The SoftEther client in Docker connects to the server successfully using an IPv4 address, but when using an IPv6 address, it keeps retrying.

[qibao07]

docker run -d --restart unless-stopped --name softether-vpn-client \
  -v /etc/localtime:/etc/localtime:ro \
  -v /etc/timezone:/etc/timezone:ro \
  -v softether-client-data:/var/lib/softether \
  --cap-add NET_ADMIN \
  --device /dev/net/tun:/dev/net/tun \
  --net host \
  softethervpn/vpnclient

AccountDisconnect vpn
AccountDelete vpn
NicDelete vpn
NicCreate vpn
AccountCreate vpn /SERVER:v6.test.top:57713 /HUB:vpn /USERNAME:rpi-03 /NICNAME:vpn
AccountPasswordSet vpn /PASSWORD:*** /TYPE:standard
AccountStartupSet vpn
AccountConnect vpn

v6.test.top maps to an IPv6 address, while v4.test.top maps to an IPv4 address.

When I install SoftEther Client via apt, both IPv4 and IPv6 connections work fine. However, when running SoftEther Client in Docker, only IPv4 works. When using IPv6, the logs show that authentication succeeds, but the TCP connection cannot be established and keeps retrying.

Client log

2025-10-09 11:40:20.552 VPN Connection Setting "vpn": Connection operation starting (this is now 2 times).
2025-10-09 11:40:20.622 VPN Connection Setting "vpn": SSL communication has been started. The protocol version is TLSv1.3. The encryption algorithm name is "TLS_AES_256_GCM_SHA384".
2025-10-09 11:40:20.622 VPN Connection Setting "vpn": Now connected. Session name: "SID-RPI-03-1012"
2025-10-09 11:40:20.753 VPN Connection Setting "vpn": The connection has been either disconnected or it failed. Cause: Connection has been disconnected. (code 3)
2025-10-09 11:40:35.756 VPN Connection Setting "vpn": Connection operation starting (this is now 2 times).
2025-10-09 11:40:35.816 VPN Connection Setting "vpn": SSL communication has been started. The protocol version is TLSv1.3. The encryption algorithm name is "TLS_AES_256_GCM_SHA384".
2025-10-09 11:40:35.826 VPN Connection Setting "vpn": Now connected. Session name: "SID-RPI-03-1013"
2025-10-09 11:40:35.927 VPN Connection Setting "vpn": The connection has been either disconnected or it failed. Cause: Connection has been disconnected. (code 3)
2025-10-09 11:40:50.930 VPN Connection Setting "vpn": Connection operation starting (this is now 2 times).
2025-10-09 11:40:50.990 VPN Connection Setting "vpn": SSL communication has been started. The protocol version is TLSv1.3. The encryption algorithm name is "TLS_AES_256_GCM_SHA384".
2025-10-09 11:40:51.000 VPN Connection Setting "vpn": Now connected. Session name: "SID-RPI-03-1014"
2025-10-09 11:40:51.101 VPN Connection Setting "vpn": The connection has been either disconnected or it failed. Cause: Connection has been disconnected. (code 3)

