Is there any restriction on running VM NICs in promiscuous mode?

[starkruzr]

I've tried to set up VPN servers on my Proxmox VE server, first OpenVPN and now SoftEther, with no luck, and noted in the SoftEther installation instructions that some virtualization environments (with no specificity as to which, sadly) need some kind of explicit instructions in order to get their VMs to allow their NICs to run in promiscuous mode. The VM I'm using is using a VirtIO NIC. Is this sufficient?

Thanks!

 

[pirateghost]

There is nothing needed to set them to promiscuous mode. They do that by default. You can see this yourself in the syslog when starting/stopping a VM.

I have succesfully run routers, firewalls, vpn servers, web filters, etc in KVM just fine. Where are you having trouble with OpenVPN? It is really a straight forward configuration.

 

[Nemesiz]

I have no problem to run SoftEther client/server on host or openvz vps. Where do you want to run SoftEther?

 

[starkruzr]

It doesn't seem to be straightforward at all. I've followed the directions both for OpenVPN and SoftEther, which I thought were simple enough, but neither one works -- SoftEther simply won't connect at all through the port forwards in my firewall and OpenVPN connects but appears to have all kinds of problems allowing clients to route Internet-destined packets through it every time I set it up.

 

[pirateghost]

If you have issues like that have you tried a preconfigured appliance for open VPN?

Http://turnkeylinux.org

 

[Nemesiz]

Can you describe what you want to achieve?

 

[starkruzr]

Can you describe what you want to achieve?

This part is easy

I have a simple, 1-subnet network at home on a broadband internet connection, with PVE running inside the firewall. I want to stand up a VPN server inside the firewall, behind NAT, which bridges clients onto the LAN. On the client side, when a client connects to the VPN, it should receive an IP address from the DHCP server already running on the LAN, and all of its traffic should be sent through the VPN connection and back out through the internet connection via my home LAN.

This has thus far been impossible to achieve with either SoftEther or OpenVPN. SoftEther refuses to allow any hosts to connect, and OpenVPN's Mac client (at the very least) seems to ignore the directive to redirect its gateway through the VPN.

 

[pirateghost]

This part is easy

I have a simple, 1-subnet network at home on a broadband internet connection, with PVE running inside the firewall. I want to stand up a VPN server inside the firewall, behind NAT, which bridges clients onto the LAN. On the client side, when a client connects to the VPN, it should receive an IP address from the DHCP server already running on the LAN, and all of its traffic should be sent through the VPN connection and back out through the internet connection via my home LAN.

This has thus far been impossible to achieve with either SoftEther or OpenVPN. SoftEther refuses to allow any hosts to connect, and OpenVPN's Mac client (at the very least) seems to ignore the directive to redirect its gateway through the VPN.

that's not how OpenVPN works. you need a separate subnet for OpenVPN and routes between the networks.

 

[Nemesiz]

This has thus far been impossible to achieve with either SoftEther or OpenVPN. SoftEther refuses to allow any hosts to connect, and OpenVPN's Mac client (at the very least) seems to ignore the directive to redirect its gateway through the VPN.

What software do you use for clients?

 

[starkruzr]

I thought doing what I described was the purpose of bridged (tap) mode.

I was using the Mac built-in L2TP client for SoftEther and Tunnelblick for OpenVPN.

 

[Nemesiz]

L2TP use UDP 500 and UDP 1701 and protocol 50.

As of Mac SoftEther client don`t work as gateway. Try to set SE server as OpenVPN server and try to connect with Tunnelblick.

 

[starkruzr]

L2TP use UDP 500 and UDP 1701 and protocol 50.

As of Mac SoftEther client don`t work as gateway. Try to set SE server as OpenVPN server and try to connect with Tunnelblick.

This is working in bridged (layer 2) mode, but like the first time I tried OpenVPN, it is not respecting the directive to send all traffic over the VPN.

 

[ieronymous]

I've tried to set up VPN servers on my Proxmox VE server, first OpenVPN and now SoftEther, with no luck, and noted in the SoftEther installation instructions that some virtualization environments (with no specificity as to which, sadly) need some kind of explicit instructions in order to get their VMs to allow their NICs to run in promiscuous mode. The VM I'm using is using a VirtIO NIC. Is this sufficient?

Thanks!

I have a similar issue with you.

I have installed in a ubuntu 24.04 softether vpn server and configured it via soft ether server manager from a win machine. While I have a successful connection with clients, speeds are another story, I also have a softether VPN server on an old dell optiplex machine (so physical one), and clients have decent speeds.

client speed results:
54 Mbit Down / 7.2 Mbit Up 61ms with softether installed directly on a physical machine running windows.
1.6 Mbit Down / 7.7 Mbit Up 76ms with softether installed on linux as VM on Proxmox.


PS There ware 2 options to set to speed up tcp connections but didnt help.
Edit file (inside the vm not the host) /etc/sysctl.conf and set
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr