Issues Connecting to FortiClient VPN from Abroad

[jvgomes]

Hello, I’m currently trying to connect to my company’s FortiClient VPN while working from another country. However, the connection is being blocked due to the firewall’s restrictions on connections originating from outside the allowed region.

To overcome this, I attempted to set up a proxy using an Amazon EC2 instance located within the allowed region. I’ve tried various methods, including using socat, stunnel, and nginx, to forward the traffic from my local machine to the VPN server via the EC2 instance. Unfortunately, I haven’t been successful in establishing a working connection.

FortiClient often stalls at 31% or 40% during the connection process, which I suspect could be due to TLS version mismatches or certificate validation issues. In some cases, FortiClient fails to present the usual certificate acceptance prompt.

Are there any specific configurations or tools you’d recommend to make this work? Thank you

[Renante_Era]

In general, you should provide the public IP address where you are and the FGT admin add an exemption or add that in the allowed public IP address to connect.

However, you should probably clarify things with your company's HR if you're allowed to work remotely from that country. For instance, an employee working on a Canadian company went on vacation in the US. If the employee doesn't have US working visa, then that employee shouldn't be working while on vacation in the US because the company might encounter some taxation liability issue. 

[jvgomes]

My IP is dynamic and I'd prefer not to keep asking them to unblock it. I work for a company that does services for that which owns the VPN, they are reluctant to unblock a whole country just for me.

[jvgomes]

For anyone struggling with the same problem, I managed to do it installing socat in a server of the same country:

sudo apt install socat

sudo socat TCP4-LISTEN:443,reuseaddr,fork TCP4:thevpnserver.com:443

(change thevpnserver.com and 443 with the port it uses)

Then on Windows, I changed the hosts file so when I access thevpnserver.com it goes to the ec2 ip.

[callmeahero · Accepted solution]

The FortiClient VPN might be stalling due to mismatches in the TLS version or cipher suites between your local setup and the FortiGate VPN server.

Make sure the FortiGate is configured to support the same TLS version as your FortiClient.

You might need to adjust the SSL/TLS settings in FortiGate’s VPN configuration (e.g., enabling TLS 1.2 or 1.3).

Since you're using an EC2 proxy, ensure that the proxy is forwarding traffic correctly to the FortiGate VPN server.

If you're using nginx or stunnel, double-check that the proxy is handling the VPN's specific protocol and port (e.g., SSL VPN typically uses port 443).

It's important to forward both UDP and TCP traffic correctly, depending on the VPN protocol you're using.

The region-based firewall might be blocking your connection attempts even through the proxy.

Ensure that the EC2 instance has the proper security group settings to allow VPN traffic on the necessary ports, and that your local machine can route traffic to the EC2 instance properly.

If FortiClient isn’t showing the certificate acceptance prompt, it could be related to SSL/TLS handshake problems.

Try disabling certificate validation temporarily (if your company security policy allows it) to see if that's causing the issue.

Alternatively, check that the FortiGate server’s SSL certificate is trusted by your system.

If using a direct VPN connection through the EC2 instance is causing issues, you could try setting up a web proxy (such as Squid or HAProxy) on the EC2 instance to relay VPN traffic through HTTP(S), which might bypass some of the regional restrictions.

Check the FortiClient logs for more specific error messages.

It might give you clues about whether it's a certificate, TLS, or proxy forwarding issue.