OPENFORTIVPN(1)

openfortivpn(1) — the manual, but make it cute ✨

okay bestie, this is the General Commands Manual page for openfortivpn, and it's a whole vibe. let's get into it 💅

---

✨ NAME ✨

openfortivpn — Client for PPP+TLS VPN tunnel services 🫶

---

🌸 SYNOPSIS 🌸

openfortivpn [<host>[:<port>]] [-u <user>] [-p <pass>]
[--cookie=<cookie>] [--cookie-on-stdin] [--saml-login[=<port>]]
[--pinentry=<name>] [--otp=<otp>] [--otp-prompt=<prompt>]
[--otp-delay=<delay>] [--no-ftm-push] [--realm=<realm>]
[--ifname=<interface>] [--set-routes=<bool>] [--no-routes]
[--set-dns=<bool>] [--no-dns] [--half-internet-routes=<bool>]
[--ca-file=<file>] [--user-cert=<file>] [--user-cert=pkcs11:]
[--user-key=<file>] [--use-syslog] [--trusted-cert=<digest>]
[--insecure-ssl] [--cipher-list=<ciphers>] [--min-tls=<version>]
[--seclevel-1] [--pppd-use-peerdns=<bool>] [--pppd-no-peerdns]
[--pppd-log=<file>] [--pppd-plugin=<file>] [--pppd-ipparam=<string>]
[--pppd-ifname=<string>] [--pppd-call=<name>]
[--pppd-accept-remote=<bool>] [--ppp-system=<string>]
[--use-resolvconf=<bool>] [--persistent=<interval>] [-c <file>] [-v|-q]
openfortivpn --help
openfortivpn --version

---

💖 DESCRIPTION 💖

okay so here's the tea: openfortivpn connects to a VPN by setting up a tunnel to the gateway sitting at <host>:<port>. that's it, that's the whole gig. iconic honestly. 🌈

---

👑 OPTIONS 👑

• --help — shows you the help message and then dips. bye bestie 🫶
• --version — shows the version and exits. short and sweet fr fr.
• -c <file>, --config=<file> — point it at a custom config file. the default is /etc/openfortivpn/config, in case you were wondering.
• -u <user>, --username=<user> — your VPN account username, obviously 💁
• -p <pass>, --password=<pass> — your VPN account password, in plain text (yeah, i know 😭). for something more secure, use pinentry, or just let openfortivpn prompt you for the password instead.
• --cookie=<cookie> — a valid cookie (SVPNCOOKIE) to use instead of a username and password. sneaky, but valid ✨
• --cookie-on-stdin — reads the cookie (SVPNCOOKIE) from standard input. pipe it in, no cap.
• --saml-login[=<port>] — spins up a temporary web server to catch a local SAML redirect. to log in with SAML you literally just have to open <your-vpn-domain>/remote/saml/start?redirect=1 and follow the login steps. when the login process finishes, the page gets redirected to http://127.0.0.1:8020/?id=<session-id>. and the actual URL you should use for the login — including the optional realm — gets printed to the terminal when the web server is started. slay. 🌸
• --pinentry=<name> — which pinentry program to use. lets you hand over the password in a secure way. for example: pinentry-gnome3 on Linux, or pinentry-mac on macOS. secure AND cute 💅
• -o <otp>, --otp=<otp> — the One-Time-Password.
• --otp-prompt=<prompt> — searches for the OTP password prompt, starting with the string <prompt>.
• --otp-delay=<delay> — how long to wait before sending the One-Time-Password. the delay has to be in seconds, and 0 means no wait at all (which, btw, is the default).
• --no-ftm-push — don't use FTM push, even if the server offers it. the server might be configured to allow two factor auth through a push notification to the mobile app; if you pass this option, authentication based on OTP gets used instead.
• --realm=<realm> — connect to the specified authentication realm. defaults to empty, which is usually exactly what you want. no notes.
• --ifname=<interface> — bind the connection to the specified network interface.
• --set-routes=<bool>, --no-routes — decides whether openfortivpn should try to configure IP routes through the VPN when the tunnel is up. if you use it multiple times, the last one wins, periodt.

--no-routes is literally the same as --set-routes=0.

