Monitoring SoftEther VPN Server with Vigilmon

SoftEther VPN is an open-source multi-protocol VPN server originally developed at the University of Tsukuba. In a single installation it supports SSL-VPN, L2TP/IPsec, OpenVPN, Microsoft SSTP, L2TPv3, EtherIP, and its own SoftEther protocol — making it one of the most flexible open-source VPN servers available. It includes a JSON-RPC 2.0 management API on HTTPS port 5555 and a GUI admin tool (SoftEther VPN Server Manager).

SoftEther's flexibility means monitoring it is more complex than a single-protocol VPN. The management API, the VPN listener ports, and the virtual hub sessions each represent distinct failure points. When a hub goes offline or the management API stops responding, connected VPN clients may drop without warning. Vigilmon lets you watch all layers of your SoftEther deployment from the outside.

What You'll Set Up

• TCP port monitor for the SoftEther VPN Server management port
• JSON-RPC 2.0 API health check using the Test() method
• TCP port monitor for VPN client connection ports
• SSL certificate expiry alerts for the management HTTPS interface
• Heartbeat monitor verifying active sessions and virtual hub status via GetServerStatus()

Prerequisites

• SoftEther VPN Server running (any platform — Windows, Linux, FreeBSD)
• Management HTTPS port accessible (default: 5555, alternately 443)
• SoftEther JSON-RPC 2.0 API accessible at https://YOUR_HOST:5555/api/
• Admin password hash for the GetServerStatus() heartbeat check
• A free Vigilmon account

Step 1: Monitor the SoftEther Admin HTTPS Port

SoftEther VPN Server listens on port 5555 (or 443) for both management connections from VPN Server Manager and direct HTTPS VPN connections. A TCP check on this port is the fastest way to verify that the VPN server process is running and accepting connections.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to TCP Port.
3. Host: YOUR_HOST_IP (or public hostname).
4. Port: 5555 (or 443 if you configured SoftEther on the standard HTTPS port).
5. Set Check interval to 2 minutes.
6. Click Save.

Add a second TCP monitor for port 443 if SoftEther is configured to accept connections on the standard HTTPS port — this is common for firewall-friendly deployments where 5555 may be blocked on corporate networks.

Step 2: Check the SoftEther JSON-RPC 2.0 Management API

SoftEther's JSON-RPC 2.0 API at /api/ supports programmatic management calls. The Test() method is an unauthenticated test that returns the server version and confirms the management API is operational — making it ideal for external health checks without needing credentials.

In Vigilmon:

1. Add Monitor → HTTP / HTTPS.
2. URL: https://YOUR_HOST:5555/api/
3. Set Method to POST.
4. Under Advanced, set Request body:

   {"jsonrpc":"2.0","id":"1","method":"Test","params":{"Int64Value":"123456"}}
   

5. Set Expected HTTP status to 200.
6. Under Advanced, add an Expected body contains check: "result".
7. Enable Allow self-signed certificates (SoftEther uses a self-signed cert by default).
8. Set Check interval to 2 minutes.
9. Click Save.

A successful Test() response looks like:

{"jsonrpc":"2.0","id":"1","result":{"Int64Value":"123456","ServerProductName":"SoftEther VPN Server","ServerVersionString":"..."}}

This confirms the SoftEther process is running, the JSON-RPC API is responding, and the management interface is intact — all in a single unauthenticated call.

Step 3: Monitor VPN Client Listener Ports

SoftEther supports VPN connections on multiple ports simultaneously. Port 443 is particularly important for SoftEther's SSL-VPN protocol because it allows VPN connections through firewalls that only permit HTTPS traffic. Port 1194 is the default for OpenVPN compatibility mode.

Add TCP monitors for each listener port you use:

Port 443 (SSL-VPN / OpenVPN over HTTPS):

1. Add Monitor → TCP Port.
2. Host: YOUR_HOST_IP.
3. Port: 443.
4. Check interval: 2 minutes.
5. Name: SoftEther SSL-VPN Port 443.

Port 1194 (OpenVPN):

1. Add Monitor → TCP Port.
2. Host: YOUR_HOST_IP.
3. Port: 1194.
4. Check interval: 2 minutes.
5. Name: SoftEther OpenVPN Port 1194.

Port 1701 (L2TP) and Port 500/4500 (IPsec/IKEv2): Add additional TCP monitors for any other listener ports your deployment uses. TCP probes on UDP-native protocols (L2TP, IPsec) test firewall reachability rather than the protocol itself — pair them with the management API heartbeat for a complete picture.

Step 4: SSL Certificate Expiry Alerts for Management HTTPS

SoftEther generates a self-signed SSL certificate for its management HTTPS interface during installation. This certificate does not auto-renew. If it expires, VPN Server Manager cannot connect to manage the server and some VPN clients will refuse to connect.

On the HTTP monitor created in Step 2:

1. Open the monitor in Vigilmon.
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 30 days (self-signed cert renewal requires manual steps — use a longer warning window).
4. Click Save.

To generate a new self-signed certificate in SoftEther, use VPN Server Manager → Server Settings → SSL Certificate → Create New Self-Signed Certificate. Plan this operation during a maintenance window as it briefly restarts the management listener.

