iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The correct UFW rule set for SoftEther is the smallest one that matches the protocols and listener ports enabled on your server. Allow SSH first, then open only the required SoftEther transports: TCP 443, 992 or 5555 for the listeners you configured; UDP 1194 for OpenVPN clone mode; and UDP 500 and 4500 for L2TP/IPsec, with UDP 1701 when the L2TP service requires it. Enable UFW only after those rules are in place.
A UFW rule does not create a SoftEther listener, bypass a cloud firewall, or replace NAT forwarding. The host firewall, the provider’s security controls and any router performing NAT must all permit the same traffic path.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Choose ports from the protocols your clients actually use
SoftEther can expose several VPN protocols from one installation. Do not open every documented port automatically. Start with the client protocols you intend to support, verify which listeners are enabled in SoftEther, and create rules only for those listeners.
| Use case | Transport and port | When to allow it | Important qualification |
|---|---|---|---|
| SoftEther SSL-VPN or management listener | TCP 443, TCP 992 or TCP 5555 | Allow the specific TCP listener ports configured on this server. | These are alternative listener ports, not a requirement to open all three. Official defaults and repository examples list them. |
| OpenVPN clone mode | UDP 1194 | Allow it when OpenVPN clone mode is enabled and clients use that endpoint. | UDP 1194 is the documented default for this mode. |
| L2TP/IPsec | UDP 500 and UDP 4500 | Allow both for L2TP/IPsec negotiation and protected traffic. | SoftEther’s L2TP/IPsec guidance specifically requires these ports through a NAT device or firewall. |
| L2TP service component | UDP 1701 | Add it when the L2TP service in your deployment requires a directly reachable UDP 1701 endpoint. | Check for conflicts with another L2TP/IPsec implementation before using it. |
TCP and UDP are separate rule families in UFW. Allowing TCP 443 does not allow UDP 443, and allowing UDP 1194 does not permit a TCP service on that number. Match the protocol exactly as SoftEther is configured.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Inventory the SoftEther configuration before touching UFW
Identify enabled protocols
Record whether this server will accept SoftEther SSL-VPN connections, OpenVPN clone connections, L2TP/IPsec connections, or a combination. SoftEther supports multiple protocols on one server, so the minimum firewall policy depends on the clients that must connect. A server used only by SoftEther SSL-VPN clients needs a different policy from one that also serves phones through L2TP/IPsec.
Confirm the actual listener ports
For SSL-VPN or management access, determine whether SoftEther is listening on TCP 443, 992, 5555, or a subset of those ports. The documented numbers are defaults and examples; a changed listener must be reflected in UFW. Opening a port that SoftEther is not using adds exposure without making a client connection possible.
Separate VPN access from administration
SSH is an administrative path, not a SoftEther protocol. Preserve it independently before enabling UFW. The representative Ubuntu sequence uses the UFW application profile named OpenSSH; if your host uses a different SSH port or profile, allow the service that actually carries your administration traffic before proceeding.
Apply the rules safely on Ubuntu
Run the following sequence from a console or an SSH session that you can recover if a mistake is made. The SoftEther entries are conditional: remove every line for a protocol or listener that is disabled on your server.
- Permit SSH first. Enter
sudo ufw allow OpenSSH. This creates the administrative exception before the firewall is turned on. - Add the configured TCP listeners. Use only the ports SoftEther actually exposes. For the documented listener set, the commands are
sudo ufw allow 443/tcp,sudo ufw allow 992/tcpandsudo ufw allow 5555/tcp. Do not add all three merely because they are listed in documentation. - Add OpenVPN clone mode if enabled. Enter
sudo ufw allow 1194/udponly when clients use OpenVPN clone mode on its UDP 1194 endpoint. - Add the L2TP/IPsec ports if enabled. Enter
sudo ufw allow 500/udpandsudo ufw allow 4500/udp. Addsudo ufw allow 1701/udpwhen the L2TP service requires that port in your design. - Enable UFW. Run
sudo ufw enableafter the required rules are present. Read the confirmation carefully; enabling a firewall while SSH is not allowed can terminate remote administration. - Review the active policy. Run
sudo ufw status verbose. Confirm that SSH and every selected SoftEther rule appear, and that no unnecessary protocol was opened.
