### Configuration File Example

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Example content for an openfortivpn configuration file.

```ini
host = vpn-gateway
port = 8443
username = foo
set-dns = 0
pppd-use-peerdns = 0
# X509 certificate sha256 sum, trust only this one!
trusted-cert = e46d4aff08ba6914e64daa85bc6112a422fa7ce16631bff0b592a28556f993db
```

--------------------------------

### Build and Install Openfortivpn

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Builds and installs openfortivpn from source using standard autotools commands. The --prefix and --sysconfdir options specify installation and configuration directories.

```shell
./autogen.sh
./configure --prefix=/usr/local --sysconfdir=/etc
make
sudo make install
```

--------------------------------

### Install Homebrew and openfortivpn on macOS

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Commands to install Homebrew and then openfortivpn on macOS.

```shell
# Install 'Homebrew'
/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
```

```shell
# Install 'openfortivpn'
brew install openfortivpn
```

--------------------------------

### Configure resolv.conf with openresolv

Source: https://github.com/adrienverge/openfortivpn/wiki/Home

Example scripts for managing /etc/resolv.conf using openresolv when openfortivpn is run with --no-dns. Ensure /sbin/resolvconf is executable.

```sh
#!/bin/sh
 
[ -x /sbin/resolvconf ] || exit 0
/sbin/resolvconf -f -d "$PPP_IFACE"
```

```sh
#!/bin/sh

[ -x /sbin/resolvconf ] || exit 0

if [ -n "$DNS1" -o -n "$DNS2" ]; then
        conf="# Generated by ppp.ip-up for $PPP_IFACE\n"
        [ -n "$DNS1" ] && conf="${conf}nameserver $DNS1\n"
        [ -n "$DNS2" ] && conf="${conf}nameserver $DNS2\n"
        printf "$conf" | /sbin/resolvconf -a "$PPP_IFACE"
fi
```

--------------------------------

### Build and Install Openfortivpn with Legacy PPP Support

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Builds and installs openfortivpn with support for legacy pppd versions (pre-2.5.0), commonly found on macOS. This is achieved using the --enable-legacy-pppd configure option.

```shell
./autogen.sh
./configure --prefix=/usr/local --sysconfdir=/etc --enable-legacy-pppd
make
sudo make install
```

--------------------------------

### FreeBSD PPP Configuration for OpenFortiVPN

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Example of how to configure openfortivpn to use FreeBSD's system PPP configuration. This involves specifying the PPP configuration file and settings.

```bash
# Use system configuration from /etc/ppp/ppp.conf
openfortivpn vpn-gateway:8443 -u foo --ppp-system=vpn-client
```

```ppp
vpn-client:
 set dial
 set speed 38400
 set mru 1354
 set login
 set timeout 0
 disable deflate pred1
 deny deflate pred1
```

--------------------------------

### Install Homebrew and Dependencies on macOS

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Installs Homebrew and necessary build dependencies like automake, autoconf, openssl@1.1, and pkg-config on macOS. Ensure openssl is available to compilers and pkg-config by exporting environment variables.

```shell
/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
```

```shell
brew install automake autoconf openssl@1.1 pkg-config
```

```shell
export LDFLAGS="-L/usr/local/opt/openssl/lib $LDFLAGS"
export CPPFLAGS="-I/usr/local/opt/openssl/include $CPPFLAGS"
export PKG_CONFIG_PATH="/usr/local/opt/openssl/lib/pkgconfig:$PKG_CONFIG_PATH"
```

--------------------------------

### OpenFortiVPN Environment Variables for PPP Scripts

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Lists environment variables set by openfortivpn that can be utilized within pppd scripts for dynamic network configuration. Includes examples of accessing gateway, route, and DNS information.

```bash
# Variables set by openfortivpn:
# VPN_GATEWAY        - IP address of the VPN gateway
# VPN_ROUTE_DEST_N   - Destination network for route N
# VPN_ROUTE_MASK_N   - Network mask for route N
# VPN_ROUTE_GATEWAY_N - Gateway for route N

# Example usage in ip-up script:
#!/bin/bash
echo "Connected to gateway: $VPN_GATEWAY"
echo "DNS1: $DNS1"
echo "DNS2: $DNS2"
echo "Interface: $PPP_IFACE"
```

--------------------------------

### Managing OpenFortiVPN Systemd Service

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Commands to enable, start, check status, and view logs for an openfortivpn systemd service instance using a specific configuration (e.g., 'work').

```bash
# Enable and start service for 'work' configuration
sudo systemctl enable openfortivpn@work
sudo systemctl start openfortivpn@work

# Check status
sudo systemctl status openfortivpn@work

# View logs
sudo journalctl -u openfortivpn@work -f
```

--------------------------------

### Install openfortivpn with MacPorts on macOS

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Command to install openfortivpn using MacPorts on macOS.

```shell
# Install 'openfortivpn'
sudo port install openfortivpn
```

