The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Open only the ports used by your SoftEther configuration, and allow SSH before turning on UFW. For the common protocols, that means TCP 443, 992, or 5555 for SoftEther SSL-VPN or management listeners, UDP 1194 for OpenVPN clone mode, and UDP 500 and 4500 for L2TP/IPsec. Add UDP 1701 only when the L2TP service on your server actually requires it. If the server is behind NAT or a cloud firewall, the same traffic must also be forwarded or permitted there; a UFW rule alone cannot make an unreachable service work.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you need to open
SoftEther can expose several protocols at the same time, but each one has a different transport and port set. The safest policy is to map the clients you intend to support to the listeners that are enabled on this particular server, then create UFW rules for that set only. Leaving unused VPN protocols open increases the public attack surface and makes troubleshooting less clear.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Enabled use case | Transport and port | When to allow it | Additional network requirement |
|---|---|---|---|
| SoftEther SSL-VPN or a SoftEther listener | TCP 443, 992, or 5555 | Allow only the ports on which your SoftEther installation is configured to listen. These are the listener ports listed in SoftEther’s specification and common repository examples. | Permit the same TCP port in any provider firewall or NAT device. |
| OpenVPN clone mode | UDP 1194 | Allow when OpenVPN clone mode is enabled and clients use the default UDP listener. | Forward or permit UDP 1194 outside the host when the server is not directly internet-facing. |
| L2TP/IPsec | UDP 500 and UDP 4500 | These are the IPsec ports SoftEther documents for L2TP/IPsec, including deployments behind NAT. | Forward UDP 500 and 4500 through the NAT device and allow them in the cloud or provider security layer. |
| L2TP service data channel | UDP 1701 | Add it when the L2TP service on your server requires a directly reachable UDP 1701 listener. Check the actual listener and your deployment design before opening it. | Ensure no other L2TP/IPsec implementation is already using the same port. |
The numbers above are protocol defaults or documented requirements, not a promise that every SoftEther server uses every port. A server configured to listen only on TCP 443 does not need TCP 992 or 5555. Conversely, opening TCP 443 does not help a client whose enabled protocol is OpenVPN clone or L2TP/IPsec.
Before you enable UFW
Record the enabled SoftEther protocols
In SoftEther Server Manager, inspect the listener and protocol settings for the virtual hub and server. Write down which of these are actually enabled: SSL-VPN, OpenVPN clone, L2TP/IPsec, or a combination. Also note any non-default listener port. The UFW rules must match the configured listener, not merely the port you expected to use.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Protect your administration session first
UFW can immediately block the SSH connection you are using to administer the machine. On Ubuntu, create the SSH allowance before enabling the firewall:
sudo ufw allow OpenSSHKeep an existing SSH session open while you test a second session. If your system does not have an OpenSSH application profile, use the SSH port and protocol shown by your server’s configuration instead of guessing. Once connectivity is confirmed, narrow the SSH rule to trusted source addresses where practical.
Identify NAT and provider controls
Determine whether the host has a public address on its network interface. If it sits behind a home router, office gateway, hypervisor NAT, or cloud load-balancing layer, traffic must pass through that device before it can reach UFW. SoftEther’s L2TP/IPsec guidance specifically requires UDP 500 and 4500 to be exposed when the VPN server is behind NAT or a firewall. Cloud deployments can also have a security group, network ACL, or provider firewall in addition to UFW. Each layer needs a matching rule.
Check for port ownership conflicts
Before changing firewall policy, check whether another service is already bound to the IPsec or L2TP ports. SoftEther warns that another IPsec/L2TP implementation using UDP 500, 4500, or 1701 can stop its own IPsec communication from working correctly. A firewall rule cannot resolve two daemons competing for one socket.
Build the UFW rule set safely
The following sequence is a template. Remove every line for a protocol or listener that is disabled on your server. Do not paste all of the lines automatically just because they are shown together.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
- Allow SSH first.
sudo ufw allow OpenSSH - Optionally set a restrictive baseline. If this is a new host and you understand the effect on existing services, set incoming traffic to deny and outgoing traffic to allow:
sudo ufw default deny incoming sudo ufw default allow outgoingDo this only after confirming that every required administration and application rule has been planned.
- Add the SoftEther SSL-VPN or listener ports that are enabled.
sudo ufw allow 443/tcp sudo ufw allow 992/tcp sudo ufw allow 5555/tcpDelete or omit the lines for listeners that SoftEther is not using.
- Add OpenVPN clone mode only if enabled.
sudo ufw allow 1194/udp - Add the IPsec ports for L2TP/IPsec.
sudo ufw allow 500/udp sudo ufw allow 4500/udp - Add UDP 1701 only when the L2TP service requires it.
sudo ufw allow 1701/udp - Enable UFW after reviewing the commands.
sudo ufw enableConfirm the prompt and keep your existing SSH session available until the verification steps succeed.
