What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Open only the ports used by the SoftEther protocols you actually enable, and preserve SSH access before turning on UFW. For a typical Ubuntu server, that means allowing OpenSSH, adding the required TCP or UDP listeners, enabling UFW, then checking both the firewall rules and SoftEther’s listening sockets. If the server sits behind NAT or a cloud firewall, the same ports must also be forwarded or permitted there.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Start with the protocols your server will accept
SoftEther VPN Server can provide several connection methods at the same time. UFW should reflect that design rather than opening every documented port by default. The smallest correct rule set depends on which clients must connect and which listeners are enabled in SoftEther.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
- SSL-VPN or SoftEther management: use the TCP listener ports configured on this server. SoftEther’s published specification and common repository examples identify TCP 443, 992 and 5555.
- OpenVPN clone mode: the documented default is UDP 1194.
- L2TP/IPsec: UDP 500 and UDP 4500 are required for the IPsec exchange and protected traffic. UDP 1701 may also be needed when the L2TP service is enabled.
A port appearing in SoftEther’s specification does not mean it must be exposed. If a listener is disabled, omit its UFW rule. Conversely, allowing a port cannot create a service that SoftEther is not listening on.
Map each enabled service to a rule
| Connection method | Transport and port | When to allow it | Additional network requirement |
|---|---|---|---|
| SoftEther SSL-VPN or management listener | TCP 443, 992 or 5555 | Only for the TCP listeners configured on the server | Permit the same port through any provider firewall or upstream NAT |
| OpenVPN clone mode | UDP 1194 | When OpenVPN-compatible clients are part of the deployment | Permit or forward UDP 1194 at every upstream enforcement point |
| L2TP/IPsec | UDP 500 and UDP 4500 | Required when SoftEther’s L2TP/IPsec service is enabled | SoftEther’s guide requires forwarding UDP 500 and 4500 when the host is behind NAT |
| L2TP service component | UDP 1701 | Add when the L2TP implementation on this server requires it | Check for competing services that may already bind this port |
TCP and UDP are separate rule families. A TCP rule for port 443 does not permit UDP 443, and a UDP rule for 1194 does not permit TCP 1194. Use the protocol shown in the table rather than opening both transports “just in case.”
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prepare the server without locking yourself out
Keep an existing SSH session open
Make firewall changes from a current administrative session and, where possible, keep a second session available. The first rule in a representative Ubuntu deployment is:
sudo ufw allow OpenSSHThis uses UFW’s predefined application profile for SSH. If your SSH daemon uses a nonstandard port, the profile may not match that deployment; verify the actual administrative path before enabling UFW. Do not close the working session until you have confirmed that the new rules are active and that a fresh administrative connection succeeds.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Confirm the SoftEther listeners
Before adding firewall entries, inspect the SoftEther configuration and determine whether the server is listening on TCP 443, 992, 5555, UDP 1194, UDP 500, UDP 4500 and, where applicable, UDP 1701. This inventory prevents two common errors: exposing unused services and troubleshooting a firewall rule for a listener that is disabled.
Identify upstream controls
Determine whether the host has a public address. A machine behind a router, gateway or cloud network has more than one enforcement point. UFW governs traffic arriving at the Linux host, while a provider security group, provider firewall or NAT device can drop the packet before it reaches UFW. Record which device owns the public address and where forwarding rules must be entered.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Apply the UFW rules in a safe sequence
The following sequence includes every port documented for the supported modes, but it is intentionally conditional. Remove commands for disabled protocols or unused listeners before running it.
