Split DNS not installed on Fedora by FortiClient

[Felix1213]

Hello,

I have split DNS configured on Fortigate for multiple SSL-VPN portals, and it working for everyone running Windows, MacOS, and Ubuntu.

It was also working for me running Fedora with Gnome, and the default NetworkManager and systemd-resolved.

But since not long ago it's not working anymore for me (it's still working for non-Fedora users).

It might be since I upgraded FortiClient using forticlient_vpn_7.4.3.1736_x86_64.rpm but I'm not 100% sure.

The FortiClient before the upgrade has been installed using forticlient_vpn_7.4.0.1636_x86_64.rpm.

The FortiGate appliance we connect to is running 7.2.11.

I can workaround by using a NetworkManager dispatcher script like this:

cat << 'EOF' > /etc/NetworkManager/dispatcher.d/at-fctvpn-connection.conf

#!/usr/bin/env bash


set -eu


# Log when there is an event
echo "Receive event from ${DEVICE_IFACE:-dummy} ${NM_DISPATCHER_ACTION:-dummy} " >> /tmp/dispatch.log


# Configure split DNS if the event is Firewall VPN going up
[[ "${DEVICE_IFACE:-dummy}" =~ "fct" ]] && [[ "${NM_DISPATCHER_ACTION:-dummy}" = "up" ]] && {
resolvectl dns "${DEVICE_IFACE}" "192.0.2.1#dns1.example.com 192.0.2.2#dns2.example.com"
resolvectl domain "${DEVICE_IFACE}" int.example.com
} >> /tmp/dispatch.log

EOF

chmod +x /etc/NetworkManager/dispatcher.d/at-fctvpn-connection.conf

Although I'd like it to be fixed for good, or know if the issue is on my side.

Does someone have the same issue with Fedora? Or know where it is coming from?

[AEK]

Hi Felix

Is it possible to back to 7.4.0 and see if the issue is the same?

[Felix1213]

Hi, I just tried and it's not working either.

So it's not working on Fedora anymore, it's not a regression of 7.4.3 version.

I upgraded F41->F42 a few months ago, and I upgrade my packages on a daily base. I'm not sure what have been the trigger then.

[AEK · Accepted solution]

I agree that something has been changed in Fedora.

Then I think your script is the best workaround in such situation, till Fortinet releases a new FCT version that works 100% fine on F42.

[Felix1213]

Do you know if Fortigate is aware of the issue, or if I should open a case?

[AEK]

Unfortunately FCT VPN is a free tool and is not supported, so you cannot open a ticket.

If you have the same issue on FCT (licensed) then you can open a ticket.

On the other hand, FCT 7.4.3 is officially supported on Ubuntu 22.04 and 24.04, RHLE/CentOS 9, but nothing official regarding Fedora (even if it is the upstream of RHEL).

https://docs.fortinet.com/document/forticlient/7.4.3/linux-release-notes/136392/product-integration-...