- Display the resulting policy.
sudo ufw status verbose
The representative Ubuntu pattern is to allow OpenSSH, add the selected SoftEther ports, enable UFW, and inspect the verbose status. The list is intentionally conditional: an SSL-VPN-only installation might need TCP 443 and SSH, while a server supporting all three protocol families could need every applicable rule.
Recommended Free Tools
Choose rules by protocol
SoftEther SSL-VPN and management listeners
TCP 443 is the familiar HTTPS port and is one of SoftEther’s specified listeners. TCP 992 and TCP 5555 are also listed SoftEther listener ports. Use the port that is configured on the server; opening all three is appropriate only when all three listeners are enabled and required by your clients or administration design.
If a client cannot connect over SSL-VPN, first compare its destination port with the listener shown in SoftEther. A UFW rule for TCP 443 does not redirect traffic to TCP 5555. If you intentionally changed the listener, create the rule for that changed port and update the client profile accordingly.
OpenVPN clone mode
SoftEther’s OpenVPN clone mode uses UDP 1194 as its documented default. The rule must specify UDP; sudo ufw allow 1194/tcp would permit a different transport and would not help an OpenVPN client sending datagrams. If you changed the clone-mode listener, use the configured port instead of 1194 and make the same change in the provider firewall and NAT forwarding.
L2TP/IPsec
L2TP/IPsec is a multi-port protocol. UDP 500 handles the initial IPsec negotiation, and UDP 4500 is used for NAT traversal; SoftEther’s official guidance says both must be exposed when the server is behind NAT or a firewall. Opening only one generally leaves negotiation incomplete.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
UDP 1701 belongs to the L2TP portion of the design. Whether it must be reachable directly depends on how the L2TP service is configured and what is bound on the host. Add the UFW rule when that service requires it, but do not assume it can be shared safely with another L2TP/IPsec daemon. SoftEther identifies conflicts on UDP 500, 4500, and 1701 as a cause of failed IPsec communication.
NAT, cloud firewalls, and UFW are separate controls
Think of an inbound VPN packet as passing through a chain: the client reaches the public address, a provider or router decides whether to forward it, and UFW then evaluates it on the Ubuntu host. A permit at only one stage is insufficient.
Server behind a router or gateway
Create destination-NAT or port-forwarding entries from the public address to the server’s private address. For L2TP/IPsec, forward UDP 500 and UDP 4500 as SoftEther documents. Forward TCP 443, 992, or 5555 only for the SSL-VPN listeners you use, and forward UDP 1194 only for OpenVPN clone mode. Make sure the forwarding target remains stable; a changed private address can look like a firewall failure.
Cloud-hosted server
In a cloud environment, add inbound rules to the instance’s security group or equivalent provider firewall for the same protocol and port pairs. The Ubuntu UFW policy and the cloud policy are independent. A cloud rule that allows TCP 443 cannot compensate for a missing UFW rule, and a UFW rule cannot override a provider rule that drops UDP 4500.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteLimit exposure where the architecture allows
Public VPN listener ports normally need to accept connections from the internet, but administrative access does not. Keep SSH restricted to known source addresses when possible. If a VPN listener is intended only for a corporate, home, or game-server network, narrow its UFW rule by source address or interface instead of allowing every origin. Apply restrictions consistently at the provider firewall and NAT device so unwanted traffic is discarded before it reaches the host.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Verify the host, then test from outside
Read the effective UFW policy
sudo ufw status verboseConfirm that each expected rule appears with the correct transport. A line for 443/tcp is not equivalent to one for 443/udp. If you need to inspect rule numbers before changing anything, use:
sudo ufw status numberedConfirm that SoftEther is listening
An allowed port is not a service. Check the host’s listening sockets:
sudo ss -lntupCompare the output with your planned matrix. Look for the SoftEther process bound to the expected TCP or UDP port. If no process is listening, correct the SoftEther protocol or listener configuration and restart it according to your installation method. Do not keep adding firewall rules for a disabled listener.
Test each enabled protocol from an external network
Use a client on a different network from the server, such as a separate internet connection, and test the protocol it is configured to use. A successful local test can bypass the public NAT path and hide a forwarding error. Test SSL-VPN against its configured TCP listener, OpenVPN clone against its UDP listener, and L2TP/IPsec with the complete UDP 500/4500 path and any required UDP 1701 path.
Record which stage fails. If the provider sees no packet, investigate its security group or NAT. If packets reach the host but the socket is absent, investigate SoftEther. If the socket is present but the connection is rejected, inspect UFW status and service logs rather than opening unrelated ports.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Troubleshoot common failures
SSH stopped working after enabling UFW
This usually means the SSH allowance was missing, used the wrong port, or was restricted to an incorrect source address. Use an out-of-band console supplied by the host or cloud provider, restore the correct SSH rule, and keep a second session open during future changes. Do not disable every firewall rule as a first response if a console is available.
SSL-VPN fails even though TCP 443 is allowed
- Verify that SoftEther is listening on TCP 443 rather than TCP 992 or TCP 5555.
- Check whether a web server or reverse proxy owns TCP 443. A port conflict can prevent SoftEther from binding.
- Confirm that the provider firewall and NAT forward TCP 443 to this host.
- Check the client profile for the same hostname, address, and port that the server exposes.
OpenVPN clone clients time out
- Confirm that OpenVPN clone mode is enabled and bound to UDP 1194, or use the configured alternative port in every layer.
- Ensure the rule is UDP, not TCP.
- Check provider and router forwarding for UDP 1194.
- Verify the listener with
ss; UFW cannot create a listener that SoftEther has disabled.
L2TP/IPsec negotiation fails
- Check UDP 500 and UDP 4500 in UFW, the provider firewall, and the NAT forwarding table.
- When the server is behind NAT, confirm that both ports are forwarded to the same private address.
- Look for another IPsec or L2TP service bound to UDP 500, 4500, or 1701. SoftEther documents these conflicts as a reason its IPsec communication can fail.
- Determine whether your L2TP configuration requires UDP 1701 and add it only when the service is actually using that port.
Rules appear correct but connections still fail
Separate reachability from authentication. UFW controls packet filtering; it does not create SoftEther users, fix a virtual-hub configuration, or repair an incorrect client profile. Once the expected packets reach the host and the correct listener is bound, investigate SoftEther authentication and protocol settings without opening additional ports at random.
Maintain and narrow the rule set
Remove obsolete listeners
When you disable a protocol or move a listener, delete its old rule. First list numbered rules:
sudo ufw status numberedThen remove the obsolete entry by number, checking the prompt carefully:
sudo ufw delete <rule-number>Alternatively, repeat the original rule expression when your UFW version supports it, such as sudo ufw delete allow 1194/udp. Verify the final policy again with sudo ufw status verbose.
Keep the public surface intentional
- Document which SoftEther protocols and listener ports are enabled and why.
- Keep SSH limited to trusted sources instead of leaving a broad administrative rule indefinitely.
- Review provider firewall and NAT entries whenever a SoftEther listener changes.
- Use strong VPN authentication and keep the SoftEther installation updated, especially when TCP 443 is exposed to the internet.
- Review firewall and VPN logs after changes so repeated probes or failed negotiations can be distinguished from configuration mistakes.
Example minimal configurations
| Deployment goal | UFW rules to consider | What is intentionally excluded |
|---|---|---|
| SSL-VPN on the standard listener | OpenSSH and 443/tcp |
TCP 992, TCP 5555, UDP 1194, and L2TP/IPsec ports unless those services are enabled. |
| SSL-VPN on a custom SoftEther listener | OpenSSH and the configured TCP listener, such as 5555/tcp |
TCP 443 if nothing listens there; all unrelated UDP protocols. |
| OpenVPN clone only | OpenSSH and 1194/udp, or the configured clone-mode port |
SSL-VPN and L2TP/IPsec ports. |
| L2TP/IPsec behind NAT | OpenSSH, 500/udp, and 4500/udp; add 1701/udp when required by the L2TP service |
TCP listener ports and UDP 1194 unless those protocols are also enabled. |
| All supported protocols on one server | SSH plus each enabled TCP listener, UDP 1194 if OpenVPN clone is enabled, and UDP 500/4500 with conditional UDP 1701 for L2TP | Any listener that is disabled, unused, or already served by a different design. |
Final checklist
- Identify the SoftEther protocols and exact listeners enabled on the server.
- Allow SSH before running
sudo ufw enable. - Add only the matching TCP and UDP rules.
- For L2TP/IPsec, permit UDP 500 and 4500 through every NAT and provider firewall; add UDP 1701 only when the L2TP service requires it.
- Check for competing IPsec or L2TP services on UDP 500, 4500, and 1701.
- Run
sudo ufw status verboseandsudo ss -lntup. - Test from an external network using the same protocol and port as the client.
- Remove rules when listeners are disabled, and restrict administrative access to trusted sources.
The correct UFW policy is therefore the smallest set that covers the SoftEther listeners your users actually need, with the same ports permitted and forwarded at every upstream network layer. A firewall allowance proves only that packets may pass; successful VPN access also requires a bound SoftEther listener, conflict-free ports, correct NAT or provider forwarding, and a client configured for that protocol.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
