How to use the command 'openfortivpn' (with examples)

OpenFortiVPN is an open-source VPN client designed for connecting to Fortinet’s proprietary VPN solutions, which integrate SSL and PPP protocols. It provides a secure and reliable way to connect to remote servers over the internet, ensuring that data remains confidential and secure during transmission. The command-line tool is a preferred choice for those familiar with terminal operations and requiring VPN connections for secure remote access and data transfer. Below are some practical use cases of using the openfortivpn command.

Use case 1: Connect to a VPN with a username and password

Code:

openfortivpn --username=username --password=password

Motivation:

You might need to connect to a VPN network that your organization or client has set up to access internal resources like files, software applications, or internal web portals securely. Using a username and password is a straightforward and commonly used method for authentication. This command allows seamless VPN connectivity ensuring that sensitive information is encrypted and transferred securely over the network.

Explanation:

• --username=username: This argument specifies the username required for authentication with the VPN server. This username is typically assigned by the network administrator and is necessary to gain access to the VPN services.

• --password=password: This argument specifies the password associated with the username for authentication. The password adds an extra layer of security by verifying that the user attempting to connect is authorized before granting access to the VPN.

Example Output:

INFO: Connected to VPN.
INFO: Local Gateway: 192.168.1.1
INFO: VPN Gateway: 10.10.10.1
INFO: SSL negotiation succeeded
INFO: Established PPP connection

Use case 2: Connect to a VPN using a specific configuration file (defaults to /etc/openfortivpn/config)

Code:

sudo openfortivpn --config=path/to/config

Motivation:

If you frequently connect to a VPN server, you might want to save the connection settings (such as the host, port, username, password, and any other options) in a configuration file for convenience and consistency. This is especially useful for organizational environments where multiple team members need to use the same VPN settings reliably without manually entering credentials and other details each time.

Explanation:

• --config=path/to/config: This argument specifies the path to a configuration file containing all the necessary settings for the VPN connection. The configuration file typically includes details like the VPN server address, port number, and authentication credentials, thus automating the connection process.

Example Output:

INFO: Configuration loaded successfully.
INFO: Connected to VPN using configuration from path/to/config.
INFO: Local Gateway: 192.168.1.1
INFO: VPN Gateway: 10.10.10.1
INFO: SSL negotiation succeeded
INFO: Established PPP connection

Use case 3: Connect to a VPN by specifying the host and port

Code:

openfortivpn host:port

Motivation:

This use case is particularly helpful in environments where the VPN server settings frequently change or vary depending on the context, such as when accessing different geographical regions or organizational units. Directly specifying the host and port allows for dynamic adjustments without relying on preset configuration files or stored credentials.

Explanation:

• host:port: This positional argument specifies the VPN server’s host address and the specific port to connect to. The ‘host’ is typically an IP address or a domain name, while ‘port’ is the network port on which the VPN server is listening for connections.

Example Output:

INFO: Attempting to connect to host:port.
INFO: SSL negotiation succeeded
INFO: Established PPP connection
INFO: Connected to VPN.

Use case 4: Trust a given gateway by passing in its certificate’s sha256 sum

Code:

openfortivpn --trusted-cert=sha256_sum 

Motivation:

In secure communications, the authenticity of the gateway, or server, must be verified to protect against man-in-the-middle attacks. By passing the sha256 cryptographic sum (a unique hash) of a server’s certificate, users can ensure they are connecting to a legitimate server. This use case is crucial for maintaining data integrity and confidentiality, especially in environments dealing with highly sensitive information.

Explanation:

• --trusted-cert=sha256_sum: This argument specifies the SHA-256 cryptographic hash of the VPN server’s certificate. By providing this hash, the client can verify that the server is indeed the one it claims to be, preventing unauthorized access and reducing the risk of data interception.

Example Output:

INFO: Connecting with trusted certificate verification.
INFO: SSL negotiation succeeded
INFO: Established PPP connection
INFO: Connected to VPN.

Conclusion:

OpenFortiVPN is a powerful and flexible tool for setting up secure VPN connections using Fortinet’s technologies, accommodating various scenarios with its diverse command options. Each use case offers specific methods to connect, ensuring that users maintain security, consistency, and convenience while accessing remote networks. By understanding these use cases, users can tailor their VPN connections to match their specific needs and security requirements effectively.