SoftEther VPN User Forum

Hi,

I want to use SoftEther to connect my customers' computers. It implies that there must be no connection between customers but my supporting teams (admin users) can connect to the customers. Is SoftEther able to do this?

Can you provide a network diagram of the desired solution or rephrase the question more explicitly?

I am not familiar with the network so I hope my diagram explains correctly. The 192.168.1.1 to 3 are the customers and 192.168.1.4 & 5 are the “Administrator Users”.

[attachment=0]10-3-1.png[/attachment]

You can get the desired result by using ACLs to restrict traffic, or you can create a separate Virtual Hub for each business group. Instructions are in the SoftEther documentation.

I think you can use 'Privacy Filter Mode' in security policy.
https://www.softether.org/4-docs/1-manu ... y_Policies

I have created separate hub for each business group. Since the Administrator Users are needed to connect all other users, I created a layer 3 switch. Below are the setting screen captures.

Please let me know what's wrong on the settings because the two computers on huba and hubc cannot ping to each others. Thank you.

It appears to me that you're assigning same IP's for both the L3 Switches and SecureNAT interfaces.
Try to uncheck/disable the SecureNAT feature on both hub and just leave the DHCP servers checked.


malei wrote:
> I have created separate hub for each business group. Since the
> Administrator Users are needed to connect all other users, I created a
> layer 3 switch. Below are the setting screen captures.
>
> Please let me know what's wrong on the settings because the two computers
> on huba and hubc cannot ping to each others. Thank you.

I am newbie on both network and SoftEther :(

The only DHCP servers I know is in the SecureNAT. I am not sure how to disable the SecureNAT and leave the DHCP servers checked?

By following this post http://www.vpnusers.com/viewtopic.php?f=7&t=3079 I can ping the subnet interface 10.168.32.1 by using this cmd

route add 10.168.32.0 mask 255.255.255.0 10.168.30.1 metric 2

But I cannot ping any other computers in 10.168.32.0/24. How to fix it?

Uncheck the box "Use Virtual NAT function" and leave the DHCP settings and feature checked, referring to your screenshots.


malei wrote:
> I am newbie on both network and SoftEther :(
>
> The only DHCP servers I know is in the SecureNAT. I am not sure how to
> disable the SecureNAT and leave the DHCP servers checked?
>
> By following this post
> http://www.vpnusers.com/viewtopic.php?f=7&t=3079 I can ping the subnet
> interface 10.168.32.1 by using this cmd
>
> route add 10.168.32.0 mask 255.255.255.0 10.168.30.1 metric 2
>
> But I cannot ping any other computers in 10.168.32.0/24. How to fix it?

I have unchecked the box "Use Virtual NAT function" but it makes no difference on the result.

malei wrote:
> I have unchecked the box "Use Virtual NAT function" but it makes
> no difference on the result.

It could be that the other machines on 10.168.32.0/24 have their firewall turned on and does not respond to pings. Can you print out your routing table also? Do this at the machine where you added the static route. Also traceroute to the machines on 10.168.32.0


> By following this post
> viewtopic.php?f=7&t=3079 I can ping the subnet
> interface 10.168.32.1 by using this cmd
>
> route add 10.168.32.0 mask 255.255.255.0 10.168.30.1 metric 2
>
> But I cannot ping any other computers in 10.168.32.0/24. How to fix it?

I made another hub 10.97.0.0/16 and connect the two computers using layer 2. Both computers can ping to each other via this.

I manually added the routes into the two computers
route add 10.168.32.0 mask 255.255.255.0 10.168.30.1
route add 10.168.30.0 mask 255.255.255.0 10.168.32.1

10.168.30.10 print out:

===========================================================================
Interface List
29...00 ac e9 71 bd da ......VPN Client Adapter - VPN119
28...00 ac af 10 d0 fd ......VPN Client Adapter - VPN2
27...00 ac 7c a9 cb ed ......VPN Client Adapter - VPN127
15...00 ff f6 94 27 ed ......TAP-Windows Adapter V9 #2
10...00 ff 26 4c bf 37 ......TAP-Windows Adapter V9
7...ac 7b a1 09 f3 9f ......Microsoft Wi-Fi Direct
6...ac 7b a1 09 f3 a2 ......Bluetooth
4...ac 7b a1 09 f3 9e ......Intel(R) Wireless-N 7260
3...b8 2a 72 fb ae 68 ......Realtek PCIe GBE Family Controller
1...........................Software Loopback Interface 1
8...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
9...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
26...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #6
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.50.50 192.168.50.51 25
10.8.0.0 255.255.240.0 On-link 10.8.0.3 276
10.8.0.3 255.255.255.255 On-link 10.8.0.3 276
10.8.15.255 255.255.255.255 On-link 10.8.0.3 276
10.97.0.0 255.255.0.0 On-link 10.97.1.10 257
10.97.1.10 255.255.255.255 On-link 10.97.1.10 257
10.97.255.255 255.255.255.255 On-link 10.97.1.10 257
10.168.30.0 255.255.255.0 On-link 10.168.30.10 257
10.168.30.10 255.255.255.255 On-link 10.168.30.10 257
10.168.30.255 255.255.255.255 On-link 10.168.30.10 257
10.168.32.0 255.255.255.0 10.168.30.1 10.168.30.10 2
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
130.158.6.114 255.255.255.255 192.168.50.50 192.168.50.51 25
192.168.50.0 255.255.255.0 On-link 192.168.50.51 281
192.168.50.51 255.255.255.255 On-link 192.168.50.51 281
192.168.50.255 255.255.255.255 On-link 192.168.50.51 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.168.30.10 257
224.0.0.0 240.0.0.0 On-link 10.97.1.10 257
224.0.0.0 240.0.0.0 On-link 192.168.50.51 281
224.0.0.0 240.0.0.0 On-link 10.8.0.3 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.168.30.10 257
255.255.255.255 255.255.255.255 On-link 10.97.1.10 257
255.255.255.255 255.255.255.255 On-link 192.168.50.51 281
255.255.255.255 255.255.255.255 On-link 10.8.0.3 276
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.50.50 1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
4 281 fe80::/64 On-link
10 276 fe80::/64 On-link
10 276 fe80::4c69:f0b6:bd4a:668d/128
On-link
4 281 fe80::8973:6b9e:8c5a:531e/128
On-link
1 306 ff00::/8 On-link
4 281 ff00::/8 On-link
10 276 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

C:\30.10>tracert 10.168.32.1

Tracing route to 10.168.32.1 over a maximum of 30 hops

1 2 ms 1 ms 1 ms 10.168.30.1
2 3 ms 2 ms 2 ms 10.168.32.1

Trace complete.

C:\30.10>tracert 10.168.32.10

Tracing route to 10.168.32.10 over a maximum of 30 hops

1 1 ms 1 ms 1 ms 10.168.30.1
2 * * * Request timed out.
3 * 14 ms 22 ms 221.126.199.1
4 8 ms 8 ms 8 ms 10.30.0.113
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 ^C
C:\30.10>

10.168.32.10 print out:

===========================================================================
Interface List
36...00 ac 37 33 be fd ......VPN Client Adapter - test
20...00 ac 19 50 32 df ......VPN Client Adapter - LSVPN
18...00 ff 38 43 13 76 ......TAP-Win32 Adapter V9
13...9c d2 1e c0 19 17 ......Dell Wireless 1705 802.11b/g/n (2.4GHZ)
11...f8 bc 12 6b 1e 17 ......Realtek PCIe GBE Family Controller
1...........................Software Loopback Interface 1
21...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
22...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
35...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
39...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.40 276
5.5.0.0 255.255.240.0 10.8.0.1 10.8.2.38 101
10.8.0.0 255.255.240.0 On-link 10.8.2.38 286
10.8.2.38 255.255.255.255 On-link 10.8.2.38 286
10.8.15.255 255.255.255.255 On-link 10.8.2.38 286
10.97.0.0 255.255.0.0 On-link 10.97.2.38 257
10.97.2.38 255.255.255.255 On-link 10.97.2.38 257
10.97.255.255 255.255.255.255 On-link 10.97.2.38 257
10.168.30.0 255.255.255.0 10.168.32.1 10.168.32.10 2
10.168.32.0 255.255.255.0 On-link 10.168.32.10 257
10.168.32.10 255.255.255.255 On-link 10.168.32.10 257
10.168.32.255 255.255.255.255 On-link 10.168.32.10 257
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
130.158.6.110 255.255.255.255 192.168.0.1 192.168.0.40 276
192.168.0.0 255.255.255.0 On-link 192.168.0.40 276
192.168.0.1 255.255.255.255 On-link 192.168.0.40 276
192.168.0.40 255.255.255.255 On-link 192.168.0.40 276
192.168.0.255 255.255.255.255 On-link 192.168.0.40 276
221.126.199.3 255.255.255.255 192.168.0.1 192.168.0.40 20
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.0.40 276
224.0.0.0 240.0.0.0 On-link 10.8.2.38 286
224.0.0.0 240.0.0.0 On-link 10.97.2.38 257
224.0.0.0 240.0.0.0 On-link 10.168.32.10 257
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.0.40 276
255.255.255.255 255.255.255.255 On-link 10.8.2.38 286
255.255.255.255 255.255.255.255 On-link 10.97.2.38 257
255.255.255.255 255.255.255.255 On-link 10.168.32.10 257
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.0.1 Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
1 306 ff00::/8 On-link
===========================================================================
Persistent Routes:
None