Step 5: Heartbeat Monitor for Virtual Hub and Session Status

SoftEther's GetServerStatus() JSON-RPC method returns live server statistics including active sessions count, current VPN connections, and hub status. A scheduled heartbeat that calls this method confirms the VPN hub is online, sessions are active, and the server hasn't entered a degraded state.

Create a script on your monitoring host (or on the SoftEther server itself):

#!/bin/bash
# softether-status-check.sh
# Monitors SoftEther VPN Server via JSON-RPC 2.0 GetServerStatus()

SOFTETHER_API="https://YOUR_HOST:5555/api/"
ADMIN_PASSWORD_HASH="YOUR_PASSWORD_HASH"  # SHA-0 hash of admin password
HEARTBEAT_URL="https://vigilmon.online/api/heartbeat/YOUR_HEARTBEAT_ID"

# Test method first (unauthenticated)
test_response=$(curl -sk -w "\n%{http_code}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":"1","method":"Test","params":{"Int64Value":"1"}}' \
  "$SOFTETHER_API" --max-time 10)

http_code=$(echo "$test_response" | tail -1)
body=$(echo "$test_response" | head -n -1)

if [ "$http_code" != "200" ]; then
  echo "$(date): SoftEther API returned HTTP $http_code — not pinging heartbeat"
  exit 1
fi

# Check if Test() returned a valid result
if ! echo "$body" | grep -q '"result"'; then
  echo "$(date): SoftEther Test() returned error: $body"
  exit 1
fi

# GetServerStatus (requires admin auth)
status_response=$(curl -sk -w "\n%{http_code}" \
  -H "Content-Type: application/json" \
  -d "{\"jsonrpc\":\"2.0\",\"id\":\"2\",\"method\":\"GetServerStatus\",\"params\":{},\"auth\":{\"Password\":\"$ADMIN_PASSWORD_HASH\",\"PasswordPlainText\":false}}" \
  "$SOFTETHER_API" --max-time 10)

status_code=$(echo "$status_response" | tail -1)
status_body=$(echo "$status_response" | head -n -1)

if [ "$status_code" != "200" ]; then
  echo "$(date): GetServerStatus returned HTTP $status_code"
  # Still ping heartbeat if basic Test() succeeded — status may require hub running
  curl -s "$HEARTBEAT_URL" --max-time 10 --retry 2
  exit 0
fi

# Extract session count and log it
session_count=$(echo "$status_body" | python3 -c "
import json, sys
try:
    data = json.load(sys.stdin)
    result = data.get('result', {})
    sessions = result.get('NumSessionTotal', {}).get('Value', 'N/A')
    connections = result.get('NumTcpConnections', {}).get('Value', 'N/A')
    print(f'sessions={sessions}, tcp_connections={connections}')
except Exception as e:
    print(f'parse_error={e}')
" 2>/dev/null)

echo "$(date): SoftEther status OK — $session_count"

# Ping heartbeat
curl -s "$HEARTBEAT_URL" --max-time 10 --retry 2
echo "$(date): SoftEther heartbeat sent"

Make executable and schedule:

chmod +x /opt/scripts/softether-status-check.sh
crontab -e

*/5 * * * * /opt/scripts/softether-status-check.sh >> /var/log/softether-monitor.log 2>&1

Set up the heartbeat in Vigilmon:

1. Monitors → New Monitor → Heartbeat
2. Name: SoftEther VPN Hub Status
3. Interval: 10 minutes
4. Grace period: 5 minutes
5. Click Save and copy the heartbeat URL into the script.

The heartbeat will stop pinging if the management API becomes unreachable, Test() returns an error, or the script's HTTP call fails — giving you early warning of VPN server instability before users report dropped connections.

Step 6: Alert Channels and Notification Routing

SoftEther's multi-protocol architecture means an outage affects users on every VPN protocol simultaneously:

1. Alert Channels → Add Channel → add Slack, email, or webhook.
2. For the JSON-RPC API check and TCP port 5555, set Consecutive failures before alert to 2 — brief restarts during updates are normal.
3. For port 443 (SSL-VPN), set Consecutive failures before alert to 1 — this port is critical for firewall-traversal clients.
4. For the session status heartbeat, allow a 5-minute grace period — session counts fluctuate normally.

Summary

| Monitor | Target | What It Catches | |---|---|---| | Admin TCP port | :5555 or :443 | VPN server process down | | JSON-RPC Test() | :5555/api/ POST | Management API unresponsive | | VPN listener port | :443, :1194 | Client connection port blocked | | SSL certificate | Management HTTPS | Self-signed cert expiry | | Hub status heartbeat | GetServerStatus() | Hub offline, session count drop |

SoftEther's strength is its support for every VPN protocol imaginable. Its monitoring surface matches that breadth — management API, multiple listener ports, and virtual hub health each require separate checks. With Vigilmon covering all layers, you'll know when any part of the stack fails before users report VPN connectivity issues.

Start monitoring your SoftEther VPN server today at vigilmon.online — free, no credit card required.