FortiVPN 2
FortiVPN 2
Forti SSL-VPN and IPsec tunnels run inside a container and are driven from a page in your browser. The machines behind them answer at a local address, so you connect with the RDP or SSH client you already have.
Your own network stays out of it. Nothing to install but Docker.
Latest release: checking…
Unpack the archive and run start.bat, or start.sh
away from Windows. The Docker image is inside, so the first start loads it
from the file: nothing is built and nothing is pulled from a registry.
It needs Docker Desktop running, and nothing else. Most of the archive is the image itself, which is why it is large; once it is loaded the panel works with no internet beyond Docker. Later versions the panel can fetch from this page by itself.
The panel is in Polish. It opens at
http://fortivpn.localhost:25263 and keeps running in the
background with Docker, so there is no terminal to leave open.
A tunnel per client, each in its own network namespace, and a local address for every machine you need to reach.
Forti SSL-VPN, and IPsec for FortiGate dial-up: IKEv1 with a shared key and XAuth, IKEv1 or IKEv2 on the key alone. A FortiToken is appended to the password, which is how XAuth takes it. Certificate and EAP authentication are not supported; for those, SSL-VPN remains.
Every connection lives in its own network namespace, so two clients using the same address ranges do not collide. SSL-VPN and IPsec mix freely.
Each forwarded port gets its own loopback address, 13391 on
127.0.0.2 and so on. Windows files RDP credentials under
the address without the port, so one shared localhost would
have machines overwriting each other's passwords.
The first connection usually presents a certificate the panel has not seen. It offers to trust it and carry on, instead of asking you to copy hashes between files.
“Connect over RDP” opens the remote desktop straight at the address:
no .rdp file saved, no unknown-publisher warning, clipboard
and printers working from the first second. A machine can also be added
to a connection that is already up, without dropping it.
Once a day the panel asks this page whether a newer version exists and shows a bar above the list with the version, the date and the size. On Windows one button downloads and installs it, keeping the connections you saved. Turn the check off and the panel talks to nothing but your tunnels.
The moments that usually cost the most time, and the one that used to cost a download.
Credentials for someone else's network deserve more care than a text file.
One master password unlocks the panel, and everything saved sits encrypted under it with scrypt and AES-256-GCM. It cannot be recovered, which is the point, so it is worth remembering.
The panel and every forwarded port listen on the loopback range and nowhere else. Nothing on your network can reach a tunnel you opened.
The tunnel is established inside the container, not in your operating system's routing. Your machine does not join the client's network; it only talks to the forwards you asked for.
Settings export every connection to one .enc file, still
encrypted under the master password, for a backup or for moving the
panel to another computer. The export button is on the lock screen too,
so a copy does not require unlocking the vault.