OpenFortiGUI


OpenFortiGUI is an open-source VPN-Client to connect to Fortigate VPN-Hardware. It is based on openfortivpn and adds an easy to use and nice GUI on top of it, written in Qt5.

Unlike other VPN-clients it is also possible to connect to multiple VPN-destinations  simultaneously. It is an replacement for the closed-source Forticlient – SSLVPN Client.

 

Features include:

  • Qt5 GUI
  • openfortivpn library built-in, no separate download required
  • All settings saved in text-files, so easy to share, passwords saved AES-encrypted (key can be defined as needed, GNOME keyring & KWallet support)
  • VPNs divided into local and global sections (readonly, useful for deployments to many users)
  • VPN-groups can be defined to start groups of VPNs at the same time
  • Trayicon with fast access to start/stop VPNs and groups
  • Multiple VPN connections possible simultaneously
  • Certificate and user/password auth supported
  • 2Factor support
  • Autostart VPNs on program startup
  • English, german, catalan (thanks wagafo@github) and japanese (thanks tsundeoku@github) language
  • Optional: KRunner Plugin for KDE5

Source: https://github.com/theinvisible/openfortigui

Prebuild packages are available for following Distros:

Ubuntu 18.04 (last Update 13.9.2018):

OpenFortiGUI 0.7.1 64bit

Ubuntu 16.04 (last Update 13.9.2018): 

Info: Since version OpenFortiGUI 0.5.0 there is libqt5keychain1 >=0.7.0 required which is not included in default Ubuntu distro, best you use our Apt mirror

OpenFortiGUI 0.7.1 32bit
OpenFortiGUI 0.7.1 64bit

Debian 9 (last Update 13.9.2018):

OpenFortiGUI 0.7.1 64bit

You can also use our apt mirror, for instructions see: https://apt.iteas.at/

Available packages on our apt mirror: openfortigui and openfortigui-runner

Quick instruction to build from source:

  1. Install DEV-tools (on Ubuntu: build-essential, qt5-default, libssl-dev, qt5keychain-dev)
  2. git clone https://github.com/theinvisible/openfortigui.git
  3. cd openfortigui && git submodule init && git submodule update
  4. qmake && make -j4
  5. openfortigui binary is ready

Debugging

If you want to help debugging please follow the next steps to produce a debug binary.

  1. Install DEV-tools (on Ubuntu: build-essential, qt5-default, libssl-dev, qt5keychain-dev)
  2. git clone https://github.com/theinvisible/openfortigui.git
  3. cd openfortigui && git submodule init && git submodule update
  4. qmake openfortigui-project.pro -spec linux-g++ CONFIG+=debug CONFIG+=qml_debug && /usr/bin/make -j4
  5. openfortigui debug binary is ready

OpenFortiGUI spawns new processes for every VPN connection profile.

You can also start a VPN connection on terminal and so use gdb. For example: sudo /usr/bin/openfortigui –start-vpn –vpn-name [yourvpnname] –main-config ‘/home/[yourusername]/.openfortigui/main.conf’

Just replace [yourvpnname] with your vpn profile name and [yourusername] with your Linux username.

Used software/libraries/resources:

97 thoughts on “OpenFortiGUI

  1. nalbyuites

    Thank you for the hard work! openfortiGUI 0.2.10-dev is working fine for me on Solus OS.

    Reply
    1. Adam

      Hi, I’m happy to see a Solus user that was able to get this working.
      I tried running the complie/make steps on this page, but it failed at qmake. Saying no such package.
      I tried installing it with sudo eopkg install qmake but that also didn’t work.

      Any suggestions? Thanks.

      Reply
  2. Christian

    Working great for me on KDE Neon. One wish, an option to close/minimize to system tray. Otherwise, just perect! Thank you so much!

    Reply
  3. Christian

    After having used it for some time I have found that it doesn’t close the process when I close the application, so I will have to kill it manually before I am able to open it again. That would be good to have fixed.

    Reply
      1. Patrick D

        Hi,

        great tool, thanks a lot for your work. I noticed the same way out issue : when I close the window application, process still runs in background, so I cannot relaunch it.
        Using the linux version for debian LTS 16.04.

        Reply
  4. Sven

    We have 2FA and the GUI version does not support that yet, something you will implement?
    Thanks in advance!

    Reply
    1. Ti Post author

      You are right, this is not implemented right now. I am working on this, but its quite hard to “hook” into the existing openfortivpn code without changing too much code. But stay tuned, updates will come.

      Reply
  5. b.f.

    Hi,
    thanks for great app. I’ve found one problem – after Disconnect it does not delete added route (if configured in Options tab -> “Set routes”).

    Reply
  6. Eric S. Smith

    Speaking of features that might be hard to implement, there doesn’t seem to be support for HTTP proxies as in forticlientsslvpn’s “Global settings”.

    Reply
  7. luis amaya

    openfortigui its an incredible software, just need some fixes. As they already commented you , it doesnt delete added routes when the quitting connection is established by the VPN.
    Thank you !!! cheers

    Reply
  8. fprietog

    It works for my work connection with a lil problem.

    Using “FortiClient SSLVPN 4.0.2333”, after negotiation three lines were added to my resolv.conf file:

    search spaced.dsd
    nameserver 10.71.xxx.xxx
    nameserver 10.71.xxx.xxx

    Using “openFortiGUI 0.2.10-dev” only the nameserver lines are added to resolv.conf, lacks the search line:

    nameserver 10.71.xxx.xxx
    nameserver 10.71.xxx.xxx

    So connection works but I need to apply the spaced.dsd suffix manually to machine names/intranet links. Not so handy 🙁

    Thanks and best regards.

    Reply
  9. Stanton

    How Can I share this Connection?

    i’ll do:
    echo “1” | sudo tee /proc/sys/net/ipv4/ip_forward

    sudo iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
    sudo iptables -A FORWARD -o ppp0 -i eth0 -m conntrack –ctstate NEW -j ACCEPT
    sudo iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -o eth0 -j MASQUERADE

    but dont working 🙁

    Reply
  10. netikras

    Really appreciate your effort! I really do. However I’ll stick with the CLI version.

    Firstly, because it’s cli 🙂 Yes, gui is a very nice eyecandy and it can store passwords as well so I’m a single click away, but… It’s a GUI. So SSH is a no-go for this version.

    Secondly, because either it still needs some polishing or I do not get how it should behave. I created a connection, hit on Connect and it turned green. A second later it became red and since then I can no longer make it green (connect) again. Logs are not filling any more either

    INFO: Connected to gateway.
    INFO: Authenticated.
    INFO: Remote gateway has allocated a VPN.
    INFO: Custom: XXXXX.XXXXXX.XX.
    INFO: Got addresses: [XX.XX.XX.XX], ns [0.0.0.0, 0.0.0.0]
    INFO: Interface ppp0 is UP.
    INFO: Tunnel is up and running.
    INFO: Cancelling threads…
    INFO: Connected to gateway.
    ERROR: Could not authenticate to gateway (No cookie given).
    INFO: Closed connection to gateway.
    INFO: Logged out.

    So I’ll just stick with CLI 🙂

    Reply
    1. Ti Post author

      Thanks for your feedback.

      Yes, OpenFortiGUI is designed for GUI but can also be used in CLI. For example: openfortigui –start-vpn –vpn-name your-vpn-profile –main-config ‘/path/to/main.conf’

      The only downside is that it still needs the QT-libraries. So on a remote server its still best to stick with openfortivpn.

      Concerning your problem: This is weird, its already connected but aborts the connection later on. What features are you using with your vpn (certs, otp). Is there any log on your Fortigate? Have you tried openfortivpn to validate the problem?

      Thanks.

      Reply
      1. Turcol

        Thanks for the information about the CLI. When I tried to run it on amd64 it give the error Segmentation fault (core dumped)

        The command was run like this (the post ^^ is missing the double –) :
        openfortigui –-start-vpn –-vpn-name your-vpn-profile –-main-config ‘/path/to/main.conf’

        Any thoughts about what can be happening (the conf file works properly from the GUI)?

        Thanks

        Reply
        1. hirnukuono

          run strace and keep an eye on those file not founds.

          in my case an abort core dumped – situation resolved when i apt install –reinstalled two xinerama related packages. ubuntu 18.04.1.

          Reply
  11. jorge

    netikras: the same happened to me. I selected the connection and click on disconnect again even if it was disconnected. After that I was able to connect again.

    Reply
  12. jelle

    Hi

    I realy like your official forticlient deb packages. I tried this GUI and it looks great but i cant get it to work.
    both the endpoints I’m connecting to are plain ip’s no dns names and no reverse lookup zones.
    they wont connect and all I find in the log is the following
    ERROR: gethostbyname: Unknown host
    INFO: Closed connection to gateway.
    ERROR: connect: Connection refused
    INFO: Could not log out.

    Reply
    1. Ti Post author

      Hello, this sounds like something is wrong with your VPN-Server name. Maybe there are Whitespace-chars included or other special chars. Have you checked your vpn-profile in text-mode? They are located in ~/.openfortigui/vpnprofiles. Try to open your profile with a text-editor and check the chars.

      Reply
      1. OnkelPony

        Thank you very much for your application. I had same problems as jelle (I used czech letter č (c with caron) in VPN server name. After I had removed it, everything worked.

        Reply
  13. Pingback: Acesso remoto – VPN | Monolito Nimbus

  14. Nicolas

    Work perfectly to replace Forticlient SSL-VPN 4.0.2333.
    I’ve just needed to check “Set routes” to work with my connection settings.

    Thanks a lot!

    Reply
  15. Pingback: Connecting SSL VPN FortiGate using Fedora 24 | >> IT UnderStandings <<

  16. rob

    I’m having an issue where I can connect and get a tunnel running to the Fortigate, however, when I start an rsync, it connects via ssh to a machine behind the fortigate fine, but after a couple of minutes the VPN disconnects. In the logs I get a

    ERROR: read: Input/output error
    INFO: Cancelling threads..”.

    Ironically, If I just leave the VPN connected, it is fine, if I ssh to the same box it is fine. It only happens when trying to run an rysnc over the VPN when I run into the problem. Also I can VPN/Rsync fine from a windows 10 machine.

    Any and all help appreciated.

    Reply
    1. Ti Post author

      Hi,

      there were segfaults on older versions but this seems to be a problem with the vpn core itself.

      Please try out the latest version (now 0.3.4) as it also includes updates on the openfortivpn core.

      Reply
  17. Marcos

    I’m running it on a debian 9. The application seems to work until i try to connect to the VPN. It does nothing. And when I try to see the logs of the VPN, the log files aren’t there.
    Also I ran the app within a terminal to see if I can get any additional info but it doesn’t write anything to the terminal output.
    Tahnk you.

    Reply
    1. Marcos

      I learned to set the app in Debug mode and it was possible to capture the app log when trying to connect to the VPN.

      Oct 5 17:05:29 openfortiGUI::Debug: action vpn pressed:: “vpn_name”
      Oct 5 17:05:29 openfortiGUI::Debug: start vpn: “vpn_name” active-tab:: 0
      Oct 5 17:05:29 openfortiGUI::Debug: Start vpn:: “vpn_name”
      Oct 5 17:05:29 openfortiGUI::Debug: add logger “/home/user/.openfortigui/main.conf”
      Oct 5 17:05:29 openfortiGUI::Debug: vpnManager::onClientConnected()
      Oct 5 17:05:29 openfortiGUI::Debug: client api helo command:: 0 ::name:: “vpn_name”
      Oct 5 17:05:29 openfortiGUI::Debug: client disconnected:: “vpn_name”
      Oct 5 17:05:29 openfortiGUI::Debug: vpnManager::onClientVPNStatusChanged() “vpn_name” status 0
      Oct 5 17:05:29 openfortiGUI::Debug: MainWindow::onClientVPNStatusChanged:: “vpn_name” ::status:: 0

      Thanks.

      Reply
      1. Ti Post author

        Hi,

        this log output is not really useful.

        Please provide the vpn log file, just right click on your VPN and “Logs”. Also enable “Debug” log in your VPN setting, thanks.

        Reply
        1. simpe

          I have the same problem on Debian 9, the program seems to do nothing. The logs associated to single VPN connections are empty, even after pressing the connect button: it appears the program doesn’t even attempt to connect!

          Reply
  18. hhllss

    Hi,

    I think that it is a perfect program that helps me work just every day. Just, I just would like to have double click on a line fire the connection not the edition of a vpn. In the same idea, enter should fire a connection. But out of those small asks (no ETA in there, just suggestions), just perfect.

    Thank you very much for you work.

    hhllss

    Reply
  19. Marcelo Gomes

    Hi,

    I’m using the GUI smoothly, thanks for developing and sharing with the community!

    Nonetheless, I’m having trouble adding the apt mirror to my machine (Ubuntu 16.04). I’m getting an error while trying to add the key
    gpgkeys: key 2FAB19E7CCB7F415 can’t be retrieved

    Any suggestions?
    Cheers!

    Reply
    1. Ti Post author

      Hi,

      maybe keyserver.ubuntu.com is blocked on your network? Should be working fine.

      Cheers Rene

      Reply
  20. Edward Chew

    I had 3 strange issue here in kubuntu 17.10

    1. I can connect through IP address but not the hostname
    2. WIFI cannot used after disconnect from VPN. Need manually disconnect an reconnect the wifi again
    3. There is a “question” mark in the WIFI icon after successful the VPN connected

    Thank you

    Reply
    1. Ti Post author

      Hi,

      openFortiGUI is using the system dns resolution. So if its working on cmd it should work also in openFortiGUI.

      But i have to admit that i didnt really tested it on non LTS releases.

      Cheers Rene

      Reply
  21. Toomas

    Hi,

    I have the same problem on ubuntu 17.10, that VPN server name doesn’t resolve. If I use IP instead of VPN server name, then everything works fine.
    Otherwise great job 🙂

    Cheers 🙂

    Reply
    1. Ti Post author

      IPSec is a completely different technology. See strongSwan or similiar. Cheers Rene

      Reply
  22. Poomerang

    Hi!!

    The first time I tried to connect to my work’s VPN, I received a notice from my IT department that I generated 70k requests to the file server, which falled.
    I’ve been asked to use the official client, though it’s not clear whether OpenFortiGUI was the problem or not (I was accessing remote folders and remote desktop connection). I saved the log of the connection and I had the debug mode ON: I see nothing weird, a lot of

    DEBUG: gateway —> pppd (125 bytes)
    DEBUG: pppd —> gateway (72 bytes)

    and sorts. But the logfile has less than 2000 lines in total.
    Since I’m no expert, I’d like to have a confirmation that everything is in order, before I dare to try it again. And if it’s possibly a bug, it’s good to tell you also.
    You think OpenFortiGUI could somehow enter an infinite connection loop?

    Thanks for your help and work anyway

    Reply
    1. Ti Post author

      Hi,

      openFortiGUI only communicates with the specified IP and Port with your VPN-Gateway. Any other traffic is caused by other programs on your computer. Maybe you ask your IT-department to use Wireshark or similiar to investigate vor details.

      Cheers Rene

      Reply
  23. Martin

    Many thanks! Working like a charm under Ubuntu.
    Is there possibility to autoconnect VPN after system reboot?

    Reply
    1. Ti Post author

      Thanks. There is no option yet for autostart functionality. But i will record for future releases. : )

      Reply
        1. Ti Post author

          Hi,

          Version 0.4.2 is now out with an autostart feature for VPNs.

          To activate just check the option “autostart” in your VPN-profile. You still need to put OpenFortiGUI in your DE autostart, best minimized (Activate “Start minimized” in OpenFortiGUI settings).

          Reply
          1. Martin

            Wau! Many thanks.
            That was really fast.
            Already installed new verision and everything seems working.

            Great job!