C:\32.10>tracert 10.168.30.1

Tracing route to 10.168.30.1 over a maximum of 30 hops

1 158 ms 159 ms 155 ms 10.168.32.1
2 * * * Request timed out.
3 24 ms * * 221.126.199.1
4 10 ms 12 ms 11 ms 10.168.30.1

Trace complete.

C:\32.10>tracert 10.168.30.10

Tracing route to 10.168.30.10 over a maximum of 30 hops

1 9 ms 11 ms 11 ms 10.168.32.1
2 11 ms 10 ms 11 ms 192.168.50.50
3 * * * Request timed out.
4 19 ms 19 ms 18 ms 10.30.0.113
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * ^C
C:\32.10>

Your configuration looks correct.
However, result of traceroute is strange.

Please show ipconfig result.

I am not sure my installation procedure is correct or not so I write a brife in here:
- Select "Enable spoofing of MAC addresses" in the guest OS, which is CentOS 6.6. The host is Server 2008r2.
- Follow this to install the SoftEther http://exalute.blogspot.com/2013/11/how ... erver.html
- I forgot which one I have selected: the "Remote Access VPN Server" or "Other Advanced Configuration of VPN" on the "SoftEther VPN Server / Bridge Easy Setup".
- Create a Virtual huba, Enable SecureNAT, set huba IP Address to 10.168.30.1, uncheck "Use Virtual DHCP Server Functions"
- Create a Virtual hubc, Enable SecureNAT, set hubc IP Address to 10.168.32.1, uncheck "Use Virtual DHCP Server Functions"
- Create users
- Create a Virtual Layer 3 Switch. Add huba/10.168.30.1 and hubc/10.168.32.1.
- route add 10.168.32.0 mask 255.255.255.0 10.168.30.1 on computer 10.168.30.10
- route add 10.168.30.0 mask 255.255.255.0 10.168.32.1 on computer 10.168.32.10
that's all

I have done a lot of trial and error. Unfortunately the current setting cannot ping the other hub ip now. I don't know why.

Except the ipconfig, I redo the route print and tracert. Hope it helps.

---------------------

computer 10.168.30.10


Windows IP Configuration


Ethernet adapter VPN119 - VPN Client:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Ethernet adapter VPN2 - VPN Client:

Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 10.168.30.10
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :

Ethernet adapter VPN127 - VPN Client:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Ethernet adapter Wired Ethernet Connection 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Ethernet adapter Wired Ethernet Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Local Area Connection* 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Ethernet adapter Bluetooth:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wi-Fi:

Connection-specific DNS Suffix . : lan
Link-local IPv6 Address . . . . . : fe80::8973:6b9e:8c5a:531e%4
IPv4 Address. . . . . . . . . . . : 192.168.50.51
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.50.50

Ethernet adapter Wired Ethernet Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.lan:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : lan

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{6F7097D7-EB66-4598-9B13-69042A9C8F87}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