Server log

2025-10-09 10:54:45.785 [HUB "VPN"] The connection "CID-56302" (IP address: 172.17.0.1, Host name: UBUNTU, Port number: 43384, Client name: "SoftEther VPN Client Developer Edition", Version: 5.02, Build: 5187) is attempting to connect to the Virtual Hub. The auth type provided is "Password authentication" and the user name is "rpi-03".
2025-10-09 10:54:45.785 [HUB "VPN"] Connection "CID-56302": Successfully authenticated as user "rpi-03".
2025-10-09 10:54:45.785 [HUB "VPN"] Connection "CID-56302": The new session "SID-RPI-03-945" has been created. (IP address: 172.17.0.1, Port number: 43384, Physical underlying protocol: "Standard TCP/IP (IPv4)")
2025-10-09 10:54:45.785 [HUB "VPN"] Session "SID-RPI-03-945": The parameter has been set. Max number of TCP connections: 2, Use of encryption: Yes, Use of compression: No, Use of Half duplex communication: No, Timeout: 20 seconds.
2025-10-09 10:54:45.785 [HUB "VPN"] Session "SID-RPI-03-945": VPN Client details: (Client product name: "SoftEther VPN Client Developer Edition", Client version: 502, Client build number: 5187, Server product name: "SoftEther VPN Server (64 bit) (Open Source)", Server version: 441, Server build number: 9787, Client OS name: "Alpine Linux", Client OS version: "6.12.47+rpt-rpi-2712", Client product ID: "--", Client host name: "rpi-03", Client IP address: "240e:3b5:xxx:xxx:3795:5739:xxx:8fba", Client port number: 35930, Server host name: "v6.test.top", Server IP address: "240e:3b5:xxx:xxx:caff:bfff:xxx:b80", Server port number: 57713, Proxy host name: "", Proxy IP address: "0.0.0.0", Proxy port number: 0, Virtual Hub name: "vpn", Client unique ID: "B95C6D1997A0CDAD4CEFFA8ADB106555")
2025-10-09 10:54:50.872 [HUB "VPN"] Session "SID-RPI-03-944": The session has been terminated. The statistical information is as follows: Total outgoing data size: 0 bytes, Total incoming data size: 0 bytes.
2025-10-09 10:54:50.893 Connection "CID-56301" terminated by the cause "The VPN session has been deleted. It is possible that either the administrator disconnected the session or the connection from the client to the VPN Server has been disconnected." (code 11).
2025-10-09 10:54:50.893 Connection "CID-56301" has been terminated.
2025-10-09 10:54:50.893 The connection with the client (IP address 172.17.0.1, Port number 49326) has been disconnected.
2025-10-09 10:55:00.896 On the TCP Listener (Port 443), a Client (IP address 172.17.0.1, Host name "UBUNTU", Port number 52432) has connected.

[qibao07]

I compiled and packaged version 5.2.5188 myself on Ubuntu and encountered the same issue, but version 5.01.9674 works fine for IPv6 connections.

Version: 5.2.5188

FROM ubuntu:24.04

WORKDIR /

RUN sed -i 's@//ports.ubuntu.com@//mirrors.ustc.edu.cn@g' /etc/apt/sources.list.d/ubuntu.sources \
  && apt update

RUN apt -y install cmake gcc g++ make pkgconf libncurses5-dev libssl-dev libsodium-dev libreadline-dev zlib1g-dev git

RUN git clone -b 5.2.5188 --depth 1 https://gitea.chenweiwen.top:57443/github-mirror/SoftEtherVPN.git

RUN cd SoftEtherVPN \ 
  && git config --global http.proxy http://192.168.50.252:57223 \
  && git config --global https.proxy http://192.168.50.252:57223 \
  && git submodule init && git submodule update \
  && ./configure \
  && make -C build \
  && make -C build install

RUN pwd

RUN cp /SoftEtherVPN/build/vpncmd /usr/local/bin/ \
  && cp /SoftEtherVPN/build/hamcore.se2 /usr/local/bin/ \
  && cp /SoftEtherVPN/build/libcedar.so /usr/local/lib/ \
  && cp /SoftEtherVPN/build/libmayaqua.so /usr/local/lib \
  && cp /SoftEtherVPN/build/vpnclient /usr/local/bin/ \
  && cp /SoftEtherVPN/build/vpnserver /usr/local/bin/ \
  && cp /SoftEtherVPN/build/vpnbridge /usr/local/bin/

CMD ["/usr/local/bin/vpnclient", "execsvc"]

Version: 5.01.9674

FROM ubuntu:24.04

WORKDIR /

RUN sed -i 's@//ports.ubuntu.com@//mirrors.ustc.edu.cn@g' /etc/apt/sources.list.d/ubuntu.sources \
  && apt update

RUN apt -y install cmake gcc g++ make pkgconf libncurses5-dev libssl-dev libsodium-dev libreadline-dev zlib1g-dev git

RUN git clone -b 5.01.9674 --depth 1 https://gitea.chenweiwen.top:57443/github-mirror/SoftEtherVPN.git

RUN cd SoftEtherVPN \ 
  && git config --global http.proxy http://192.168.50.252:57223 \
  && git config --global https.proxy http://192.168.50.252:57223 \
  && git submodule init && git submodule update \
  && ./configure \
  && make -C tmp \
  && make -C tmp install

