The SecureNAT function can be use for the following objectives.Įven setting up the VPN Server and Virtual Hub and remotely connecting to that hub only results in closed communication within the Virtual Hub, so it is possible to communicate with the physical network connected to the computer running the VPN Server. Even if a failure occurs in the SecureNAT program, the effect is limited to the user space which launched the VPN Server / VPN Bridge, thus eliminating the risk of effects to other users and the system overall. In contrast, the SoftEther VPN SecureNAT program can be run completely in user space without the need for special system authority. If there is vulnerability such as a buffer overrun in part of the NAT program, it may lead to system invasion and kernel authority theft by a black hat or an entire system crash due to a bug. Typical NAT programs run as kernel modules. In addition, System Administrators can use SecureNAT as safe NAT software. Please refer to 10.11 Exploit SecureNAT for Remote Access into Firewall without Any Permission for specific methods of use. When general users with permission from the Network Administrator or System Administrator but without a System Administrator account use the SecureNAT function, it becomes possible to realize VPN communication typically not within general user authority. Please refer to 3.2 Operating Modes for details on how to launch the VPN Server / VPN Bridge as a general user. This feature means that no System Administrator authority is required to use the SecureNAT function. Accordingly, all SecureNAT functions including the virtual NAT function can be freely executed with general user authority. In order to realize the virtual NAT, the SoftEther VPN requires absolutely no special processing in the operating system's kernel mode nor the use of the kernel mode's NAT function. In order to realize a complicated mechanism such as the one present in the virtual NAT in particular, it is usually necessary to use the kernel module within the operating system. The SecureNAT function and virtual NAT / virtual DHCP server all run as user mode programs. Using SecureNAT with General User Authority The virtual host network interface can also assign IP addresses.

As such, from the perspective of other VPN client computers connected to the Virtual Hub and the perspective of cascaded or bridging destination computers when the Virtual Hub is cascaded or locally bridged to other Virtual Hubs or physical LANs, the SecureNAT function's virtual host network interface is recognized as being equivalent to a single computer. This is called a virtual host network interface.Ī virtual host network interface is layer 2 direct connected to the Virtual Hub.

Enabling the SecureNAT function creates a virtual VPN session called a SecureNAT session within the Virtual Hub and creates a virtual network interface (VNI) as if there were a single network adapter within that VPN session. Unlike the local bridge function, all settings of the SecureNAT function can be set by the Virtual Hub Administrators. The SecureNAT function can be set and enabled/ disabled for each Virtual Hub.

Softether vpn guide