- Allow administration first.
sudo ufw allow OpenSSH - Add enabled TCP listeners. Use only the SoftEther TCP ports configured on this server:
sudo ufw allow 443/tcpsudo ufw allow 992/tcpsudo ufw allow 5555/tcp - Add OpenVPN clone mode if required.
sudo ufw allow 1194/udp - Add L2TP/IPsec if required.
sudo ufw allow 500/udpsudo ufw allow 4500/udp - Add the L2TP service port only when the deployment needs it.
sudo ufw allow 1701/udp - Enable UFW after reviewing the commands.
sudo ufw enable - Inspect the resulting policy.
sudo ufw status verbose
UFW may warn that enabling the firewall could interrupt existing SSH connections. That warning is a reason to verify the SSH rule and keep a recovery path, not a reason to open every port. The status output should show only the administrative rule and the SoftEther transports selected for this installation.
Choose a minimal rule set for each deployment
| Deployment profile | UFW entries | Typical reason |
|---|---|---|
| SSL-VPN on TCP 443 only | OpenSSH; 443/tcp |
A deployment using SoftEther’s HTTPS-like listener as its sole VPN endpoint |
| SSL-VPN with additional SoftEther listeners | OpenSSH; whichever of 443/tcp, 992/tcp and 5555/tcp are enabled |
Separate clients or administrative arrangements require more than one TCP listener |
| OpenVPN clone only | OpenSSH; 1194/udp |
OpenVPN-compatible clients connect through SoftEther |
| L2TP/IPsec only | OpenSSH; 500/udp; 4500/udp; add 1701/udp when required |
Clients use the L2TP/IPsec service rather than SSL-VPN or OpenVPN clone mode |
| Several protocols on one server | OpenSSH plus the union of the selected rows |
SoftEther accepts different client types at the same time |
The last profile is not automatically better. Every additional exposed listener expands the set of services that must be maintained, monitored and protected. Enable multiple protocols only when they serve a defined client or compatibility requirement.
Handle L2TP/IPsec, NAT and port forwarding correctly
Why UDP 500 and 4500 are different from ordinary VPN rules
L2TP/IPsec depends on UDP 500 and UDP 4500. SoftEther’s official L2TP/IPsec guidance states that a server behind NAT or a firewall must expose and forward those two ports. Allowing them in UFW is therefore necessary on the host, but it is not sufficient when the public address belongs to another device.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Forward traffic to the correct private address
On a NAT gateway, create forwarding entries for UDP 500 and UDP 4500 to the private address of the SoftEther server. If the L2TP service in your design also requires UDP 1701, forward and permit that port as well. Use a stable internal address so a DHCP change does not silently send VPN packets to another machine.
Check for an IPsec or L2TP collision
SoftEther warns that another IPsec or L2TP implementation using UDP 500, 4500 or 1701 can prevent SoftEther’s IPsec communication from working correctly. A rule can show “ALLOW” while the wrong daemon owns the socket. Before debugging UFW, identify services on the host that provide another VPN or IPsec stack and ensure only the intended implementation binds the required ports.
Account for cloud security groups
Cloud networks commonly enforce a provider-level security group or firewall in addition to UFW. The Ubuntu deployment pattern that uses sudo ufw allow OpenSSH also requires matching permissions in services such as AWS or Azure network controls. Add the same protocol-and-port combinations there, with the narrowest source scope that still supports your clients. A provider rule that allows TCP 443 does not automatically allow UDP 500 or UDP 4500.
Validate the firewall and the application separately
Read UFW’s active policy
Run:
sudo ufw status verboseCheck that each expected entry has the correct transport. Pay particular attention to UDP versus TCP and to accidental rules left from an earlier experiment. The output confirms UFW’s policy; it does not prove that SoftEther is listening or that an upstream network is forwarding the packet.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Verify listeners on the server
Use the host’s socket inspection method to confirm that SoftEther has bound the ports you opened. The expected result is a SoftEther listener on each selected TCP or UDP endpoint. If a port is absent, return to the SoftEther listener configuration and service state instead of adding more firewall rules.
Test from an external network
Test from a client outside the server’s local network, using a client appropriate to the enabled protocol. An SSL-VPN test should target the configured TCP listener; an OpenVPN clone test should use UDP 1194; an L2TP/IPsec test should exercise UDP 500 and 4500 and the L2TP service where applicable. Testing from the same LAN can succeed through a different path and conceal a missing NAT or provider rule.
Interpret a successful status check correctly
If UFW shows an allow rule and the listener is bound but an external client still fails, the remaining path usually includes NAT forwarding, a cloud security group, a provider firewall, routing, or a port conflict. Treat the network as a chain: the packet must pass every control point and arrive at the process that owns the destination socket.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot by symptom
The SSH connection drops after enabling UFW
- Use an existing console or out-of-band recovery channel if available.
- Confirm that the SSH application profile or the actual SSH port was allowed before enabling UFW.
- Do not assume a VPN rule can restore administration; SSH and the VPN listener are separate services.
The SSL-VPN endpoint is unreachable
- Check that SoftEther is configured to listen on the TCP port you opened: 443, 992 or 5555.
- Confirm the external address and any provider firewall rule.
- If the host is behind NAT, verify that the selected TCP port forwards to this server.
- Check whether another application already occupies the selected TCP port.
OpenVPN clone clients cannot connect
- Verify that UDP 1194 is enabled in SoftEther and allowed in UFW.
- Confirm that upstream NAT or cloud controls permit UDP rather than TCP 1194.
- Test from outside the local network so the result includes the real Internet path.
L2TP/IPsec negotiation fails
- Check both UDP 500 and UDP 4500 at UFW and at the upstream firewall or NAT device.
- Add UDP 1701 only when the L2TP service requires it; opening it cannot compensate for blocked IPsec negotiation.
- Look for another IPsec or L2TP daemon bound to 500, 4500 or 1701.
- Confirm that forwarding targets the SoftEther host and that the public address is not assigned to a different gateway.
The rule is present but nothing answers
This is the characteristic difference between filtering and service configuration. UFW can permit a packet to a closed port without producing a VPN response. Check the SoftEther process, its configured listeners and socket ownership before changing firewall policy.
Limit exposure after connectivity works
Keep administration narrower than VPN access
SSH is an administrative control plane, not a VPN transport. Where the architecture permits, restrict SSH to trusted source addresses or an administrative network instead of leaving it broadly reachable. Make that change only after confirming a reliable management path.
Free tools Windows power users keep installed
One-click scans. No signup required.
Expose only the required VPN transports
Remove rules for protocols that no client uses. A server that needs SSL-VPN on TCP 443 does not also need UDP 1194, 500, 4500 or 1701. Reducing the exposed set makes the active configuration easier to audit and avoids confusion during incident response.
Review the internet-facing TCP listener
TCP 443 is commonly reachable from the public Internet, so treat it as an exposed application service. Use strong VPN authentication, keep SoftEther current, and review logs for repeated or unexpected connection attempts. The firewall controls reachability; it does not replace authentication, patching or monitoring.
Document every enforcement point
Record the selected SoftEther protocols, their UFW entries, the provider security-group rules and any NAT mappings. Include the date of the change and the internal destination address. This documentation makes later troubleshooting faster when a provider rule, router configuration or SoftEther listener changes independently of UFW.
Final verification checklist
- SSH was allowed before UFW was enabled, and a new administrative connection has been tested.
- Every UFW entry corresponds to an enabled SoftEther listener.
- TCP and UDP transports match the protocol requirements.
- L2TP/IPsec has UDP 500 and 4500 permitted wherever the traffic passes; UDP 1701 is present only when required.
- NAT forwarding and cloud-provider controls match the host rules.
- No competing IPsec or L2TP service owns the required UDP ports.
sudo ufw status verboseshows the intended final policy.- External clients have tested each enabled protocol from outside the local network.
The reliable approach is therefore selective rather than permissive: inventory the listeners, allow SSH first, add only the protocol-specific TCP and UDP rules, configure every upstream firewall or NAT device, and validate both UFW and the SoftEther sockets. That sequence avoids the two most damaging assumptions—that an open port means a running service and that a host-level rule controls the entire network path.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