• --half-internet-routes=<bool> — decides whether openfortivpn should add two routes, 0.0.0.0/1 and 128.0.0.0/1, with higher priority, instead of replacing the default route. sneaky little trick, love that for us.
• --set-dns=<bool>, --no-dns — decides whether openfortivpn should add DNS name servers into /etc/resolv.conf when the tunnel is up. also, a dns-suffix may come through from the peer and get added to /etc/resolv.conf at the same time as the name servers are added. if resolvconf is installed and --use-resolvconf is activated, resolvconf is the one instructed to update the resolv.conf file; otherwise openfortivpn prepends its changes to whatever is already in the resolv.conf file. heads up though — there may be other mechanisms out there that update /etc/resolv.conf, like --pppd-use-peerdns together with an ip-up-script, and those might require you to call openfortivpn with --no-dns. --no-dns is the same as --set-dns=0. ✨
• --use-resolvconf=<bool> — decides whether openfortivpn should use resolvconf to add DNS name servers into /etc/resolv.conf. if you set it to false, the builtin fallback mechanism gets used instead — even if resolvconf is actually available.
• --ca-file=<file> — use the specified PEM-encoded certificate bundle instead of the system-wide store, to verify the gateway certificate.
• --user-cert=<file> — use the specified PEM-encoded certificate if the server requires authentication with a certificate.
• --user-cert=pkcs11: — use at least the string pkcs11: when you're using a smartcard 🎀. it takes the full or a partial PKCS11-URI (see p11tool --list-token-urls).

--user-cert = pkcs11:

--user-cert = pkcs11:token=someuser

--user-cert = pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=012345678;token=someuser

this feature requires the OpenSSL PKCS engine!

• --user-key=<file> — use the specified PEM-encoded key if the server requires authentication with a certificate.
• --pem-passphrase=<pass> — the pass phrase for the PEM-encoded key. 🔑
• --use-syslog — log to syslog instead of the terminal.
• --trusted-cert=<digest> — trust a given gateway. if classical TLS certificate validation fails, the gateway certificate gets matched against this value. <digest> is the X509 certificate's sha256 sum, and the certificate has to be encoded in DER form. you can use this option multiple times to trust several certificates. 💜
• --insecure-ssl — do not disable insecure TLS protocols/ciphers. if your server needs a specific cipher, consider using --cipher-list instead. (lowkey risky, bestie, be careful 🫣)
• --cipher-list=<ciphers> — the OpenSSL ciphers to use. if the default doesn't work, you can try alternatives like HIGH:!MD5:!RC4, or whatever the Cipher: line suggests in the output of openssl(1) (e.g. AES256-GCM-SHA384):

$ openssl s_client -connect <host:port>

the default is HIGH:!aNULL:!kRSA:!PSK:!SRP:!MD5:!RC4.

this applies to TLS v1.2 or lower only — do not use it with TLS v1.3 ciphers, fr fr.

• --min-tls=<version> — use a minimum TLS version instead of the system default. valid values are 1.0, 1.1, 1.2, 1.3.
• --seclevel-1 — if --cipher-list isn't specified, add @SECLEVEL=1 to the list of ciphers. this lowers the limits on dh key.

applies to TLS v1.2 or lower only.

• --pppd-use-peerdns=<bool>, --pppd-no-peerdns — whether to ask the peer ppp server for DNS server addresses and let pppd rewrite /etc/resolv.conf. ngl, there's no mechanism to tell the dns-suffix to pppd. and if the DNS server addresses are requested, also --set-dns=1 may race with the mechanisms inside pppd 💀.

--pppd-no-peerdns is the same as --pppd-use-peerdns=0.

• --pppd-log=<file> — sets pppd into debug mode and saves its logs into <file>.
• --pppd-plugin=<file> — use the specified pppd plugin instead of configuring the resolver and routes directly.
• --pppd-ipparam=<string> — gives an extra parameter to the ip-up, ip-pre-up and ip-down scripts. see man pppd(8) for further details.
• --pppd-ifname=<string> — set the ppp interface name. only if pppd supports it. patched versions of pppd implement this option, but they might not be available on your platform. 🙈
• --pppd-call=<name> — drops the usual arguments from the pppd command line and adds call <name> instead. this is useful on Debian and Ubuntu, where unprivileged users in the dip group can invoke pppd call <name> to make pppd read and apply options from /etc/ppp/peers/<name> (including privileged ones 👀).
• --pppd-accept-remote=<bool> — whether to invoke pppd with ipcp-accept-remote. enabling this option breaks pppd < 2.5.0, but newer pppd versions require it. pick your fighter.
• --ppp-system=<string> — only available if compiled for a ppp user space client (e.g. on FreeBSD). connect to the specified system as defined in /etc/ppp/ppp.conf.
• --persistent=<interval> — run the VPN persistently in an endless loop and try to reconnect forever 🔁. the reconnect interval may be specified in seconds, where 0 means no reconnect is done (that's the default).
• -v — increase verbosity. can be used multiple times to be even more verbose.
• -q — decrease verbosity. can be used multiple times to be even less verbose. shhh 🤫

---

🦋 ENVIRONMENT and proxy support 🦋

openfortivpn can be run behind an HTTP proxy that supports the HTTP connect command. it checks whether one of the environment variables https_proxy, HTTPS_PROXY, all_proxy, ALL_PROXY is set — those are supposed to contain a string in the format

http://[host]:[port]

where [host] is the ip or the fully qualified host name of the proxy server, and [port] is the TCP port number where the proxy is listening for incoming connections. if one of these variables is defined, openfortivpn tries to first establish a TCP connection to this proxy (plain HTTP, not encrypted), and then makes a request to connect to the VPN host as given on the command line or in the configuration file. the proxy is supposed to forward any subsequent packets transparently to the VPN host, so that the TLS layer of the connection is effectively established between the client and the VPN host — the proxy is just acting as a forwarding instance on the lower level of the TCP connection. 💅

the following environment variables are set by openfortivpn, and pppd(8) or its scripts can obtain information this way:

• VPN_GATEWAY — the ip of the gateway host

and for each route, three variables get set up, where an integer number is appended to the variable names, denoting the number of the current route:

• VPN_ROUTE_DEST_... — the destination network of the route
• VPN_ROUTE_MASK_... — the network mask for this route
• VPN_ROUTE_GATEWAY_... — the gateway for the current route entry

if not compiled for pppd, the pppd options and the features that rely on them are not available. on FreeBSD, --ppp-system is available instead. 🌈

---

<div style="display:none">more parts incoming, don't go anywhere 💖</div>

🎀 CONFIGURATION 🎀

okay so bestie, you can also pull all your options from a config file instead of typing them every single time. 💅 Options can be taken from a configuration file. But lowkey, if you pass an option on the command line, it overrides whatever the config file says, though. 👑

The default configuration file is /etc/openfortivpn/config, but you can set a different one with the -c option. An empty template for the configuration file is installed to /usr/share/openfortivpn/config.template. ✨

A configuration file looks like:

# this is a comment
host = vpn-gateway
port = 443
username = foo
# Password in plain text.
# For a secure alternative, use pinentry or let openfortivpn
prompt for the password.
# password = bar
# The pinentry program to use. Allows supplying the password in a
secure manner.
# pinentry = pinentry-mac
# realm = some-realm
# useful for a gui that passes a configuration file to
openfortivpn
# otp = 123456
# otp-delay = 0
# otp-prompt = Please
# This would disable FTM push notification support, and use OTP
instead
# no-ftm-push = 1
user-cert = /etc/openfortivpn/user-cert.pem
# user-cert = pkcs1: # use smartcard as client certificate
user-key = /etc/openfortivpn/user-key.pem
pem-passphrase = baz
# the sha256 digest of the trusted host certs obtained by
# openssl dgst -sha256 server-cert.crt:
trusted-cert = certificatedigest4daa8c5fe6c...
trusted-cert = othercertificatedigest6631bf...
# This would specify a ca bundle instead of system-wide store
# ca-file = /etc/openfortivpn/ca-bundle.pem
set-dns = 0
use-resolvconf = 1
set-routes = 1
half-internet-routes = 0
pppd-use-peerdns = 1
# alternatively, use a specific pppd plugin instead
# pppd-plugin = /usr/lib/pppd/default/some-plugin.so
# for debugging pppd write logs here
# pppd-log = /var/log/pppd.log
# pass ppp interface name to pppd (if supported by a patched
pppd)
# pppd-ifname = ppp1
# pass an ipparam string to pppd, e.g. the device name (a similar
use case)
# pppd-ipparam = 'device=$DEVICE'
# instruct pppd to call a script instead of passing arguments (if
pppd supports it)
# pppd-call = script
# use-syslog = 0
insecure-ssl = 0
cipher-list = HIGH:!aNULL:!kRSA:!PSK:!SRP:!MD5:!RC4
persistent = 0
seclevel-1 = 0

🌈 SEE ALSO 🌈

If you want the full lore, the openfortivpn home page (https://github.com/adrienverge/openfortivpn) provides a short introduction in the README file and additional information under the Wiki tab. 🦋

---

That's the whole vibe, bestie! This was the OPENFORTIVPN(1) manual page, dated May 4, 2020. Stay encrypted and slay. 💖✨