Ubuntu 24.04: Forticlient VPN installation w/ DNS resolution fix

[shannonpeeveyunlv]

#####
#Ubuntu 24.04: Forticlient VPN installation
#####

1. Additional packages need to be downloaded in order to install Forticlient VPN:

## download libayatana-appindicator1 by scrolling to the bottom and clicking your architecture (amd64)
https://packages.debian.org/bullseye/libayatana-appindicator1

## download libayatana-indicator7 by scrolling to the bottom and clicking your architecture (amd64)
https://packages.debian.org/bullseye/libayatana-indicator7

## download libdbusmenu-gtk4 from this link
http://security.ubuntu.com/ubuntu/pool/universe/libd/libdbusmenu/libdbusmenu-gtk4_18.10.20180917~bzr...

2.  Install these deb packages

sudo dpkg -i *.deb

## install libgconf-2.4 and libnss3-tools by running the shell script on this page
https://2h3ph3rd.medium.com/how-to-install-libgconf-2-4-on-ubuntu-23-10-fec6bda8d5f5

## download the forticlient vpn deb package from
https://www.fortinet.com/support/product-downloads#vpn

## install forticlient vpn
sudo dpkg -i forticlient_vpn_7.2.2.0753_amd64.deb

#####
#Forticlient VPN: Fix DNS resolution
#####

There are two ways to fix the DNS resolution issue. Pick your poison.

1. Modify /etc/systemd/resolved.conf and restart systemd-resolved.service

vi /etc/systemd/resolved.conf
[Resolve]
# Some examples of DNS servers which may be used for DNS= and FallbackDNS=:
# Cloudflare: 1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com 2606:4700:4700::1001#cloudflare-dns.com
# Google: 8.8.8.8#dns.google 8.8.4.4#dns.google 2001:4860:4860::8888#dns.google 2001:4860:4860::8844#dns.google
# Quad9: 9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
DNS=10.1.1.4 8.8.8.8 8.8.4.4
FallbackDNS=10.1.1.4
...
ReadEtcHosts=yes
...

sudo systemctl restart systemd-resolved.service

2. Create the following script and run it after connecting successfully to the VPN

vi /usr/local/bin/fortinect_dns_fix.sh
#!/bin/bash

export VPN_INTERFACE=$(resolvectl | grep fctvpn | sed 's/[()]//g' | cut -d' ' -f3)


sudo resolvectl domain $VPN_INTERFACE ~.
sudo resolvectl dns $VPN_INTERFACE <space delimited DNS server IPs>

chmod 755 /usr/local/bin/fortinect_dns_fix.sh
Login to Forticlient VPN as normal
#In a Terminal run: 
/usr/local/bin/fortinect_dns_fix.sh

#resolvectl should output something like:

 
...
Link 11 (fctvpn6b5ab556)
Current Scopes: DNS
Protocols: -DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 10.1.1.4
DNS Servers: 10.1.1.4 10.1.1.5 8.8.8.8 8.8.4.4
DNS Domain: ~.

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[rtanagras]

Hi @shannonpeeveyunlv - Seems like you're trying to configure DNS settings in your script. May we know what issue you're encountering with it?

[shannonpeeveyunlv]

I haven't been able to use Forticlient VPN on Linux for the past months due to DNS resolution issues while connected. 

I didn't go heavily into verifying the exact cause of the issue, but used this thread as a jumping off point for solving the problem for me: 

https://community.fortinet.com/t5/Support-Forum/DNS-settings-on-Ubuntu-22-04-and-FortiClient-VPN-7-0...

I used this posting as a reference for my solution: 

https://askubuntu.com/questions/1417070/ubuntu-22-04-vpns-dns-server-not-used-for-resolving-addresse...

[ceperic]

Hi, I know it's a bit old, but I still have the same problem with my Ubuntu 24.04

I applied your solution and it seems to work. After running your script querying resolvectl works.

But when trying to open the webpage in firefox or chrome, I get the usual DNS_PROBE_FINISHED_NXDOMAIN. 

Really no idea if it might be related or where is the cause.

