fortivpn-nm

NetworkManager integration for a FortiGate IKEv2/EAP+2FA VPN client on Linux (strongSwan). Provides a NetworkManager VPN plugin (D-Bus service + editor), a standalone connection-management GUI, and a 2FA (email OTP) prompt agent that runs in the user's graphical session.

English/Polish: this package's installer and GUI support both languages (--lang pl|en / FORTIVPN_LANG=pl|en, auto-detected from system locale otherwise).

Screenshots

fortivpn-config — the standalone connection editor (Connection field shows placeholder/example values, not a real gateway):

The 2FA prompt shown by fortivpn-otp-agent when the gateway requests an EAP-GTC token:

What this is (and isn't)

This repo is the NetworkManager integration layer — it is not strongSwan itself. It talks to a locally installed, patched strongSwan (swanctl/vici) to do the actual IKEv2/EAP negotiation with a FortiGate gateway; the strongSwan-side patches (EAP-GTC token handling, FortiGate auth quirks) live in a separate repository/fork of strongSwan.

Components:

• nm/nm-fortivpn-service.py — the NetworkManager VPN plugin's D-Bus service (root). Renders swanctl.conf from a template, drives swanctl --initiate/--terminate, reports state back to NetworkManager.
• nm/nm-fortivpn-editor.c — the libnm VPN editor plugin (GTK3). Known limitation: gnome-control-center is a GTK4 process, and mixing a GTK3 plugin into it deadlocks (a GNOME-side issue, not fixable from here) — use fortivpn-config instead of the GNOME Settings VPN editor.
• sbin/fortivpn-config-gui.py — standalone GTK3 connection editor (own process, so no GTK3/GTK4 conflict). Handles multiple independent FortiVPN tunnels, IKE/ESP algorithm proposals, DH groups. Installed as fortivpn-config.
• sbin/fortivpn-otp-agent.py — runs in the user's session (systemd --user), shows a zenity prompt for the 2FA code on request.
• sbin/fortigate-otp-helper.sh — the otp_helper invoked by the patched eap-gtc strongSwan plugin; requests a code from the agent above via a FIFO rendezvous (root/fortivpn group only reads the code, never bridges into the user's session).
• sbin/fortivpn-up.sh / fortivpn-down.sh — direct swanctl CLI wrapper, an alternative to the NetworkManager path (useful for scripting or debugging without NM).
• etc/ — swanctl.conf template and strongSwan config drop-ins (fortigate.conf for the FortiClient-compatibility knobs, fct_data.txt identity data sent to the gateway, eap-gtc-otp.conf, logging).

Building

Requires gcc, libnm/gtk+-3.0/gmodule-2.0 dev headers, and a locally installed strongSwan (for header/plugin compatibility — install the base strongswan-swanctl charon-systemd libcharon-extra-plugins packages first).

sudo install/build-deb.sh

Produces dist/fortivpn-nm_1.0_<arch>.deb. This package alone is not sufficient — the gateway requires the patched strongSwan libcharon (see the companion strongSwan patches repo) installed and held (apt-mark hold) first.

Installing

sudo install/install-client.sh --gateway vpn.example.com --user youruser

See INSTALL.md (Polish) / INSTALL.en.md (English) for the full manual step-by-step and troubleshooting.

Tested on

• Ubuntu 26.04 LTS "Resolute Raccoon" (VERSION_ID=26.04, codename resolute)
• Kernel 7.0.0-14-generic
• strongSwan packages 6.0.4-1ubuntu3.1

Security notes

• Secrets (VPN password, gateway PSK) are entered via hidden prompts only — never passed as CLI arguments or left in shell history.
• The OTP agent runs as an unprivileged user; the root-side helper only ever reads a code back over a FIFO, it never runs anything in the user's session.
• etc/fct_data.txt ships with placeholder identity values (IP=192.0.2.1, a zeroed MAC) — adjust only if your environment actually needs FortiClient-identity spoofing to match a specific gateway policy.