--------------------------------

### Configure Sudoers for Openfortivpn

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Configures sudoers to allow specific users or groups to run openfortivpn without a password. This example creates an alias for the openfortivpn command and grants access to the 'adm' group.

```shell
visudo -f /etc/sudoers.d/openfortivpn
```

```text
Cmnd_Alias  OPENFORTIVPN = /usr/bin/openfortivpn

%adm       ALL = (ALL) OPENFORTIVPN
```

--------------------------------

### Smartcard PKCS#11 URIs

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Examples of PKCS#11 token URIs for smartcard authentication.

```ini
user-cert = pkcs11:
```

```ini
user-cert = pkcs11:token=someuser
```

```ini
user-cert = pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=012345678;token=someuser
```

```ini
username =
```

```ini
password =
```

--------------------------------

### Certificate-Based Authentication for VPN

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Authenticates using client certificates, either as a replacement for or in addition to username/password. This is common for mutual TLS authentication setups.

```bash
# Connect with user certificate and key (no password)
openfortivpn vpn-gateway:8443 --username= --password= \
  --user-cert=/path/to/cert.pem \
  --user-key=/path/to/key.pem
```

```bash
# With passphrase-protected key
openfortivpn vpn-gateway:8443 --username= --password= \
  --user-cert=/etc/openfortivpn/user-cert.pem \
  --user-key=/etc/openfortivpn/user-key.pem \
  --pem-passphrase=keypassword
```

```bash
# Use custom CA bundle for server verification
openfortivpn vpn-gateway:8443 -u user \
  --ca-file=/etc/openfortivpn/ca-bundle.pem
```

```ini
host = vpn.example.org
port = 443
username = 
password = 
user-cert = /etc/openfortivpn/user-cert.pem
user-key = /etc/openfortivpn/user-key.pem
pem-passphrase = keypassword
```

--------------------------------

### Get Server Certificate Info

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Retrieve the server certificate information, specifically its SHA256 digest, which can then be used with the --trusted-cert option.

```bash
openssl s_client -connect vpn-gateway:8443 </dev/null 2>/dev/null | \
  openssl x509 -outform DER | \
  openssl dgst -sha256
```

--------------------------------

### Using a Configuration File

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Connect to a VPN using settings defined in a configuration file.

```shell
openfortivpn -c /etc/openfortivpn/my-config
```

--------------------------------

### OpenFortiVPN Logging and Debugging Options

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Demonstrates various command-line options for controlling the verbosity of openfortivpn's output and directing logs. Includes options for verbose, very verbose, quiet modes, logging to syslog, and enabling pppd debug logging.

```bash
# Verbose output
openfortivpn vpn-gateway:8443 -u foo -v

# Very verbose output
openfortivpn vpn-gateway:8443 -u foo -v -v

# Quiet mode (less output)
openfortivpn vpn-gateway:8443 -u foo -q

# Log to syslog instead of terminal
openfortivpn vpn-gateway:8443 -u foo --use-syslog

# Enable pppd debug logging
openfortivpn vpn-gateway:8443 -u foo --pppd-log=/var/log/pppd.log

# Combined debugging
openfortivpn vpn-gateway:8443 -u foo -v -v --pppd-log=/var/log/pppd.log
```

--------------------------------

### Connect using SAML Login

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Initiate a VPN connection using SAML for authentication.

```shell
openfortivpn vpn-gateway:8443 --saml-login
```

--------------------------------

### Use resolvconf for DNS Management

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Configure openfortivpn to use the resolvconf utility for managing DNS settings.

```bash
openfortivpn vpn-gateway:8443 -u foo --use-resolvconf=1
```

--------------------------------

### View openfortivpn Manual

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Access the manual page for detailed information on openfortivpn usage and options.

```shell
man openfortivpn
```

--------------------------------

### Basic VPN Connection with Username

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Establishes a VPN connection using username and password. The client will prompt for the password if it's not explicitly provided.

```bash
# Simple connection with username (will prompt for password)
openfortivpn vpn-gateway.example.com:8443 --username=myuser
```

```bash
# Connection with explicit port and password
openfortivpn vpn.example.com:443 -u myuser -p mypassword
```

```bash
# Connect with verbose output for debugging
openfortivpn vpn-gateway:8443 --username=foo -v
```

```bash
# Very verbose output
openfortivpn vpn-gateway:8443 --username=foo -v -v
```

--------------------------------

### Systemd Service Configuration for OpenFortiVPN

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Configure openfortivpn to run as a systemd service. This enables automatic startup and restart capabilities. Ensure the configuration file exists at `/etc/openfortivpn/work.conf`.

```ini
host = vpn.example.com
port = 443
username = employee
pinentry = pinentry-gnome3
trusted-cert = e46d4aff08ba6914e64daa85bc6112a422fa7ce16631bff0b592a28556f993db
set-dns = 1
set-routes = 1
```

```systemd
[Unit]
Description=OpenFortiVPN for %I
After=network-online.target
Wants=network-online.target systemd-networkd-wait-online.service
Documentation=man:openfortivpn(1)

[Service]
Type=notify
PrivateTmp=true
ExecStart=/usr/bin/openfortivpn -c /etc/openfortivpn/%I.conf
Restart=on-failure
OOMScoreAdjust=-100

[Install]
WantedBy=multi-user.target
```