  24. Daria

    Help!!! So, I’m new to umbuntu. It’s my son’s pc. My laptop is MIA, and I need to work from home tomorrow. I’m a life long windows user, and I was state of the art desktop support… in 1999 LOL. The vpn says it is connected, however I am getting no dns from the destination network. Nothing. I have an IP and nothing else (as far as I can tell… which doesn’t mean much)

    grady@Changeling:~$ nmcli dev show ppp0
    GENERAL.DEVICE: ppp0
    GENERAL.TYPE: unknown
    GENERAL.HWADDR:
    GENERAL.MTU: 1354
    GENERAL.STATE: 10 (unmanaged)
    GENERAL.CONNECTION: —
    GENERAL.CON-PATH: —
    IP4.ADDRESS[1]: 192.168.113.1/32
    IP4.GATEWAY:

    The connection is just missing a piece, and I don’t know enough to know what…

    Reply
  25. Rob

    Do i need to install the package openfortivpn from github?
    Or openfortigui has already installed it?
    I cant connect to colleage vpn.
    ERROR: getaddrinfo: Nombre o servicio desconocido
    INFO: Closed connection to gateway.
    ERROR: connect: Conexión rehusada
    INFO: Could not log out.
    ERROR: getaddrinfo: Nombre o servicio desconocido
    INFO: Closed connection to gateway.
    ERROR: connect: Conexión rehusada
    INFO: Could not log out.

    Reply
    1. Ti Post author

      You dont need the openfortivpn package, its already included in OpenFortiGUI. Please try to connect by IP-adress, there seems to be some issues with your DNS it seems.

      Reply
  26. Julia Magenheimer

    Hi Ti,
    first thank you very much! Keep up the good work!

    I’ve a minor issue regarding the display scaling on high DPI display (4k). On the HDPI display, the font of the gui dialog / text boxes is very big. So there is not much space for text; in fact not enough.

    Could you please check on HDPI with window scaling set to e.g. 2.
    Also, the connection / settings window is of fixed size so it can’t be enlarged.

    All minor UI issues. The product is great.

    Reply
  27. Julia Magenheimer

    Sorry, I cannot connect:

    Server name is 100$% correct. We have some servers that have a postix URL e.g. /vpn. Is that relevant for the settings? Where do you enter this?

    ERROR: getaddrinfo: Name or service not known
    INFO: Closed connection to gateway.
    DEBUG: server_addr: 0.0.0.0
    DEBUG: server_port: 4443
    DEBUG: gateway_addr: 0.0.0.0
    DEBUG: gateway_port: 4443
    ERROR: connect: Connection refused

    Reply
    1. Daniel

      I have a similar problem here;

      ERROR: getaddrinfo: Nombre o servicio desconocido
      INFO: Closed connection to gateway.
      ERROR: connect: Conexión rehusada
      INFO: Could not log out.

      With old FortiClient it works.

      Any idea?

      Reply
  28. Toomas

    On Ubuntu 18.04 VPN server names don’t resolve (the same issue was on Ubuntu 17.10). The connection works when I give VPN server as an IP address instead of server name.
    There is also “try” icon any more (version 0.4 had visible try icon on Ubuntu 17.04 and 18.04 beta).
    But still, you have done great work 🙂

    Reply
    1. Toomas

      It seams, that the issue with Gnome-Shell “try” icons is the Gnome-Shell issue. Sorry for mentioning 🙂

      Reply
    2. Ti Post author

      Are you using the specific 18.04 build or the 16.04 one? I could not reproduce the resolving issue until now. When i make a testinstall with a fresh Ubuntu 18.04 and test with latest OpenFortiGUI name resolving is working. Thanks for further hints.

      Reply
      1. Toomas

        Hi,
        I’m currently using version from the package “openfortigui_0.6.1-1_bionic_amd64.deb”. So, I believe this is the right one for Ubuntu 18.04. I deleted my openfortigui profile and created all the connections again, but still, when I use domain name instead of IP address there will be no connection. If I use IP the connections will be started without any problems. In journalctl I see something like:
        kernel: openfortigui[4034]: segfault at 2b8 ip 0000559e4bc76894 sp 00007ffe3b0289f8 error 4 in openfortigui[559e4bc2e000+d3000]

        Reply
          1. Toomas

            Thank you, excellent job 😀 Now the DNS resolving works.
            The Ubuntu 18.04 link points currently to an old version 🙂

      2. Toomas

        I forgot to mention, that this type of error:
        kernel: openfortigui[4034]: segfault at 2b8 ip 0000559e4bc76894 sp 00007ffe3b0289f8 error 4 in openfortigui[559e4bc2e000+d3000]
        appears only if I try to use domain name.