Best and thanks for your help

[Xalalau]

Hi. I also had a connectivity issue here, but I'm not sure if it's the same one the main post was trying to fix. In my case, my coworkers use the VPN without any issues on Windows, while I can connect to it but lose my internet connection overall on Ubuntu 24.04. So, instead of digging into the settings, checking if split-tunneling is active, or talking to IT, I just decided to rebuild my connection exactly how I want it to work. In my script below I isolate two subnets for the VPN and restore my normal routes and DNS on the main net interface, allowing my distro to access both the internal services and open web. I hope it helps someone (and please read the script before executing it!).

#!/usr/bin/env bash

# Rewire the system to: use both internal and public DNS; route only specific IP ranges through the VPN.    
# Ubuntu 24.04

set -euo pipefail
# e Exit on error
# u Unset variables are errors
# o Pipeline failure detection

sudo -v >/dev/null 2>&1

# ==== USER SETTINGS ====
# CHANGE THE EXAMPLE VALUES BELLOW
LAN_DEV="enp4s0"
LAN_GW="192.168.100.1"
# Split-tunnel networks that must go through the VPN:
SPLIT_NETS=("192.168.31.0/24" "192.168.32.0/24")

# DNS for your LAN device after routing changes:
LAN_DNS_INTERNAL=("10.0.0.4" "10.0.1.4")
LAN_DNS_PUBLIC=("1.1.1.1" "1.0.0.1" "8.8.8.8")

FORT_PROFILE_NAME="FortiClient Profile Name"

CURL_TEST_URL="https://ifconfig.me"                # External reachability check
CURL_TIMEOUT=8
# =======================

# Find active fctvpn interface
FCT_DEV="$(ip -o link show | awk -F': ' '$2 ~ /fctvpn/ {print $2; exit}')"

if [[ -z "${FCT_DEV:-}" ]]; then
  echo "Connecting VPN profile: ${FORT_PROFILE_NAME}"

  forticlient vpn connect "${FORT_PROFILE_NAME}"

  FCT_DEV="$(ip -o link show | awk -F': ' '$2 ~ /fctvpn/ {print $2; exit}')"

  if [[ -z "${FCT_DEV:-}" ]]; then
	echo "No fctvpn* interface found. Connect the VPN and run again." >&2
	exit 1
  fi
fi

echo "Using VPN interface: $FCT_DEV"

# Rewire network

# 1) Remove default route via VPN (ignore error if it doesn't exist)
sudo ip route del default dev "$FCT_DEV" 2>/dev/null || true

# 2) Ensure default route via LAN with higher metric (as shown after executing ip r)
sudo ip route replace default via "$LAN_GW" dev "$LAN_DEV" metric 20100

# 3) Add only the internal networks through the VPN interface
for NET in "${SPLIT_NETS[@]}"; do
  sudo ip route replace "$NET" dev "$FCT_DEV"
done

# 4) (Optional) Clean leftover host route to VPN gateway, if present
# sudo ip route del SOME_IP_HERE via "$LAN_GW" dev "$LAN_DEV" 2>/dev/null || true

# 5) Apply DNS to your LAN device via resolvectl (internals first, then public)
DNS_COMBINED=("${LAN_DNS_INTERNAL[@]}" "${LAN_DNS_PUBLIC[@]}")
echo "Applying DNS to $LAN_DEV: ${DNS_COMBINED[*]}"
sudo resolvectl dns "$LAN_DEV" "${DNS_COMBINED[@]}"

echo
echo "Current routes:"
ip route show

echo
echo "Current DNS (resolvectl):"
resolvectl

# External connectivity check
echo
echo "Waiting 10s..."
sleep 10

echo
echo "External connectivity test (curl ${CURL_TEST_URL}, ${CURL_TIMEOUT}s)..."
if OUT="$(curl -4 -sS --max-time "${CURL_TIMEOUT}" "${CURL_TEST_URL}" || true)"; then
  if [[ -n "$OUT" ]]; then
    echo "OK. Sample output: ${OUT}"
    exit 0
  else
    echo "curl returned no body (possible block upstream)."
    exit 0
  fi
else
  echo "curl failed (no external connectivity or blocked)."
  exit 2
fi