openfortivpn

open-source VPN client for Fortinet's proprietary PPP+TLS VPN

TLDR

Connect to a VPN with a username and password

$ openfortivpn -u [username] -p [password]

Connect to a VPN using a specific configuration file

$ sudo openfortivpn -c [path/to/config]

Connect by specifying the host and port

$ openfortivpn [host]:[port]

Trust a gateway by its certificate SHA256 sum

$ openfortivpn --trusted-cert [sha256_sum]

SYNOPSIS

openfortivpn [host:port] [-u user] [-p pass] [-c config] [options]

openfortivpn is an open-source VPN client for Fortinet's proprietary PPP+TLS VPN solution, commonly known as FortiClient SSL VPN. It establishes a secure tunnel using PPP over TLS/SSL to connect to FortiGate appliances and FortiClient VPN servers.The client handles authentication (including two-factor), certificate verification, and route configuration. It creates a PPP interface for the VPN connection and can manage routing to direct traffic through the VPN tunnel.

PARAMETERS

-c, --config=file

Configuration file (default: /etc/openfortivpn/config)

-u, --username=user

VPN account username

-p, --password=pass

VPN account password

--trusted-cert=sha256

Trust gateway certificate with this SHA256 fingerprint

--user-cert=file

Client certificate file for authentication

--user-key=file

Client private key file

--realm=realm

Specify authentication realm

-o, --otp=otp

One-time password for two-factor authentication

--otp-prompt=prompt

Search for OTP prompt string

--otp-delay=delay

Delay in seconds before sending OTP

--saml-login[=port]

Use SAML/SSO authentication

--pinentry=program

Use a pinentry program for password entry

--persistent=seconds

Reconnect after the specified delay on disconnect

--no-routes

Do not add VPN routes to routing table

--half-internet-routes

Add two /1 routes instead of default route

--set-routes=bool

Configure routes (0 to disable)

--set-dns=bool

Configure DNS (0 to disable)

--pppd-log=file

Log file for pppd

--pppd-ifname=name

Set ppp interface name

--pppd-use-peerdns=bool

Use DNS servers provided by the peer

--user-agent=string

Set custom HTTP User-Agent

-v, --verbose

Increase verbosity (use multiple times)

-q, --quiet

Decrease verbosity

CAVEATS

Requires root privileges to create network interfaces and modify routing tables. Password provided on command line may be visible in process listings; prefer configuration file for credentials. Some Fortinet servers may require specific trusted certificate fingerprints or realm settings.

HISTORY

Created as an open-source alternative to the proprietary FortiClient for Linux. Developed to provide command-line VPN connectivity for FortiGate SSL VPN servers, which are widely used in enterprise environments. The project emerged from the need for a lightweight, scriptable VPN client compatible with Fortinet infrastructure.