        Reply
  29. BestShenna

    I see you don’t monetize your website, don’t waste your traffic,
    you can earn extra bucks every month because you’ve got high quality content.
    If you want to know how to make extra $$$, search for:
    Ercannou’s essential adsense alternative

    Reply
  30. Sebastian Pająk

    VPN disconnects about every 30 min. What can be the problem?

    From logs:
    maj 16 12:58:24 openfortiGUI::Debug: 1526468304417 bytes avail:: 537
    maj 16 12:58:26 openfortiGUI::Warning: QThread::start: Thread termination error: No such process
    maj 16 12:58:26 openfortiGUI::Debug: shutting down vpn process:: “Eniro”
    maj 16 12:58:27 openfortiGUI::Debug: client disconnected:: “Eniro”
    maj 16 12:58:27 openfortiGUI::Debug: vpnManager::onClientVPNStatusChanged() “Eniro” status 0
    maj 16 12:58:27 openfortiGUI::Debug: MainWindow::onClientVPNStatusChanged:: “Eniro” ::status:: 0

    Reply
  31. Henry Katz

    Hi,
    This looks like a great product. Just wanted to confirm that someone has successfully built this on Centos 7.X and lived to tell about it?

    Thanks,
    Henry

    Reply
  32. Gustavo

    Congratulations for a job well done.
    This is an excellent piece of software.

    I’d love to see it running on my mac too.

    Thank you !

    Reply
  33. hhllss

    Hello,

    I just updated to version 0.7 64 bits. I think there is a problem with /etc/resolv.conf update after connecting, is it ?

    Best regards,

    hhllss

    Reply
      1. hhllss

        Hi Rene,
        Thank you for your answer. I am probably missing something, “Set DNS” is checked and “PPPD no peerdns” unchecked (I tried all combinations, actually). But still no luck. What am I missing ?
        Thank you for your help.
        Best regards,
        hhllss

        Reply
        1. Ti Post author

          Hi,

          which OS are you using?

          Is working here for Ubuntu 18.04 and KDE Neon 16.04 fine.

          Regards

          Reply
          1. hhllss

            Hi,
            It is an Ubuntu 16.04 LTS 64 bits (on Cinnamon but that should not be the problem).
            Regards,
            hhlllss

          2. hhllss

            Hi,
            But I have another PC with same install, when the resolv.conf update does work. Weird… I will try to find out what is going on.
            Regards,
            hhllss

        2. Ti Post author

          Thanks for investigating.

          Please also check your system/openfortigui logs, there may still be a bug with different systems.

          Reply
          1. hhllss

            Hi Ti,

            Well, I do not find anything special here :
            Two-factor authentication token:
            INFO: Authenticated.
            INFO: Remote gateway has allocated a VPN.
            INFO: Got addresses: [192.168.yy.1], ns [192.168.xx.10, 192.168.xx.11]
            INFO: Interface ppp0 is UP.
            INFO: Setting new routes…
            INFO: Tunnel is up and running.
            INFO: Setting ppp interface down.
            INFO: Restoring routes…

            May I post more logs somewhere else ?

            Best regards,

            hhllss

          2. hhllss

            Hello,
            No more luck after upgrading to 18.04. I do not understand, really ;-).
            Regards,
            hhllss

  34. Luis Enrique

    Hi !

    I’ve been using openfortgui since it’s first development and i want to thank you for this incredible work of you. Do you think , if it’s possible for you , add support in the client to interact with KeepassX ? it could be a nice feature . I dont expect to see it any time soon , but could be a nice addition for the project

    Thank you !

    Reply
  35. Alejandro

    Hello
    I have to use it in a Raspberry whith Raspbian.
    I try to compile it without success.
    Do you know how can i do?

    Thanks

    Reply
  36. Pingback: Tunelamento utilizando Fortigate numa máquina com Linux/Debian | Blog do Albuquerque

  37. rofc

    Hi Ti, I’m using the latest version of OpenFortiGUI (OpenFortiGUI 0.7.0 64bit). Seems it’s working fine, but where I should place the 2FA code once I got it?

    Thank you in advance.

    Best,
    @rofc

    Reply

Leave a Reply to Eric S. Smith Cancel reply

Your email address will not be published. Required fields are marked *