SoftEther VPN Review 2026: Free Multi-Protocol VPN Server

Verdict: a powerful free VPN server, not a privacy service

SoftEther VPN is free, open-source server and client software that you install on your own machine. It is not a subscription VPN with a server network and a no-logs promise. If you want remote access to an office or home network, or a site-to-site link that survives strict firewalls, it is one of the most capable free options available. If you want to hide your browsing from your ISP with one click, it is the wrong tool.

• Price: free for personal and commercial use, Apache License 2.0.
• Best for: admins who want one server that speaks SoftEther SSL-VPN, OpenVPN, L2TP/IPsec and MS-SSTP at the same time.
• Strengths: firewall-friendly Ethernet over HTTPS, built-in NAT traversal, free Dynamic DNS, Layer 2 bridging, clustering.
• Weaknesses: slow Stable release cadence, a dated GUI that is Windows-only, legacy L2TP/IPsec crypto, and an unpatched pre-auth DoS in the Developer Edition as of October 27, 2026.

What SoftEther VPN is and who makes it

softether.org describes the project as "An Open-Source Free Cross-platform Multi-protocol VPN Program, as an academic project from University of Tsukuba, under the Apache License 2.0." The current code base began as Daiyuu Nobori's master's degree research at the University of Tsukuba and was released as freeware on March 8, 2013. Copyright is shared between Daiyuu Nobori, the SoftEther Project at the University of Tsukuba and SoftEther Corporation, which was founded in 2004.

The license changed from GPLv2 to Apache 2.0 with version 4.29 Build 9680 in February 2019, which makes it easier to embed in commercial products. The official site states plainly: "You can use SoftEther for any personal or commercial use for free charge." SoftEther Corporation separately sells a commercial product, PacketiX VPN, in Japan; we could not confirm its current pricing, so we do not quote it here.

The software ships as three components: VPN Server, VPN Client and VPN Bridge. Servers are managed through VPN Server Manager, a Windows GUI, or vpncmd, a cross-platform command-line utility.

Stable Edition vs Developer Edition in 2026

SoftEther is published in two lines, and choosing the right one is the most important decision you will make.

Stable Edition (4.x)

The latest Stable build is 4.44 Build 9807 RTM, dated April 16, 2025. It is the only Stable release since 4.42 and 4.43 in mid 2023, and the repository is maintained by founder Daiyuu Nobori. Version 4.44 backported OpenVPN AEAD cipher support from the Developer Edition and added a TunnelCrack protection option to the VPN Client, which is off until you enable it in settings.

Developer Edition (5.x)

The latest Developer Edition release is 5.2.5188, published July 18, 2025. Its notes include "Add X25519MLKEM768", a post-quantum hybrid key exchange, and an iOS client implementation with SoftEther protocol support. The repository is still active, with commits as recent as October 2026, but there has been no tagged release since July 2025. The project's own README calls it experimental and points non-developers to the Stable Edition.

• WireGuard: Developer Edition only.
• IKEv2: neither edition.
• TLS 1.0 to 1.3: both editions.
• Standard TLS verification with the system CA store: Developer Edition. In Stable you pin the exact certificate or CA.
• IPv6: Stable supports it inside Layer 2 tunnels only.
• AES-NI: on by default in the Developer Edition; Stable needs intel_aes_lib and is x86 only.
• Windows XP and SoftEther 1.0 compatibility: Stable only.

Protocols and client compatibility

SoftEther's main selling point is that a single server speaks many protocols at once: the SoftEther VPN protocol (Ethernet over HTTPS), OpenVPN in L3 and L2 modes, L2TP/IPsec, MS-SSTP, L2TPv3/IPsec and EtherIP/IPsec. That lets you serve devices that cannot install extra software by using the VPN clients already built into their operating systems.

• Native SoftEther VPN Client: Windows and Linux.
• L2TP/IPsec: built-in clients on Windows, Mac, iOS and Android.
• OpenVPN: Windows, Linux, Mac, iOS and Android through OpenVPN clients.
• MS-SSTP: built-in client on Windows Vista through Windows 11.

One caution: the spec page lists MD5 and SHA-1 and Diffie-Hellman groups MODP 768, 1024 and 1536 for L2TP/IPsec. Those are legacy choices. Use the SoftEther protocol or OpenVPN where you can, and keep L2TP/IPsec for devices that have no alternative.

Getting through firewalls and NAT

The SoftEther protocol tunnels Ethernet frames over HTTPS on TCP 443, so it usually passes firewalls that block IPsec or PPTP. Default listening ports are TCP 443, 992 and 5555, plus UDP 1194 for OpenVPN.

• NAT traversal is enabled by default, so a server behind a home router can often be reached without port forwarding. It can be disabled with DisableNatTraversal or a /tcp suffix.
• Dynamic DNS registers your server under the softether.net suffix, operated by SoftEther Corporation and the University of Tsukuba, free of charge.
• VPN Azure is a free cloud relay run by the University of Tsukuba as an academic experiment. It is disabled by default.
• VPN over ICMP and DNS exist for emergencies; the vendor warns they can misbehave on buggy routers and are "not for long-term stable using."

Remember that Dynamic DNS and VPN Azure route metadata or traffic through infrastructure you do not control. If that matters to you, leave them off and use your own domain and port forwarding.

