FortiClient Alternative for Linux as Remote Access IPsec VPN with strongSwan

strongSwan can be used as a practical alternative to FortiClient on Linux when the FortiGate remote-access VPN is configured for IPsec/IKEv2.

This configuration has been tested on Ubuntu 24.04 LTS. It uses IKEv2, a pre-shared key for the FortiGate gateway authentication and EAP-MSCHAPv2 for the user credentials.

Important: This setup is not officially supported by Fortinet. In this tested configuration, split routes pushed by the FortiGate are not automatically installed by the Linux client, so the remote networks must be configured manually using rightsubnet.

Install strongSwan

Install strongSwan together with the plugins required for EAP authentication and additional IPsec functionality:

sudo apt update

sudo apt install strongswan strongswan-swanctl libcharon-extra-plugins libstrongswan-standard-plugins

Configure the FortiGate VPN Connection

Edit the strongSwan IPsec configuration:

sudo nano /etc/ipsec.conf

Add the VPN connection:

conn fortigate-psk-vpn

keyexchange=ikev2

auto=add

fragmentation=yes

left=%any

leftsourceip=%config

leftid=%any

leftauth=eap

leftauth2=eap-mschapv2

eap_identity=<USERNAME>

right=<FORTIGATE_PUBLIC_IP_ADDRESS>

rightid=%any

esp=aes256-sha256

ike=aes256-sha256-ecp521

rightauth=psk

rightsubnet=<SPLIT_NETWORK_1/24>,<SPLIT_NETWORK_2/23>,<SPLIT_NETWORK_3/22>

leftsourceip=%config requests a virtual IP address from the FortiGate. The rightsubnet option defines which remote networks should be routed through the IPsec tunnel.

Configure Split Tunnel Networks

FortiGate-pushed routes were not automatically applied in this tested Linux setup. Add every network that must be reachable through the VPN manually:

rightsubnet=10.10.0.0/24,10.20.0.0/23,192.168.100.0/22

Only traffic destined for these networks will use the VPN tunnel.

Configure the Pre-Shared Key and User Credentials

Edit the strongSwan secrets file:

sudo nano /etc/ipsec.secrets

Add the FortiGate pre-shared key and the EAP username/password:

# PSK for tunnel

%any : PSK "<PRESHARED_KEY>"

# EAP user credentials

<USERNAME> : EAP "<USER_PASSWORD>"

Protect the Configuration Files

The VPN configuration contains authentication information and should only be readable by root:

sudo chown root:root /etc/ipsec.conf

sudo chmod 600 /etc/ipsec.conf

sudo chown root:root /etc/ipsec.secrets

sudo chmod 600 /etc/ipsec.secrets

Configure DNS Received from the VPN

If the FortiGate provides DNS servers to the VPN client, enable the strongSwan resolve plugin and configure the interface used by resolvconf:

sudo nano /etc/strongswan.d/charon/resolve.conf

Configure the file as follows:

resolve {

# File where to add DNS server entries if not using resolvconf(8).

# file = /etc/resolv.conf

# Whether to load the plugin.

load = yes

resolvconf {

# Interface name/protocol sent to resolvconf(8).

# iface = lo.ipsec

iface = <PHYSICAL_INTERFACE_NAME>

# Path/command for resolvconf(8).

# path = /sbin/resolvconf

}

Replace <PHYSICAL_INTERFACE_NAME> with the Linux interface used for the connection, for example:

iface = enp0s3

Restart strongSwan After Configuration Changes

After changing the IPsec configuration, restart strongSwan and reload the secrets:

sudo ipsec restart

sudo ipsec rereadsecrets

Connect to the FortiGate VPN

Bring the VPN tunnel up manually:

sudo ipsec up fortigate-psk-vpn

Disconnect the VPN:

sudo ipsec down fortigate-psk-vpn

Check VPN Status

Display the complete IKE and IPsec Security Association status:

sudo ipsec statusall

After the tunnel is established, verify the virtual IP and installed routes:

ip addr

ip route

ip xfrm policy

ip xfrm state

Useful Troubleshooting Commands

If the tunnel does not establish, monitor the strongSwan logs while connecting:

journalctl -u strongswan-starter -f

Useful commands for checking the connection: