openfortivpn

TLDR

Connect to a VPN with a username and password

$ openfortivpn -u [username] -p [password]

Connect to a VPN using a specific configuration file

$ sudo openfortivpn -c [path/to/config]

Connect by specifying the host and port

$ openfortivpn [host]:[port]

Trust a gateway by its certificate SHA256 sum

$ openfortivpn --trusted-cert [sha256_sum]

SYNOPSIS

openfortivpn [host:port] [-u user] [-p pass] [-c config] [options]

openfortivpn is an open-source VPN client for Fortinet's proprietary PPP+TLS VPN solution, commonly known as FortiClient SSL VPN. It establishes a secure tunnel using PPP over TLS/SSL to connect to FortiGate appliances and FortiClient VPN servers.
The client handles authentication (including two-factor), certificate verification, and route configuration. It creates a PPP interface for the VPN connection and can manage routing to direct traffic through the VPN tunnel.

PARAMETERS

-c, --config=file

Configuration file (default: /etc/openfortivpn/config)

-u, --username=user

VPN account username

-p, --password=pass

VPN account password

--trusted-cert=sha256

Trust gateway certificate with this SHA256 fingerprint

--realm=realm

Specify authentication realm

-o, --otp=otp

One-time password for two-factor authentication

--otp-prompt=prompt

Search for OTP prompt string

--otp-delay=delay

Delay in seconds before sending OTP

--no-routes

Do not add VPN routes to routing table

--half-internet-routes

Add two /1 routes instead of default route

--pppd-log=file

Log file for pppd

-v, --verbose

Increase verbosity (use multiple times)

--pppd-ifname=name

Set ppp interface name

CAVEATS

Requires root privileges to create network interfaces and modify routing tables. Password provided on command line may be visible in process listings; prefer configuration file for credentials. Some Fortinet servers may require specific trusted certificate fingerprints or realm settings.

HISTORY

Created as an open-source alternative to the proprietary FortiClient for Linux. Developed to provide command-line VPN connectivity for FortiGate SSL VPN servers, which are widely used in enterprise environments. The project emerged from the need for a lightweight, scriptable VPN client compatible with Fortinet infrastructure.