SoftEther VPN: Tsukuba's Multi-Protocol Server, Its HTTPS Tunnel and VPN Gate

SoftEther ("Software Ethernet") is free, open-source VPN software from the University of Tsukuba in Japan. One SoftEther server speaks its own SSL-VPN protocol over HTTPS plus several standard VPN protocols at once, so almost any device can connect. The native protocol disguises the tunnel as ordinary web traffic, which is how it passes port filters and restrictive firewalls. The same university also runs VPN Gate, a network of relays maintained by volunteers, free to use and weak on privacy.

What SoftEther is and where it came from

The name stands for Software Ethernet: the package emulates Ethernet switches and network adapters in code, so a session carries whole Ethernet frames at layer 2, not just IP packets. The project began as Daiyuu Nobori's master's thesis research at Tsukuba and is maintained by the SoftEther VPN Project there. It was released under GPLv2 on January 4, 2014, and relicensed to Apache License 2.0 on January 21, 2019. There is no paid tier; the official SoftEther VPN Project site hosts the downloads and manual.

How the native protocol moves traffic

The Virtual Hub is a software Ethernet switch, and one SoftEther server can host several isolated Virtual Hubs, each with its own admins, users and packet filters. Clients connect through a virtual adapter on Windows, Linux or macOS, and the tunnel carries Ethernet frames inside an HTTPS session to TCP port 443 by default. To squeeze more out of slow or high-latency links, the client can open 1 to 32 parallel TCP connections in one session. NAT traversal is on by default, so a server behind a home router accepts connections without port forwarding. VPN over ICMP and VPN over DNS are fallback modes: painfully slow, but they connect where only ping or DNS packets pass.

One server, many protocols

VPN Bridge, cascade connections and local bridges cover site-to-site setups on top of these protocols.

Why firewalls let it through, and where the disguise fails

To a port-based firewall or proxy, a SoftEther session looks like a visit to an HTTPS website on port 443, a port almost no network can close without breaking the web. Against serious DPI it is a different story: systems that fingerprint TLS handshakes, track long high-volume TCP sessions or actively probe servers can still flag the tunnel, because HTTPS camouflage is not a dedicated obfuscation layer. Tunnelling over TCP also slows down on lossy links, where the parallel connections partly compensate. In heavily censored countries you want a stealth protocol in the mix.

VPN Gate: what it is and whether free relays are safe

VPN Gate is a separate academic experiment at Tsukuba, launched March 8, 2013, built as a plug-in on SoftEther VPN Server with the relay function off by default. Volunteers enable it, and their machines, often ordinary home connections, show up on a list that is public and needs no account, accepting the SoftEther SSL-VPN protocol, L2TP/IPsec, OpenVPN and MS-SSTP. According to the VPNRadarLab card, 3137 volunteer relay servers are listed.

What VPN Gate logs and who reads it

Connection logs are kept centrally for at least 3 months and tie your source IP to each session; every volunteer keeps packet header logs for at least 2 weeks. Connection logs are disclosed to police, prosecutors and courts on request. Separately, the VPNRadarLab card gives VPN Gate a red flag for storing the connection IP.

Other risks of public relays

The volunteer running a relay is your exit point and can see unencrypted traffic and the destinations you visit. There is no kill switch, no claimed DNS leak protection, no obfuscation, and a relay disappears when its owner switches off the machine. Outbound mail on TCP port 25 is blocked, and censors read the same list and blacklist the addresses they find.

SoftEther with a VPN service

Of the 377 services in the VPNRadarLab main ranking, 11 state SoftEther support and 1 more supports it partly, with the list, scores and prices on the SoftEther ranking page.

FAQ

Is SoftEther free?

Yes. The server and client are open source; a provider charges for its own infrastructure.

Is SoftEther the same as VPN Gate?

No. SoftEther is the software; VPN Gate is a volunteer network built on it and disabled by default in the server.

Can my phone connect to a SoftEther server?

Yes, through the built-in L2TP/IPsec client or an OpenVPN app; the dedicated client is only for computers.

Does SoftEther work under heavy censorship?

It passes port filters and simple inspection, not determined DPI, so plan for a stealth protocol there.

SoftEther summary

SoftEther is open-source VPN software from the University of Tsukuba that runs several protocols, including its own Ethernet-over-HTTPS tunnel, from a single server installation. It beats port filters and basic inspection, not determined DPI. VPN Gate puts the software on volunteer machines for free, at the cost of long logs and exit points you cannot vet.