SoftEther Server, Client and Manager: Which One Do You Need?
The server accepts connections, the client makes one, and Server Manager edits the deployment. Installing the wrong part leaves a setup that does nothing.
SoftEther ships several programs that look similar in a download list and behave nothing alike. The server accepts and manages connections, the client creates one from a device, and Server Manager administers a deployment. Choosing the wrong one produces a working installation that does not do the task you had in mind.
What the server actually does
The server binary, vpnserver, listens, authenticates users, and attaches virtual hubs to networks. It holds the identities and the policy. When you install it, you are building a gateway that other devices connect to; you are not configuring your own machine to use someone else's service.
Its listeners are configuration rather than a property of the product. A hub can exist with no listener enabled, and a listener can be enabled with no hub reachable behind it. That is why a successful port check proves less than it seems: something answered, and the useful question is what it authenticated you against. Ask for the listener's name as well as its port.
Server Manager is the administrative view of that state. It shows the configuration; it does not carry traffic.
What the client actually does
The client binary, vpnclient, creates a virtual adapter on the device and connects a saved account to a server. The adapter is where the address, routes and DNS behavior land. Installing the client does not create an account, and it does not enable anything on the far side.
The client also keeps its own state between runs: the account list, the startup flag and the adapter configuration. That state is why a client can appear installed and still connect nothing after a reboot. Server Manager cannot substitute for that path, however complete its menus look.
What the manager is for
Server Manager connects to a running server with administrative credentials and edits its configuration. It is a control plane. A session in it proves that administration works; it does not move the local browser's traffic through the server.
Keep administrator credentials separate from user profiles, because the two objects grant different things. If someone receives an administrative login, they can change the deployment; if they receive a user account, they can join the service. Distributing the first to solve the second is a common and expensive mistake. The console reaches the server through the same process that the service runs, which is why the distinction is easy to lose.
Write down which credentials belong to which role before handing anything out. A password that opens the management console is not a VPN account, and treating it as one removes the boundary you were trying to draw.
Compatible listeners add a fourth role
SoftEther can expose OpenVPN-compatible, L2TP/IPsec and SSTP listeners. Those are bridge roles: the server speaks another protocol so a client that does not support the native mode can still connect. They do not turn the client into a server or the manager into a client. Name the stack in the ticket, because the first useful question is always which of the two programs produced the error.
A device using a compatible listener needs the matching third-party client and the parameters that listener expects. That client has its own configuration, its own logs and its own failure modes, so support has to know which stack is in play before reading anything. Mixing advice from the native client into a compatible one wastes time.
Match the component to the task in one pass
You need the server when other devices connect to you, the client when this device must use an existing gateway, and the manager when you must change the gateway's configuration. Only the first two move traffic. Keep administrative credentials out of user hands when you hand out the third.
| Component | What it does | What it cannot do |
|---|---|---|
vpnserver | Terminates VPN sessions and holds hub state | Create an outgoing connection for your device |
vpnclient | Creates the virtual adapter and connects an account | Administer the server's configuration |
| Server Manager | Edits a running server's configuration | Carry your traffic or replace the client |
Then verify the result at the layer you changed, not at the layer you installed. A client is working when its adapter has an address and the intended resource answers.
A server is working when the intended listener accepts the intended account, and a manager is working when it can read the configuration without changing it by accident. Those three sentences prevent most of the confusion. The vpncmd utility is the command-line equivalent for both the server and client sides, which is handy when a graphical console is not available.