===========================================================================
Interface List
28...00 ac e9 71 bd da ......VPN Client Adapter - VPN119
27...00 ac af 10 d0 fd ......VPN Client Adapter - VPN2
26...00 ac 7c a9 cb ed ......VPN Client Adapter - VPN127
15...00 ff f6 94 27 ed ......TAP-Windows Adapter V9 #2
10...00 ff 26 4c bf 37 ......TAP-Windows Adapter V9
7...ac 7b a1 09 f3 9f ......Microsoft Wi-Fi Direct
6...ac 7b a1 09 f3 a2 ......Bluetooth
4...ac 7b a1 09 f3 9e ......Intel(R) Wireless-N 7260
3...b8 2a 72 fb ae 68 ......Realtek PCIe GBE Family Controller
1...........................Software Loopback Interface 1
8...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
9...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.50.50 192.168.50.51 25
10.168.30.0 255.255.255.0 On-link 10.168.30.10 257
10.168.30.10 255.255.255.255 On-link 10.168.30.10 257
10.168.30.255 255.255.255.255 On-link 10.168.30.10 257
10.168.32.0 255.255.255.0 10.168.30.1 10.168.30.10 2
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
130.158.6.111 255.255.255.255 192.168.50.50 192.168.50.51 25
192.168.50.0 255.255.255.0 On-link 192.168.50.51 281
192.168.50.51 255.255.255.255 On-link 192.168.50.51 281
192.168.50.255 255.255.255.255 On-link 192.168.50.51 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.168.30.10 257
224.0.0.0 240.0.0.0 On-link 192.168.50.51 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.168.30.10 257
255.255.255.255 255.255.255.255 On-link 192.168.50.51 281
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.50.50 1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
4 281 fe80::/64 On-link
4 281 fe80::8973:6b9e:8c5a:531e/128
On-link
1 306 ff00::/8 On-link
4 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None



C:\30.10>tracert 10.168.30.1

Tracing route to 10.168.30.1 over a maximum of 30 hops

1 2 ms 2 ms 3 ms 10.168.30.1

Trace complete.

C:\30.10>tracert 10.168.32.1

Tracing route to 10.168.32.1 over a maximum of 30 hops

1 5 ms 7 ms 3 ms 10.168.30.1
2 3 ms 70 ms 138 ms OpenWrt.lan [192.168.50.50]
3 327 ms 277 ms 58 ms 221.126.199.1
4 295 ms 27 ms 24 ms 10.30.0.113
5 * * * Request timed out.
6 ^C
C:\30.10>

computer 10.168.32.10


Windows IP Configuration


Ethernet adapter VPN2 - VPN Client:

Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 10.168.32.10
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 10.8.2.38
Subnet Mask . . . . . . . . . . . : 255.255.240.0
Default Gateway . . . . . . . . . :

Wireless LAN adapter:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 192.168.0.40
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1

Tunnel adapter isatap.{38431376-2195-4B2F-A957-FD0BE2AC74AB}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter Local Area Connection* 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{5DA1DF8F-4139-424F-B226-09FEE41E9E74}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{B8BB4274-6759-43FD-AC59-4404E2FC197A}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{71A13D1F-D9DF-41E5-B121-E9DE142EF7F0}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

===========================================================================
Interface List
22...00 ac 46 e1 fa c6 ......VPN Client Adapter - VPN2
18...00 ff 38 43 13 76 ......TAP-Win32 Adapter V9
13...9c d2 1e c0 19 17 ......Dell Wireless 1705 802.11b/g/n (2.4GHZ)
11...f8 bc 12 6b 1e 17 ......Realtek PCIe GBE Family Controller
1...........................Software Loopback Interface 1
23...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
21...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.40 276
5.5.0.0 255.255.240.0 10.8.0.1 10.8.2.38 101
10.8.0.0 255.255.240.0 On-link 10.8.2.38 286
10.8.2.38 255.255.255.255 On-link 10.8.2.38 286
10.8.15.255 255.255.255.255 On-link 10.8.2.38 286
10.168.30.0 255.255.255.0 10.168.32.1 10.168.32.10 2
10.168.32.0 255.255.255.0 On-link 10.168.32.10 257
10.168.32.10 255.255.255.255 On-link 10.168.32.10 257
10.168.32.255 255.255.255.255 On-link 10.168.32.10 257
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.0.0 255.255.255.0 On-link 192.168.0.40 276
192.168.0.40 255.255.255.255 On-link 192.168.0.40 276
192.168.0.255 255.255.255.255 On-link 192.168.0.40 276
221.126.199.3 255.255.255.255 192.168.0.1 192.168.0.40 20
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.0.40 276
224.0.0.0 240.0.0.0 On-link 10.8.2.38 286
224.0.0.0 240.0.0.0 On-link 10.168.32.10 257
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.0.40 276
255.255.255.255 255.255.255.255 On-link 10.8.2.38 286
255.255.255.255 255.255.255.255 On-link 10.168.32.10 257
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.0.1 Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
1 306 ff00::/8 On-link
===========================================================================
Persistent Routes:
None


C:\32.10>tracert 10.168.32.1

Tracing route to 10.168.32.1 over a maximum of 30 hops

1 12 ms 11 ms 11 ms 10.168.32.1

Trace complete.