sudo ufw allow OpenSSH
# Keep only the listeners and protocols enabled in SoftEther:
sudo ufw allow 443/tcp
sudo ufw allow 992/tcp
sudo ufw allow 5555/tcp
sudo ufw allow 1194/udp
sudo ufw allow 500/udp
sudo ufw allow 4500/udp
sudo ufw allow 1701/udp
sudo ufw enable
sudo ufw status verboseThe complete block is intentionally shown as a reference. It is not a recommendation to open every line. For example, an SSL-VPN-only server may need one TCP listener and SSH, while an L2TP/IPsec-only deployment needs the UDP negotiation ports and any required UDP 1701 path.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Account for NAT, routers and cloud firewalls
Host firewall versus upstream controls
UFW filters traffic at the Ubuntu host. It cannot open a port that is blocked earlier by a cloud security group, provider firewall, edge firewall or router. When the server is not directly internet-facing, reproduce the intended port and protocol policy at every enforcement point.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteNAT requirements for L2TP/IPsec
SoftEther’s L2TP/IPsec guidance states that a server behind NAT or a firewall must expose and forward UDP 500 and UDP 4500. Configure those forwards to the SoftEther host, then permit the same UDP ports in UFW. A rule on the host without a matching forward leaves the service unreachable from the public address.
Forward other selected listeners
If a router or provider NAT fronts the server, forward each TCP or UDP listener that clients are expected to reach, using the same protocol and port selected in UFW. Do not forward disabled listeners. In a cloud deployment, check the instance or subnet security controls separately; the Ubuntu example specifically notes that AWS or Azure network controls must allow the ports in addition to UFW.
Plan the public exposure scope
A public TCP 443 listener is an internet-facing VPN service even when UFW is correctly configured. If the architecture permits, restrict rules by trusted source networks or the appropriate interface. Keep public exposure limited to the protocols and clients that the service must support.
Validate that the service, not just the firewall, is ready
Check UFW’s effective rules
Use sudo ufw status verbose after enabling the firewall and after any change. Verify the expected protocol is shown next to each port. A TCP rule cannot satisfy an incoming UDP request, and an allowed port that is missing from the status output is not part of the active policy.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Check for bound SoftEther listeners
Confirm that SoftEther is actually listening on every port you opened. You can inspect the host socket table with:
sudo ss -lntup | grep -E ':(443|992|5555|1194|500|4500|1701)b'Compare the result with the protocols enabled in SoftEther. If a port is allowed by UFW but no SoftEther process is bound to it, the firewall is not the cause of that particular failure; enable or correct the corresponding SoftEther listener instead.
Test from an external client
Test each enabled protocol from a network outside the server’s local segment. Use an SSL-VPN client for the selected TCP listener, an OpenVPN-compatible client for UDP 1194 when clone mode is enabled, and an L2TP/IPsec client for the UDP 500/4500 path. Testing from the same LAN can conceal missing NAT forwards or provider rules.
Interpret partial success
- If TCP SSL-VPN works but L2TP/IPsec does not, inspect UDP 500 and 4500 forwarding, provider rules and port conflicts rather than changing the TCP rule.
- If a client reaches the public address but receives no service response, verify that the selected SoftEther listener is bound and that the protocol in the UFW rule matches the client.
- If UFW shows the rule and the socket is bound but remote traffic still fails, inspect the upstream security group, provider firewall and NAT mapping.
Troubleshoot the common failure modes
SSH stopped working after enabling UFW
The usual cause is enabling UFW before allowing SSH, or allowing a profile that does not match the host’s actual SSH service. Recover through an out-of-band console when available, add the correct SSH allowance, and then review the active policy with sudo ufw status verbose. Do not disable administrative access as a shortcut on a remotely managed production host.
The port is allowed, but SoftEther is unreachable
First distinguish a firewall problem from an application problem. Confirm the SoftEther listener is enabled and bound to the expected address and port. Then check the cloud security group or provider firewall and, where applicable, the router’s NAT destination. UFW only governs the host-level hop.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
L2TP/IPsec negotiation fails
L2TP/IPsec requires the UDP 500 and UDP 4500 path. Verify both rules, both upstream forwards and the public address used by the client. If your L2TP service requires UDP 1701, verify that allowance as well. Missing either of the required negotiation ports can prevent a session even when an unrelated TCP VPN listener is reachable.
