VPN Client

From Ever changing code
Jump to navigation Jump to search

Forticlient - Linux

Forticlient is available for multiple platforms but official downloads do not contain anything for linux (as of Apr 2017). Therefore here below you will find linux client provided by Arubacloud

Download, install and accept a license agreement

wget -q http://kb.arubacloud.com/files/tar-gz/forticlientsslvpn_linux_4-0-2281-tar.aspx -O fortisslvpn.tgz  
tar -xzf fortisslvpn.tgz && cd forticlientsslvpn && ./helper/setup.linux.sh

wget https://apt.iteas.at/iteas/pool/main/f/forticlient-sslvpn/forticlient-sslvpn_4.4.2332-1_amd64.deb
# Install 'dpkg -i' to default location
dpkg -i forticlient-sslvpn_4.4.2332-1_amd64.deb
cd /opt/forticlient-sslvpn

# Extract 'dpkg -x'
dpkg -x forticlient-sslvpn_4.4.2332-1_amd64.deb ./fortigate #specify location
cd ./fortigate/opt/forticlient-sslvpn/64bit

Ubuntu 18.04 LTS

wget -O - https://repo.fortinet.com/repo/ubuntu/DEB-GPG-KEY | sudo apt-key add - 
#Add the following line in /etc/apt/sources.list
deb [arch=amd64] https://repo.fortinet.com/repo/ubuntu/ /bionic multiverse 
sudo apt-get update 
sudo apt install forticlient

Other sources (not recommended but working), WARN! one of these is ver. 4.0.2333 not as the download states v4.4.x

Optional: Install 32bit libraries on 64bit system to run 32bit version

Enable the i386 architecture (as root user):

sudo dpkg --add-architecture i386 && sudo apt-get update

Install 32-bit libraries (as root user):

sudo apt-get install libc6:i386 libstdc++6:i386


Press Ctrl+C, Agree Their License (1st time only) & then connect to VPN by:

$ yes | ./forticlientsslvpn_cli --server sslvpn.server.com:10443 --vpnuser a_user > /dev/null

host sslvpn.server.com #=  #remote VPNServer public IP
host laptop-1          #= #from   VPNClient pool, private IP

When connected you should see similar new entries in route, ppp0 interface and resolv.conf

$ watch -d "cat /etc/resolv.conf | grep -v \#"
nameserver   #<- new entry
nameserver   #<- new entry
options edns0

$ watch -d route -n #do not resolve dns
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    600    0        0 wlp4s0       UG    0      0        0 ppp0     U     1000   0        0 wlp4s0     UG    0      0        0 ppp0   U     600    0        0 wlp4s0 UGH   0      0        0 wlp4s0

$ watch -d route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway         UG    600    0        0 wlp4s0        laptop-1       UG    0      0        0 ppp0
link-local     U     1000   0        0 wlp4s0      laptop-1     UG    0      0        0 ppp0   U     600    0        0 wlp4s0
edge_vpn_fw     _gateway UGH   0      0        0 wlp4s0

watch -d ip address #below this is what will be added
9: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1354 qdisc fq_codel state UNKNOWN group default qlen 3
    inet peer scope global ppp0
       valid_lft forever preferred_lft forever


If you wish run with GUI you may need to install

sudo apt-get install libgtk2.0-0:i386


Error: Peer's certificate is not valid. action is 1

Disable the check

Edit forticlientsslvpn/helper/config file and set invalid_peer_cert_action=0

sed -n -E 's/^(invalid_peer_cert_action=).*$/\10/p' config    #test
sed -i -E 's/^(invalid_peer_cert_action=).*$/\10/g' config    #substitute

Upload required certificate

Your endpoint SSL certificate is not trusted by your local machine. Firstly, create trustedstore hidden directory

$ mkdir ~/.fctsslvpn_trustca

Secondly locate trusted stores on your machine and copy to Forticlient trustedstores location

$ locate cacert
$ cp /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts ~/.fctsslvpn_trustca
$ cp /opt/Citrix/ICAClient/keystore/cacerts/QuoVadis_Root_CA*   ~/.fctsslvpn_trustca