RUN pwd

RUN cp /SoftEtherVPN/build/vpncmd /usr/local/bin/ \
  && cp /SoftEtherVPN/build/hamcore.se2 /usr/local/bin/ \
  && cp /SoftEtherVPN/build/libcedar.so /usr/local/lib/ \
  && cp /SoftEtherVPN/build/libmayaqua.so /usr/local/lib \
  && cp /SoftEtherVPN/build/vpnclient /usr/local/bin/ \
  && cp /SoftEtherVPN/build/vpnserver /usr/local/bin/ \
  && cp /SoftEtherVPN/build/vpnbridge /usr/local/bin/

CMD ["/usr/local/bin/vpnclient", "execsvc"]

[qibao07]

The server is using softethervpn/vpnserver:stable.

[qibao07]

As a client, version 5.2.5188 has issues connecting over IPv6, while version 5.01.9674 experiences network instability and keeps failing to reconnect.

Currently, I have packaged the SoftEtherVPN_Stable v4.44-9807-rtm version myself, and neither of these issues occur on it.

[weidi]

You mean v4.44 in docker can make use of ipv6 where others don´t?
To be hones i never used v6 as in that configuration and docker networking itself is v4 per default this might lead to an issue as well.

[qibao07]

Both v4.44 and 5.01.9674 can connect to the server via IPv6. However, version 5.01.9674 has an issue where it occasionally disconnects and fails to reconnect. Version 5.2.5188 seems to have fixed the reconnection issue, but it cannot connect to the client over IPv6. The client is using --net host, which should normally support IPv6 easily.

[chipitsine]

we didn't introduce any ipv6 related change between 5.01.9674 and 5.2.5188

however, if talking about docker, that change may have arrived with alpine image.

can you verify that behaviour without docker ?

[qibao07]

I don’t want to compile on a physical machine; I’ve only tried version 5.01.9674 provided by the Debian repository.

I’m using Ubuntu as the base image to build version 5.2.5188, and no matter whether it’s the official image or one I built myself, IPv6 cannot connect to the server. Therefore, I believe there’s something in the code affecting IPv6 connections.

Also, according to the logs, authentication succeeds, but the TCP connection never completes.
When I use Ubuntu as the base image to build version 4.44, it works perfectly.

Version 5.01.9674 has disconnections and reconnects, with TCP failing to establish; version 5.2.5188 fixes the reconnect issue, but IPv6 cannot establish a TCP connection at all. It seems somewhat related.

[qibao07]

In summary, using the same base image and the same version of Ubuntu, I compiled three versions of SoftEther Client: 4.44, 5.01.9674, and 5.2.5188. Only 4.44 showed no issues. Both 4.44 and 5.01.9674 can connect to the server over IPv6, but 5.2.5188 cannot—regardless of whether it’s the official package or a self-built image. Therefore, we can almost rule out any impact from running in Docker or from the base image.

[chipitsine]

ok, those repro steps are good as well

do you mind bisecting? If possible, I would try to build fir every commit between releases and try

what comes to mind is enabling OQS (post quantum) for OpenSSL. can you try current master with iqs disabled?

OQS was added between mentioned releases

[chipitsine]

@weidi what fo you think, shall we maybe build default image without oqs and introduce a tag for oqs

[qibao07]

what comes to mind is enabling OQS (post quantum) for OpenSSL. can you try current master with iqs disabled?

I’m not really sure how to do that.

Are you saying you’ll build a temporary version of softethervpn/vpnclient for me to try? I’d be happy to do that.

[weidi]

Let's build a test image with -noOQS an if this really solves it we can think of making noOQS an additional tag> @weidi what fo you think, shall we maybe build default image without oqs and introduce a tag for oqs

[chipitsine]

@qibao07 please hold for a while. we'll prepare image for testing

[chipitsine]

@qibao07 sorry for the delay.

I prepared two docker images

chipitsine/vpnclient:oqs - should be identical to the most recent 5.X build

chipitsine/vpnclient:nooqs - same, but without OQS (which we suspect may be the reason of this issue)

can you please run your tests on them ?

[qibao07]

chipitsine/vpnclient:nooqs doesn’t work; it seems unrelated to OQS.