C:\32.10>tracert 10.168.30.1

Tracing route to 10.168.30.1 over a maximum of 30 hops

1 11 ms 11 ms 11 ms 10.168.32.1
2 19 ms 190 ms 268 ms 192.168.50.50
3 103 ms 228 ms 259 ms 221.126.199.1
4 39 ms 28 ms 23 ms 10.30.0.113
5 * * * Request timed out.
6 * * * Request timed out.
7 ^C
C:\32.10>


---------------------------------------

Finally, the connection window looks strange. It shows 169.254 after machine reboot. However the subsequence login will show the correct 10.168 IP address.

SecureNAT interface and virtual L3 switch interface use same IP addresses.

I change the layer 3 switch huba IP address to 10.168.30.254 and hubc to 10.168.32.254

Delete the old route and change the route add accordingly:
- route add 10.168.32.0 mask 255.255.255.0 10.168.30.254 on computer 10.168.30.10
- route add 10.168.30.0 mask 255.255.255.0 10.168.32.254 on computer 10.168.32.10

(please correct me if I am wrong)

It still cannot access the other machine.

----------------------------------------

C:\>tracert 10.168.32.1

Tracing route to 10.168.32.1 over a maximum of 30 hops

1 2 ms 2 ms 2 ms 10.168.30.254
2 2 ms 2 ms 3 ms 10.168.32.1

Trace complete.

C:\>tracert 10.168.32.10

Tracing route to 10.168.32.10 over a maximum of 30 hops

1 2 ms 1 ms 1 ms 10.168.30.254
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 ^C
C:\>

-----------------------------------------

C:\>tracert 10.168.30.1

Tracing route to 10.168.30.1 over a maximum of 30 hops

1 1 ms 1 ms 1 ms 10.168.32.254
2 2 ms 1 ms 1 ms 10.168.30.1

Trace complete.

C:\>tracert 10.168.30.10

Tracing route to 10.168.30.10 over a maximum of 30 hops

1 2 ms 1 ms 1 ms 10.168.32.254
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * ^C
C:\>

> C:\>tracert 10.168.32.1
> Tracing route to 10.168.32.1 over a maximum of 30 hops
> 1 2 ms 2 ms 2 ms 10.168.30.254
> 2 2 ms 2 ms 3 ms 10.168.32.1

I think this is strange result.
10.168.32.1 is SecureNAT interface.
However, SecureNAT can't answer ping from other segment because SecureNAT doesn't know gateway.

Please show the IP address table of the virtual hub.

I am afraid I have already shown the IP address table on the above post (Jun 07)? If this is not the related information please let me know the steps of getting the IP address table (Sorry about that I am still a newbie on this.)

Finally it works :)

Not sure which is the root cause but these are the changes:

- bought a new computer and use CentOS 6.6 as host (orginal was Server 2008r2)

- using the latest version softether-vpnserver-v4.18-9570-rtm-2015.07.26-linux-x64-64bit.tar.gz and softether-vpnclient-v4.18-9570-rtm-2015.07.26-windows-x86_x64-intel.exe

- follow to the official installation guide https://www.softether.org/4-docs/1-manu ... igurations but not http://exalute.blogspot.com/2013/11/how ... erver.html the only difference is "Complete the installation of the program with the firewall and SELinux functions disabled"

May I run the

route add 10.168.32.0 mask 255.255.255.0 10.168.30.254

equivalent command / setting on the server side?

I think I can achieve this by putting

10.168.32.0/255.255.255.0/10.168.30.254

in the "Edit the static routing table to push". However, it does not work. I did not see the new route in route print. I have already tried:
- run the SoftEther VPN Client Manager using administrator privileges
- check the Static Routing Table Pushing Function: yes

What else am I missed? Or the "Edit the static routing table to push" is not for this purpose?

It works properly in my case.

For L2TP/IPsec,

I found the reason: I assigned the static IP on VPN Client Adapter.

Since I know SoftEther, the first Google search is that how to assign the static IP from SoftEther. If I am correct there is no way to do it?

https://technet.microsoft.com/en-us/lib ... s.10).aspx

This page says that you can add persistent routes.