2

I have SoftEther VPN running on a Linux server with SSTP, L2TP over IPSec, VPN over DNS, and VPN over ICMP enabled, along with management via TCP port 5555.

I have disabled everything else I could find, specifically including SecureNAT and the server-assisted Dynamic DNS and KeepAlive functionalities.

However, when I run sudo netstat -eptuwWl, I see it listening to the following ports:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode       PID/Program name
tcp        0      0 *:5555                  *:*                     LISTEN      root       17326       6619/vpnserver
udp        0      0 *:domain                *:*                                 root       5273060     6619/vpnserver
udp        0      0 *:56432                 *:*                                 root       17850       6619/vpnserver
udp        0      0 *:42726                 *:*                                 root       17319       6619/vpnserver
udp        0      0 MY_ADDRESS:ipsec-nat-t  *:*                                 root       4493472     6619/vpnserver
udp        0      0 localhost:ipsec-nat-t   *:*                                 root       17376       6619/vpnserver
udp        0      0 MY_ADDRESS:isakmp       *:*                                 root       4493471     6619/vpnserver
udp        0      0 localhost:isakmp        *:*                                 root       17375       6619/vpnserver
udp        0      0 *:50676                 *:*                                 root       17309       6618/vpnserver
raw        0      0 *:icmp                  *:*                     7           root       5273062     6619/vpnserver
raw        0      0 MY_ADDRESS:esp          *:*                     7           root       4493473     6619/vpnserver
raw        0      0 localhost:esp           *:*                     7           root       17377       6619/vpnserver
raw        0      0 MY_ADDRESS:52           *:*                     7           root       4493474     6619/vpnserver
raw        0      0 localhost:52            *:*                     7           root       17378       6619/vpnserver

I can only account for the ICMP, ISAKMP, ESP, and IPSec-NAT-T, and 5555 listeners (that's 8 of them).
However, I can't account for the other 6 listeners. What are they for?

  • One (or maybe more) of those ports is used to list the Virtual Hubs on the SoftEther server when queried by the client. – David Refoua Jul 8 '18 at 21:43
  • @DRSDavidSoft: Oh wow, really? Is 5555 not used for that? – Mehrdad Jul 8 '18 at 22:19
1

Maybe you add more listened TCP ports during the configuration?

SoftEther should listen for 443, 992 and 5555 by default.

Take a look here and check for your config first.

0

I figured out 3 more of them myself:

  • The one DNS (domain) socket is for the VPN over DNS functionality

  • The two RAW (protocol 52 - "I-NLSP"?) sockets are for the L2TP over IPsec functionality

Disabling the options for reach of these removes the port listeners.

The bounty will go to anyone who can explain what the final 3 listening sockets are used for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.