Another service is using the IPsec/L2TP ports
SoftEther warns that another IPsec or L2TP implementation using UDP 500, 4500 or 1701 can prevent its IPsec communication from working correctly. Check which process owns those sockets. Stop or reconfigure the competing service, or choose a deployment in which only the intended IPsec/L2TP implementation binds those ports. Adding more UFW rules cannot resolve a socket-binding conflict.
OpenVPN clone clients cannot connect
Confirm that OpenVPN clone mode is enabled, that SoftEther is listening on UDP 1194, and that UFW, NAT and provider controls all permit UDP rather than TCP. A TCP 1194 allowance, or a correctly opened TCP SSL-VPN port, does not substitute for the UDP listener used by clone mode.
Only some clients connect
Different client types may use different protocols. One group may be using SSL-VPN over TCP while another uses L2TP/IPsec over UDP. Map each client to its protocol, then verify that protocol’s complete path independently. Avoid opening additional ports speculatively; identify the client protocol first.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Harden and maintain the rule set
Minimize the exposed surface
Remove the conceptual assumption that every SoftEther protocol must be available. A server that supports one listener has fewer externally reachable services than a server exposing SSL-VPN, OpenVPN clone mode and L2TP/IPsec simultaneously. Keep only the listeners required by current clients.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Restrict sources where the design allows
Keep SSH limited to trusted source addresses where practical. Apply the same principle to VPN rules when clients come from known networks or an administrative interface is intentionally private. Source and interface restrictions must match the real routing design; an over-restrictive rule can be indistinguishable from a broken VPN path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Protect internet-facing TCP 443
Treat a public TCP 443 VPN listener as an internet-facing service. Use strong VPN authentication, keep SoftEther updated and review logs for unexpected connection attempts. UFW controls reachability; it does not provide authentication, patching or account monitoring.
Review changes as a set
Whenever a SoftEther protocol is enabled, disabled or moved to another listener, update the host rule, NAT forwarding and provider security controls together. Re-run sudo ufw status verbose, confirm the socket bindings and perform an external protocol-specific test after the change.
Reference configurations by deployment goal
| Deployment goal | UFW entries | Upstream considerations | Exposure decision |
|---|---|---|---|
| SSL-VPN on one configured TCP listener | SSH plus the selected TCP 443, 992 or 5555 rule | Forward that TCP listener through NAT and allow it in the provider firewall when applicable. | Do not open UDP 1194, 500, 4500 or 1701 unless another enabled protocol needs them. |
| OpenVPN clone mode | SSH plus UDP 1194 | Permit and forward UDP 1194 through every upstream control in the path. | Keep TCP listeners closed if no SSL-VPN or management endpoint uses them. |
| L2TP/IPsec | SSH plus UDP 500 and UDP 4500; add UDP 1701 when required by the L2TP service | SoftEther specifically requires UDP 500 and 4500 forwarding when behind NAT or a firewall. Check for competing IPsec/L2TP services. | Expose only the L2TP/IPsec path needed by the client population. |
| Multiple protocols on one server | Combine the exact TCP and UDP rules for every enabled protocol | Synchronize UFW, NAT and cloud/provider rules for each transport. | Document which client uses which protocol so an outage can be isolated to one path. |
A practical pre-launch checklist
- SSH access is allowed before UFW is enabled.
- Each SoftEther protocol enabled for clients has a matching UFW rule with the correct TCP or UDP transport.
- Disabled listeners and unused protocol ports are not exposed.
- SoftEther is bound to every port you intend to publish.
- UDP 500 and UDP 4500 are forwarded when L2TP/IPsec is behind NAT or a firewall.
- Any required UDP 1701 path has been checked for service conflicts.
- Cloud security groups, provider firewalls and router rules match the host policy.
sudo ufw status verboseshows the expected active rules.- External tests have been run with a client appropriate to each enabled protocol.
- Public listeners use strong authentication, current software and ongoing log review.
The dependable approach is therefore sequential: identify the client protocols, verify SoftEther’s real listeners, allow SSH, add only the matching UFW rules, configure NAT and provider controls, enable UFW, then validate from outside the server. This prevents both accidental lockout and the misleading situation in which a port appears open while no service or upstream route can answer.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
