Security Concerns

[khris2fer74]

Hello, I've come across a couple of security concerns with the Softether VPN Server
1. Old TLS versions by default TLS 1.0 and TLS 1.1 are enabled by default but there is a step that can be taken to disable the old protocols and leave 1.2 and 1.3 enabled.

2. Also by default if you go to https://yourpublicipaddress:5555 or whatever port your sever is on in a browser it displays this in a webpage

SoftEther VPN Server / Bridge
For VPN users:

Connect to this VPN Server
by Official SoftEther VPN Client (download)
by L2TP/IPsec, OpenVPN or SSTP traditional clients
For VPN administrators:

Manage this VPN Server or VPN Bridge
by SoftEther VPN Server Manager GUI for Windows / macOS (download) (Recommended)
by SoftEther VPN Command Line Management Utility (vpncmd) for CUI
by JSON-RPC API from your favorite programming language (JavaScript, TypeScript, Java, Python, Ruby, C#, ... etc.)
(ID: 'administrator', Password: same to the VPN Server's password. Default: empty)
by Built-in HTML5 Web Administration Console (New, under construction)
(ID: 'administrator', Password: same to the VPN Server's password. Default: empty)

If you want to disable this embedded web server and JSON-RPC server:
Stop the daemon.
Modify the value of "bool DisableJsonRpcWebApi" from "false" to "true" on the vpn_server.config or vpn_bridge.config.
Restart the daemon.

Which I don't like cause it advertises what VPN software you're using. All they need now is to get the client and start trying to login at the bottom of the page it tells how to disable this.

So those are 2 security issues I see. Does anyone know of anything else that should be disabled to harden the security a bit more or turn off anything that's vunerable?

[solo]

Enable anti-MitM.
https://www.softether.org/4-docs/1-manu ... rification
https://www.softether.org/4-docs/1-manu ... entication

Enable TunnelCrack protection.
https://www.softether.org/9-about/News/905-TunnelCrack

Pick chained ciphers.
viewtopic.php?t=68790

Adapt VPN Gate packet filtering rules.
viewtopic.php?f=7&t=68039#p97841

Apply IP Access Control List.
https://www.softether.org/4-docs/1-manu ... ntrol_List

Consider VPN Gate's "Deny Bridge Operation policy" option.
https://www.softether.org/4-docs/1-manu ... licy_Items
(this would make some users cry, LOL viewtopic.php?t=70058 and viewtopic.php?t=70105 )

While at it, for other reasons disable DDnsClient and NatTraversal if you don't need them.
viewtopic.php?f=7&t=67838#p97405

[Aleksas123]

Would it also make sense to restrict management access to trusted IPs at the firewall level, especially if the server is directly exposed to the internet?

[solo]

For sure if it's on non-443 port.
viewtopic.php?p=104455