Incoming traffic generation bug, when VPN interface is turned on.

[DROZD01]

I have 2 PCs (one runs Windows 10, the other - Windows Server 2025) connected to the same remote Softether VPN server. While Windows 10 one works perfectly, Server 2025 one (using the same exact setup for the VPN connection) starts generating about 50Mbit/s of incoming traffic as soon as i turn the VPN connection on. Server 2025 system also has DHCP and DNS features turned on.

What could be causing it? If any additional info needed for troubleshooting - please let me know.

According to wireshark, generated traffic is from the VPN server to some of my ISPs IP addresses.
*From "Conversations"

Code: Select all

- Address A: <VPN_IP>
 - Address B: <ISP_IP>
 - Packets: 60296
 - Bytes: 84686426
 - Stream ID: 398
 - Packets A → B: 60296
 - Bytes A → B: 84686426
 - Packets B → A: 0
 - Bytes B → A: 0
 - Rel Start: 8.661389
 - Duration: 17.233788
 - Bits/s A → B: 39311810
 - Bits/s B → A: 0

https://forum.vpngate.net/download/file ... ew&id=3448

[solo]

Are both clients connected with SoftEther VPN protocol to the same ISP from the same LAN?

[DROZD01]

Are both clients connected with SoftEther VPN protocol to the same ISP from the same LAN?

Yes. They are connected to the same Keenetic router. I also have a phone connected to that same VPN server through SSTP. Works fine both being connected to the same LAN (through WiFi) and on cellular.

If it makes a difference - Windows 10 system is on intel, Server 2025 system is on amd epyc.

[solo]

viewtopic.php?f=7&t=69130&p=101861#p101861
If not, review earlier diagnostics in the thread.

[DROZD01]

Oh, and btw - both the PC, Server, and VPN server run the latest "Developer Edition".

P.S. I think i should clarify: this issue generates only incoming traffic, nothing on outgoing. It only occurs after i successfully connected to my VPN server and got the IP through DHCP. VPN server and the Server can ping each other but with a heavy packet loss.

Will try the stuff from that other post, thanks.

[DROZD01]

viewtopic.php?f=7&t=69130&p=101861#p101861
If not, review earlier diagnostics in the thread.

No such option exists in the menu mentioned in the post:
I'll try reinstalling it.
P.S. - no such option existed during reinstallation. Gonna try the stable version.
P.P.S. No such option in regular version either.

Capture_client.PNG

Capture_version.PNG

[DROZD01]

Just tested turning off VPN connection on the PC, while the server one is on - no weird downlink traffic!
As soon as i turn the PC's back on - it jumps back to that 30-50Mbit/s range.
What could be causing that? MAC addresses of the VPN adapters are different. Both use separate user accounts and fixed (through "ethers") IP addresses.

P.S. Nevermind, the issue is back again.

[DROZD01]

I also tried to connect a windows 10 laptop in the same physical LAN (through WiFi) to the softether server - i get the exact same traffic generation on it too.

[solo]

Gonna try the stable version.

It's there for sure.
.

444.png

.

While Windows 10 one works perfectly, Server 2025 one (using the same exact setup for the VPN connection) starts generating about 50Mbit/s of incoming traffic as soon as i turn the VPN connection on.

I also tried to connect a windows 10 laptop in the same physical LAN (through WiFi) to the softether server - i get the exact same traffic generation on it too.

As your observations are now completely revised, here is the explanation - there is no bug, we see plenty of duplicate ACKs and frame retransmissions because your ISP's DPI is interfering with the VPN. It happens in some [restricted] countries...

[DROZD01]

Maybe it's not in the releases from the SoftEther website/github?
Ok, if it's not strictly a "bug", then how one would deal with it? I found a guide here which uses "site-to-site" bridges. Could this fix it?

[solo]

If your SE server's IP is known or is from a known VPS, your overlords will easily block it. Your tunnel viewtopic.php?f=7&t=67838#p97123 must be established like a Tor bridge https://support.torproject.org/censorship/censorship-7/ to ensure reliable operation.

[DROZD01]

If your SE server's IP is known or is from a known VPS, your overlords will easily block it. Your tunnel viewtopic.php?f=7&t=67838#p97123 must be established like a Tor bridge https://support.torproject.org/censorship/censorship-7/ to ensure reliable operation.

I'm not quite sure how that would help me exactly. I have no issues reaching to the SE server itself, if there's only one device on my local LAN trying to (sometimes, traffic gen bug reoccurs though). I had no issues connecting to the same SE server through the cellular. So if it's a protocol issue - linking 2 SE servers won't really help me, i think.

[DROZD01]

Ok, so while i was not successful in establishing multi-hop vpn as you suggested, i trued using OpenVPN as a client for the same SE server. OVPN connection does not cause the traffic gen. Connection to an in-country SE server with an SE client doesn't cause it either with a single client (only in some weird cases during setup, it generated 80Mbits/s of it).

[solo]

The systems of blocking country recognize the OpenVPN protocol and interrupt the connection on the ISP equipment or on the country's Internet lines.

viewtopic.php?f=7&t=69366 - the same overlords, different disruptions. If or when it comes to your ISP, consider OpenVPN obfuscation viewtopic.php?f=7&t=69655

[DROZD01]

Found one curious difference between normal and traffic-generating session:
Normal session reports client's IP as an ISP IP, bugged sessions report local LAN's IP (the one that DHCP on a client's router gave it)

Bugged:

Снимок экрана 2025-05-14 003118.png

Normal:

Снимок экрана 2025-05-14 003248.png

I highly doubt that this was caused by some specific "overlord restriction", especially since OpenVPN was claimed to be blocked for more than a year, and yet it's the one that works without any problems and/or additional configurations, just with auto-generated .ovpn config.

[DROZD01]

Moreover, i'm particularly concerned that the OpenVPN part of SoftEther server works rather separately from the whole thing:
It not only gives the client a random MAC address (not matching the TAP interface on client's PC, which OpenVPN client created), but also sends that client connection parameters which are different from the SE connection:

In partcular, OpenVPN connection has no listed default gateway, and the DHCP server is 192.168.30.0, instead of 192.168.30.1, as stated in dnsmasq.conf (and it's definitely dnsmasq giving that .30.115 address, since it in the dnsmasq.leases with the MAC apparently given by the SE emulated OpenVPN server)

SE connection:

se.png

OpenVPN connection

ovpn.png

[solo]

...gives the client a random MAC address (not matching the TAP interface on client's PC, which OpenVPN client created),

Then make it not-random viewtopic.php?f=7&t=68900&p=101140#p101140

"OpenVPN connection has no listed default gateway, and the DHCP server is 192.168.30.0"

But that's how L3 protocols actually work.

[DROZD01]

But that's how L3 protocols actually work.

Interesting... Ok, so it's not a weird behaviour.

I also tested what's gonna happen if i just use SE SecureNAT instead of dnsmasq - it did work! With SE server to SE client - no traffic gen. Now I'm fairly certain all of this was caused by dnsmasq misconfiguration. Though, it's still weird that OpenVPN clients didn't have the same issues.