Run the connection command

$ yes | ./forticlientsslvpn_cli --server sslvpn.server.com:10443 --vpnuser a_user > /dev/null
STATUS::Setting up the tunnel
NOTICE::ing /home/a_user/.fctsslvpn_trustca
NOTICE::oVadis_Root_CA_2.crt => d7e8dc79.0
WARNING: cacerts does not contain a certificate or CRL: skipping
NOTICE::oVadis_Root_CA_3.crt => 76faf6c0.0
STATUS::Login succeed
STATUS::Starting PPPd
STATUS::Initializing tunnel
STATUS::Connecting to server
STATUS::Tunnel running

tail -f /opt/forticlient-sslvpn/64bit/helper/forticlientsslvpn.log

Error: /lib/ld-linux.so.2: bad ELF interpreter: No such file or directory

Fedora or newer Red Hat, CentOS:

sudo dnf install glibc.i686

Error: error while loading shared libraries: libstdc++.so.6

sudo dnf install linstdc++.i686

Forticlient (VPN client only) - Windows

The FortiNet.com does not provide or develop Linux client therefore the best is to use openfortigui project. But if you have to use Windows, best you can do is to download the official client and install only basic set of features, so only VPN client gets installed. Follow the steps below:

This has worked with version, downloaded in May 2018

  1. Download FortiClientOnlineInstaller.exe file, FortiClient 5.6 for Windows (Win7 or higher supported) from official website
  2. Run installer until you see "Welcome to the FortiClient Setup Wizard"
  3. The installer has downloaded .msi (image) into C:\programdata\Applications\Cache
  4. Open cli with Administration privileges and run FortiClient.msi /quiet /norestart INSTALLLEVEL=1 . Quiet is optional, don't use if you wish to see the progress and features being installed.
  5. FortiClinet application should appear on a list of installed programs
  6. Run FortiClient from Start

This is a feature set controlled by MSI, INSTALLLEVEL switch

Feature Name                  Install level
Feature_Core                  1
Feature_Basic                 1
Feature_AntiVirus             5
Feature_WebFilter             5
Feature_VPN                   3
Feature_SSLVPN                1
Feature_WanAcceleration       5
Feature_EndPointNAC           3
Feature_Firewall              5
Feature_Vulnerability         5
Feature_SingleSignOnMobility  3

The default install level when running msiexec is 100, which means all features are installed. If you do install software to modify the default install level of the Features in the .MSI file, you could then create custom installers by adjusting the install level of unwanted features above a threshold.


Fortinet client for PPP+SSL VPN tunnel services. openfortivpn is a client for PPP+SSL VPN tunnel services. It spawns a pppd process and operates the communication between the gateway and this process. It is compatible with Fortinet VPNs.

# All commands below run on Ubuntu 18.04

$ apt-cache madison openfortivpn 
openfortivpn | 1.6.0-1build1 | http://gb.archive.ubuntu.com/ubuntu bionic/universe amd64 Packages

# https://packages.ubuntu.com/eoan/amd64/openfortivpn/download #latest Ubuntu version
wget http://es.archive.ubuntu.com/ubuntu/pool/universe/o/openfortivpn/openfortivpn_1.10.0-1_amd64.deb

# install
sudo dpkg -i openfortivpn_1.10.0-1_amd64.deb

$ which openfortivpn 

# shows where files are installed
dpkg -x openfortivpn_1.10.0-1_amd64.deb root ; tree $_ ; rm -rf $_
├── etc
│   └── openfortivpn
│       └── config
└── usr
    ├── bin
    │   └── openfortivpn
    └── share
        ├── doc
        │   └── openfortivpn
        │       ├── changelog.Debian.gz
        │       ├── copyright
        │       └── README.md.gz
        ├── man
        │   └── man1
        │       └── openfortivpn.1.gz
        └── openfortivpn
            └── config.template


sudo vi /etc/openfortivpn/config
# config file for openfortivpn, see man openfortivpn(1)
host =
port = 39953
username = user1
#password =
trusted-cert = 6c6*****fa8a58

$ sudo openfortivpn
VPN account password: ***
INFO:   Connected to gateway.
INFO:   Authenticated.
INFO:   Remote gateway has allocated a VPN.
Using interface ppp0
Connect: ppp0 <--> /dev/pts/10
INFO:   Got addresses: [], ns [,]
INFO:   negotiation complete
INFO:   Got addresses: [], ns [,]
INFO:   negotiation complete
INFO:   negotiation complete
local  IP address   #<-- pppd interface assigned with VPNClient IP from pool
remote IP address
primary   DNS address
secondary DNS address
INFO:   Interface ppp0 is UP.
INFO:   Setting new routes...
WARN:   Route to vpn server exists already.
INFO:   Adding VPN nameservers...
INFO:   Tunnel is up and running.

