Skip to main content
netvpn15
netvpn15
New Member
September 16, 2025
Question

How to configure home router/firewall to allow Forticlient connections?

  • September 16, 2025
  • 2 replies
  • 609 views

Hi,


I've a corporate laptop that uses Forticlient to establish a VPN
connection to corporate resources.


When working at home, when this corporate laptop is connected through the ISP
router, there's no problem connecting to the VPN server.

 

Now, I'm setting up my own router/firewall.


Using simple NAT rules, other systems can connect fine to the Internet, also the corporate
laptop can connect fine for everything except the VPN resources.
When I try to connect the VPN, Forticlient 2.7.8.1140 returns:
"a network error prevented updates from being downloaded".

 

It seems that for this kind of ssl vpn there are some special rules.
Can you please tell me what rules, protocols, ports, etc should I
consider in my router/firewall?

If you could show Linux iptables rules (or FreeBSD, OpenBSD, NetBSD equivalents), it would be very kind of you.

Thank you

2 replies

AEK
SuperUser
AEK
SuperUser
September 16, 2025

Hi

No special rule needed, except need to open the outgoing connection to the remote SSL VPN server IP:port (usually TCP 443 or 10443).

NAT is fully supported.

AEK
netvpn15
netvpn15Author
New Member
September 16, 2025
@netvpn15 wrote:

Hi,


I've a corporate laptop that uses Forticlient to establish a VPN
connection to corporate resources.


When working at home, when this corporate laptop is connected through the ISP
router, there's no problem connecting to the VPN server.

 

Now, I'm setting up my own router/firewall.


Using simple NAT rules, other systems can connect fine to the Internet, also the corporate
laptop can connect fine for everything except the VPN resources.
When I try to connect the VPN, Forticlient 2.7.8.1140 returns:
"a network error prevented updates from being downloaded".

 

It seems that for this kind of ssl vpn there are some special rules.
Can you please tell me what rules, protocols, ports, etc should I
consider in my router/firewall?

If you could show Linux iptables rules (or FreeBSD, OpenBSD, NetBSD equivalents), it would be very kind of you.

Thank you

@netvpn15 wrote:

Hi,


I've a corporate laptop that uses Forticlient to establish a VPN
connection to corporate resources.


When working at home, when this corporate laptop is connected through the ISP
router, there's no problem connecting to the VPN server.

 

Now, I'm setting up my own router/firewall.


Using simple NAT rules, other systems can connect fine to the Internet, also the corporate
laptop can connect fine for everything except the VPN resources.
When I try to connect the VPN, Forticlient 2.7.8.1140 returns:
"a network error prevented updates from being downloaded".

 

It seems that for this kind of ssl vpn there are some special rules.
Can you please tell me what rules, protocols, ports, etc should I
consider in my router/firewall?

If you could show Linux iptables rules (or FreeBSD, OpenBSD, NetBSD equivalents), it would be very kind of you.

Thank you



Maybe there's some problem because of IPv6?
My filter table is all about IPv4:

table <int-block> type lpm
 
procedure "log"
 
map re0 dynamic any -> xxx.xxx.xxx.xxx pass family inet4 from 192.168.1.0/24 # id="1" 
 
group "external" on re0 { # id="1" 
pass stateful out final all # id="2" 
pass stateful in final family inet4 proto tcp flags S/FSRA to ifaddrs(re0) port 22220 # id="3" 
pass stateful in final proto tcp flags S/FSRA to ifaddrs(re0) port { 80, 443, 25, 53, 6000, 9022 } # id="4" 
pass stateful in final proto udp to ifaddrs(re0) port { 53, 123, 6000 } # id="5" 
pass stateful in final proto { tcp, udp } flags S/FSRA to ifaddrs(re0) port 17166 # id="6" 
pass stateful in final proto { tcp, udp } flags S/FSRA to ifaddrs(re0) port 44000 # id="7" 
pass stateful in final proto { tcp, udp } flags S/FSRA to ifaddrs(re0) port 23456 # id="8" 
pass stateful in final proto { tcp, udp } flags S/FSRA to ifaddrs(re0) port { 14111, 8555, 999 } # id="9" 
pass stateful in final proto { tcp, udp } flags S/FSRA to ifaddrs(re0) port 8123 # id="a" 
}
 
group "internal" on wm0 { # id="c" 
pass in final family inet4 from 192.168.1.0/24 # id="d" 
pass out final all # id="e" 
}
 
group default { # id="f" 
pass final on lo0 all # id="10" 
}
@netvpn15 wrote:

Hi,


I've a corporate laptop that uses Forticlient to establish a VPN
connection to corporate resources.


When working at home, when this corporate laptop is connected through the ISP
router, there's no problem connecting to the VPN server.

 

Now, I'm setting up my own router/firewall.


Using simple NAT rules, other systems can connect fine to the Internet, also the corporate
laptop can connect fine for everything except the VPN resources.
When I try to connect the VPN, Forticlient 2.7.8.1140 returns:
"a network error prevented updates from being downloaded".

 

It seems that for this kind of ssl vpn there are some special rules.
Can you please tell me what rules, protocols, ports, etc should I
consider in my router/firewall?

If you could show Linux iptables rules (or FreeBSD, OpenBSD, NetBSD equivalents), it would be very kind of you.

Thank you

 

Do you find anything wrong?  This is not even blocking anything.
Tried with
net.inet6.ip6.forwarding = 0
and also
net.inet6.ip6.forwarding = 1

IPv4 is set for forwarding:  net.inet.ip.forwarding = 1 

Terms & ConditionsAccessibility statement