protocol plus common options like OpenVPN, SSTP, L2TP/IPsec, L2TPv3/IPsec, EtherIP/IPsec).
• Designed for hostile networks: SoftEther’s protocol is built around “Ethernet over HTTPS,” aiming for connectivity where typical VPNs get blocked.
• NAT traversal + Dynamic DNS features are built into the server to reduce the pain of “no static IP / behind NAT” deployments.
• Open-source licensing (Apache 2.0) supports auditability and long-term maintainability.

Limitations / trade-offs

• Not a consumer VPN service: you must run and secure the server yourself; there’s no built-in “privacy policy” protecting you from your own admin decisions.
• Logging can be very detailed (including packet logging via Virtual Hub) if enabled—bad for privacy if misconfigured.
• Protocol/security nuance requires homework: the manual notes the SoftEther VPN protocol encapsulation itself does not implement encryption/signature at that layer, so you need to understand what protections your chosen setup actually provides.
• You must patch: the project has issued security advisories and vulnerability fixes; running old versions is asking for trouble.

Who Should Use SoftEther?

Good fit

1. Self-hosters who need one VPN server for many device types. If you need to support a mix of Windows/macOS/Linux and embedded clients, SoftEther’s multi-protocol server design can reduce client-side friction.

2. Admins dealing with NAT/no-static-IP constraints. If your deployment reality includes residential internet, CGNAT, or frequently changing IPs, SoftEther’s built-in Dynamic DNS and NAT Traversal features are directly aimed at that problem.

3. Teams operating in restrictive networks. If outbound filtering is aggressive and HTTPS egress is the only stable option, SoftEther’s HTTPS-oriented protocol design is the whole point.

Not a good fit

1. Anyone who just wants anonymous browsing via a commercial VPN exit network. SoftEther doesn’t come with a paid server fleet, shared exits, or a consumer app experience.

2. People who can’t (or won’t) maintain a security patch cycle. VPN servers are high-value targets; if you won’t update after advisories and CVEs, don’t run one.

3. Privacy-sensitive users who can’t control logging and admin access. SoftEther can log extensively; if you don’t fully control the server and configuration, you can’t assume privacy.