^CINFO:   Cancelling threads...  #<-- Stop tunnel Ctrl^C
INFO:   Setting ppp interface down.
INFO:   Restoring routes...
INFO:   Removing VPN nameservers...
Hangup (SIGHUP)
Modem hangup
Connect time 0.2 minutes.
Sent 2573 bytes, received 4943 bytes.
Connection terminated.
INFO:   pppd: The link was terminated by the modem hanging up.
INFO:   Terminated pppd.
INFO:   Closed connection to gateway.
INFO:   Logged out.


OpenFortiGUI v0.8.1 contains openfortivpn core v1.10.0, so all is good.


lsb_release -c # get Ubuntu conde name, link below is for Ubuntu 18.04
wget https://apt.iteas.at/iteas/pool/main/o/openfortigui/openfortigui_0.8.1-1_amd64_bionic.deb

# Package content
dpkg -x openfortigui_0.8.1-1_amd64_bionic.deb root ; tree $_ ; rm -rf $_
├── etc
│   └── sudoers.d
│       └── openfortigui
└── usr
    ├── bin
    │   └── openfortigui
    └── share
        ├── applications
        │   └── openfortigui.desktop
        ├── doc
        │   └── openfortigui
        │       ├── changelog.Debian.gz
        │       └── copyright
        ├── pixmaps
        │   └── openfortigui.png
        └── polkit-1
            └── actions
11 directories, 6 files

# Install and possible dependencies issues
sudo dpkg -i openfortigui_0.8.1-1_amd64_bionic.deb 

# Open from Dash/Start applet

Known issues

Issue with openfortigui_0.8.0-1_amd64_bionic.deb version

dpkg: dependency problems prevent configuration of openfortigui:
 openfortigui depends on libqt5keychain1 (>= 0.7.0); however:
  Package libqt5keychain1 is not installed.

# Fix dependencies
apt --fix-broken install

Logs and troubleshooting

openfortigui logs (debug on)
~/.openfortigui/logs/openfortigui.log ~/.openfortigui/logs/vpn/<profile>.log /var/log/openfortigui.log (custom logs)
tail -f ~/.openfortigui/logs/openfortigui.log 
Aug 7 00:02:25 openfortiGUI::Debug: 1565132545338 bytes avail:: 38
Aug 7 00:02:27 openfortiGUI::Debug: 1565132547941 bytes avail:: 75
Aug 7 00:02:31 openfortiGUI::Debug: 1565132551545 bytes avail:: 76
Aug 7 00:02:31 openfortiGUI::Debug: 1565132551746 bytes avail:: 76
Aug 7 00:02:32 openfortiGUI::Debug: 1565132552785 bytes avail:: 37
tail -f ~/.openfortigui/logs/vpn/ppawl.log 
DEBUG:  pppd ---> gateway (88 bytes)
DEBUG:  pppd ---> gateway (88 bytes)
DEBUG:  gateway ---> pppd (255 bytes)
DEBUG:  gateway ---> pppd (443 bytes)
DEBUG:  pppd ---> gateway (88 bytes)
DEBUG:  gateway ---> pppd (443 bytes)
DEBUG:  pppd ---> gateway (78 bytes)
DEBUG:  gateway ---> pppd (142 bytes)
DEBUG:  pppd ---> gateway (98 bytes)
tail -f /var/log/openfortigui.log 
rcvd [IPCP ConfReq id=0x66 <addrs>] #server, clientIP
sent [IPCP ConfRej id=0x66 <addrs>]
rcvd [IPCP ConfReq id=0x67]
sent [IPCP ConfAck id=0x67]
local  IP address
remote IP address
primary   DNS address
secondary DNS address
Script /etc/ppp/ip-up started (pid 27495)
Script /etc/ppp/ip-up finished (pid 27495), status = 0x0