FortiClient VPN-only on Ubuntu Server 24.04: licensing, routing, sudo issue, auto-reconnect, and partner visibility

Hello ferrysiagian, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Regards,

Regards,

Hello ferrysiagian,

I found this solution, can you tell us if it helps, please?

Here’s a detailed breakdown addressing each of your questions and concerns about using FortiClient VPN-only on Ubuntu Server 24.04.

1. Impact from Previously Installed Paid FortiClient

Could the old paid FortiClient 7.2 affect your system? How to verify only VPN-only is installed?

• Potential Impact: If the previous paid edition was not fully removed, there could be leftover binaries, configuration files, or services that might interfere with the VPN-only version.
• Verification Steps:
  • Check Installed Packages:

    dpkg -l | grep forticlient
    

    This will list all FortiClient-related packages.
  • Remove Old Versions:
    If you see any packages other than forticlient-vpn, remove them:

    sudo apt remove forticlient
    sudo apt purge forticlient
    

  • Check for Leftover Files:
    Look for any remaining files or directories:

    sudo find / -name '*forticlient*'
    

    Remove any unnecessary remnants.
  • Check Running Processes:

    ps aux | grep forticlient
    

    Only the VPN process should be running when connected.

2. License Requirement for FortiClient VPN-only

Does FortiClient VPN-only require a license for SSL VPN or IPsec VPN on Linux?

• No License Required:
  The FortiClient VPN-only package for Linux does not require a license for basic SSL VPN or IPsec VPN connectivity. Licensing is only needed for advanced features (EMS, ZTNA, endpoint protection, etc.), which are not included in the VPN-only edition.
• Your Use Case:
  For connecting to a partner’s VPN (SSL or IPsec), the VPN-only edition is sufficient and free to use.

3. No Internet/External Network Access After VPN Connects

Is this expected? Can you keep access to non-partner networks?

• Expected Behavior:
  This is likely due to the VPN being configured as a full-tunnel (all traffic routed through the VPN), or due to DNS settings pushed by the VPN server.
• How to Check:
  After connecting, run:

  • ip route
    

    If the default route (0.0.0.0/0) points to the VPN interface, it’s a full-tunnel.
• Split Tunneling:
  • Client-Side:
    FortiClient VPN-only for Linux does not support client-side split tunneling configuration. Split tunneling must be enabled by the VPN administrator on the FortiGate device.
  • Workarounds:
    • You can try manually adding routes after connecting, but if the VPN server pushes a full-tunnel, these may be overridden.
    • Example to restore default route via your original gateway:

      sudo ip route add default via <your-original-gateway> dev <your-original-interface>
      

    • Note: This may break VPN connectivity or violate partner policy.
• Recommendation:
  Contact the partner’s VPN administrator to request split tunneling if you need simultaneous access to external networks.
   

4. Cannot Run sudo su After VPN Connects

Why does this happen? What to check?

• Possible Causes:
  • DNS Issues: If /etc/resolv.conf is overwritten by the VPN, sudo may hang if it tries to resolve hostnames and cannot reach DNS servers.
  • PAM/Authentication: If your system uses network-based authentication (LDAP, etc.), and those servers become unreachable after VPN connects, sudo may fail.
• Troubleshooting Steps:
  • Try running sudo su with -E to preserve the environment.
  • Check /etc/resolv.conf before and after VPN connection.
  • Check /etc/nsswitch.conf for how host resolution is configured.
  • Review /var/log/auth.log for sudo-related errors.
• Workaround:
  If DNS is the issue, consider configuring a static /etc/resolv.conf or using a local DNS cache.

5. VPN Disconnects Unexpectedly & Auto-Reconnect

How to keep the VPN connected and reconnect automatically?

• Auto-Reconnect:
  FortiClient VPN-only CLI does not have a built-in auto-reconnect feature.
• Recommended Solution:
  Use a wrapper script or systemd service to monitor and restart the VPN connection if it drops.
  • Example Bash Loop:

    while true; do
      forticlient vpn connect vpn-profile -u users-vpn -p<password> -w -a -s
      sleep 5
    done
    

    • Security Note: Storing passwords in scripts is insecure. Consider using a password manager or environment variable with restricted permissions.
• Passwordless Reconnect:
  • If your partner supports certificate-based authentication, use that instead of passwords.
  • Otherwise, you may need to enter the password each time unless you automate it (with the above security caveat).
     

6. Partner Visibility and Access to Your Machine

What can the partner see/do? What precautions should you take?

• Visibility:
  • The partner can see your VPN-assigned IP and any traffic you send to their network.
  • If your server has open ports/services, and the VPN policy allows, the partner could potentially scan or access those services.
• Precautions:
  • Firewall: Restrict inbound connections on your server to only what is necessary.
  • Service Hardening: Disable or secure any unnecessary services.
  • User Accounts: Ensure only authorized users have access.
  • Logging: Monitor logs for unusual activity.
  • VPN Scope: Ask the partner what their VPN policy allows regarding access to client machines.
     

Additional Guidance & Best Practices

• Keep FortiClient Updated: Use the latest supported version for security and bug fixes.
• Minimal Privileges: Run the VPN client with the least privileges necessary.
• Backup Configurations: Before making changes, back up your network and VPN configurations.
• Monitor Connectivity: Use monitoring tools to alert you if the VPN drops.

Follow-Up & Clarification Questions

To provide even more targeted advice, please clarify:

• Are you using SSL VPN or IPsec VPN?
• Does your partner allow split tunneling, or is it strictly full-tunnel?
• Are you required to use password authentication, or is certificate-based authentication possible?
• What specific error do you see when sudo su fails (any log output)?
• Do you need to automate VPN connection at boot, or only when needed?

Let me know if you need example scripts, systemd service templates, or further troubleshooting steps for any of the above issues!