Setup, management and limits

On Windows the installer and VPN Server Manager make setup approachable: create a virtual hub, add users, enable the protocols you need and turn on SecureNAT or a local bridge. On Linux you build or unpack the server and configure it with vpncmd, or manage it remotely from the Windows GUI. The Developer Edition builds with CMake against OpenSSL or LibreSSL.

• Server OS: Windows up to Server 2025 and Windows 11, Linux, FreeBSD and Solaris (server and bridge), Intel Macs only.
• Up to 4,096 concurrent sessions and 4,096 virtual hubs per server, 10,000 users, and clusters of up to 64 members.
• Memory: 32 MB plus 0.5 MB per concurrent session, per the spec page.

The management experience is where SoftEther shows its age. Many official screenshots date from 2013, the HTML5 admin console is still labelled under construction on the vendor site, and there is no first-party mobile client in the Stable Edition. Expect to read documentation rather than follow a wizard.

Security track record

SoftEther has a public history of audits and fixes, which is a good sign for an open-source project but also a reminder to keep servers patched.

• 2018: 4.25 Build 9656 fixed 11 vulnerabilities found in a source audit by the Max Planck Institute for Molecular Genetics and Guido Vranken.
• 2019: 4.29 fixed several buffer and integer overflows usable for DoS; CVE-2019-11868, a local privilege escalation in the Windows bridge driver, was fixed in 4.30.
• 2023: 4.42 Build 9798 fixed six CVEs reported by Cisco Talos. Talos rated CVE-2023-27395, a heap overflow, at CVSS 9.0.
• 2024: CVE-2024-38520, a 2.75x L2TP amplification issue, fixed in Stable 4.44 and Developer 5.02.5185.
• 2025: the vendor disputes CVE-2025-25565 to 25568 as a local console UI bug and does not consider CVE-2025-32787 a real vulnerability; 4.44 fixes the latter anyway.
• 2026: CVE-2026-39312 affects only the Developer Edition and remains without a patched release as of October 27, 2026.

Because you run the server, logging is under your control. Review the log settings on each virtual hub and set retention to match your own policy.

VPN Gate is not a private VPN

Many people meet SoftEther through VPN Gate, a free public relay network run as an academic experiment at the University of Tsukuba with servers provided by volunteers. It needs no registration, but it is not a privacy service.

VPN Gate's own abuse policy says it keeps connection logs of relay servers for three months or more, including the client's raw IP address and the destination HTTP and HTTPS hostnames, IP addresses and ports. Packet logs with TCP/IP headers stay on each relay for at least two weeks. The aggregated logs are held by SoftEther Corporation and can be disclosed to police, prosecutors, lawyers or courts. Use it to get around a block, not to stay anonymous.

Who should use SoftEther VPN

Good fit

• Small businesses and homelabs that need remote access to a LAN without paying per-user fees.
• Site-to-site links where Layer 2 bridging or HTTPS tunnelling through restrictive firewalls is required.
• Mixed fleets that must support built-in L2TP/IPsec and OpenVPN clients from one gateway.

Poor fit

• Anyone looking for a consumer no-logs VPN with servers in many countries.
• Teams that want WireGuard or IKEv2 on a production-grade, regularly released stack.
• Admins who cannot run Windows for the GUI and do not want to learn vpncmd.

If you only need OpenVPN, our OpenVPN review covers that option on its own.

Frequently asked questions

Is SoftEther VPN free?

Yes. It is free for personal and commercial use under the Apache License 2.0. PacketiX VPN, sold by SoftEther Corporation in Japan, is a separate commercial product.

Is SoftEther VPN the same as VPN Gate?

No. VPN Gate is a public volunteer relay network built on SoftEther software. It logs client IPs and destination hostnames for three months or more, while your own SoftEther server logs only what you configure.

Should I install the Stable or Developer Edition?

Stable Edition 4.44 Build 9807 for production. Developer Edition 5.2.5188 adds WireGuard and post-quantum key exchange but is labelled experimental and is affected by the unpatched CVE-2026-39312 as of October 27, 2026.

Does SoftEther support WireGuard or IKEv2?

WireGuard is available only in the Developer Edition. IKEv2 is not supported in either edition.

Can I connect from a Mac, iPhone or Android phone?

Yes, through those devices' built-in L2TP/IPsec client or an OpenVPN app. The native SoftEther VPN Client in the Stable Edition runs on Windows and Linux, and the server runs only on Intel Macs.

Does it work without port forwarding?

Often, yes. NAT traversal is on by default, Dynamic DNS gives you a free softether.net hostname, and the optional VPN Azure relay can reach servers behind strict NAT.

Is SoftEther VPN safe to run?

It is reasonably safe if you stay on the current Stable build, change the default IPsec pre-shared key, prefer the SoftEther or OpenVPN protocols over legacy L2TP/IPsec, and watch the project's GitHub security advisories.

Key takeaways

• SoftEther VPN is free self-hosted VPN software under Apache 2.0, not a subscription VPN service.
• Use Stable Edition 4.44 Build 9807 (April 16, 2025) in production; the Developer Edition is experimental.
• One server handles SoftEther SSL-VPN, OpenVPN, L2TP/IPsec, MS-SSTP, EtherIP and L2TPv3; WireGuard is Developer Edition only and IKEv2 is absent.
• NAT traversal, free Dynamic DNS and VPN Azure make it easy to reach servers behind firewalls.
• Developer Edition 5.2.5188 has an unpatched pre-auth DoS, CVE-2026-39312, as of October 27, 2026.
• VPN Gate keeps connection logs for three months or more and is not a privacy VPN.