--------------------------------

### Connecting via HTTP Proxy with OpenFortiVPN

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Instructions for connecting to a VPN through an HTTP proxy that supports the CONNECT method. This is achieved by setting the `https_proxy` environment variable before running openfortivpn. Multiple environment variable names are supported.

```bash
# Set proxy via environment variable
export https_proxy=http://proxy.example.com:8080
openfortivpn vpn-gateway:8443 -u foo

# Alternative environment variables
export HTTPS_PROXY=http://proxy.example.com:8080
# or
export all_proxy=http://proxy.example.com:8080
# or
export ALL_PROXY=http://proxy.example.com:8080

openfortivpn vpn-gateway:8443 -u foo
```

--------------------------------

### Connect with User Certificate

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Establish a VPN connection using a user certificate and no password.

```shell
openfortivpn vpn-gateway:8443 --username= --password= --user-cert=cert.pem --user-key=key.pem
```

--------------------------------

### DNS Configuration in INI File

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Configure DNS settings using the openfortivpn configuration file. Options include disabling automatic DNS, using pppd's DNS handling, or utilizing resolvconf.

```ini
host = vpn-gateway
port = 8443
username = foo

# DNS configuration
set-dns = 0
pppd-use-peerdns = 0
# Or use resolvconf
# set-dns = 1
# use-resolvconf = 1
```

--------------------------------

### Run OpenFortiVPN without Password Prompt

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Use this command to connect to a VPN gateway without being prompted for a password. Ensure the username is provided.

```bash
sudo openfortivpn vpn-gateway:8443 -u foo
```

--------------------------------

### Custom PPP ip-up Script for OpenFortiVPN Routing and DNS

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

This script manages custom routing and DNS settings when a VPN connection is established via openfortivpn. It parses parameters from `PPP_IPPARAM` to add routes and configure `/etc/resolv.conf`.

```bash
#!/bin/bash
# Custom routing script for openfortivpn

case "$PPP_IPPARAM" in
    openfortivpn*) 
        rconf=/etc/resolv.conf
        routes=$(echo "$PPP_IPPARAM" | tr , ' ')
        for r in $routes; do
            [[ $r = "openfortivpn" ]] && continue
            com="ip route add ${r%/*} via ${r##*/}"
            echo "$com"
            $com
        done
        cp -pv $rconf $rconf.openfortivpn
        if [[ "$DNS1" ]]; then
            echo nameserver "$DNS1" > $rconf
            [[ "$DNS2" ]] && [[ "$DNS1" != "$DNS2" ]] && echo nameserver "$DNS2" >> $rconf
        fi
        exit 0
        ;; 
esac 2>&1 | logger -p daemon.debug -i -t "$0"

true
```

--------------------------------

### Add Specific Routes via pppd-ipparam

Source: https://github.com/adrienverge/openfortivpn/wiki/Home

Configure openfortivpn to pass specific IP addresses via pppd-ipparam and use a pppd ip-up script to add these as routes on Linux or macOS.

```sh
set-routes=0
pppd-ipparam=192.168.77.88 192.168.77.233 192.168.77.205
```

```sh
#!/bin/sh -e   

# $PPP_IFACE should also be available with $1, if needed.
logger "forticlient connection is up $PPP_IFACE connection ip routes: ${6}"
OS="$(uname)"
IPS="${6}"
for IP in ${IPS}
do
    if [ "$OS" = "Darwin" ]; then
      /sbin/route add "${IP}" -interface "${PPP_IFACE}"
    elif [ "$OS" = "Linux" ]; then
      ip route add "${IP}" dev "${PPP_IFACE}"
    fi
done
```

--------------------------------

### SAML/SSO Authentication for VPN

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Initiates a VPN connection using SAML-based single sign-on. This method involves a local web server to manage the SAML redirect flow.

```bash
# Start SAML login (default port 8020)
openfortivpn vpn-gateway:8443 --saml-login
```

```bash
# Specify custom local server port
openfortivpn vpn-gateway:8443 --saml-login=9000
```

--------------------------------

### Routing Configuration in INI File

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Configure routing settings using the openfortivpn configuration file. Options include disabling automatic routing or enabling half-internet routes.

```ini
host = vpn-gateway
port = 8443
username = foo

# Disable automatic routing
set-routes = 0

# Or use half-internet routes for split tunneling
# set-routes = 1
# half-internet-routes = 1
```

--------------------------------

### Connect to VPN with Realm

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Connect to a VPN specifying the gateway, username, and authentication realm.

```shell
openfortivpn vpn-gateway:8443 --username=foo --realm=bar
```

--------------------------------

### Use Half-Internet Routes

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Configure openfortivpn to use half-internet routes (0.0.0.0/1 and 128.0.0.0/1) for split tunneling.

```bash
openfortivpn vpn-gateway:8443 -u foo --half-internet-routes=1
```

--------------------------------

### Sudoers Configuration for OpenFortiVPN

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Configuration for `/etc/sudoers.d/openfortivpn` to allow non-root users, specifically members of the 'vpn' group, to execute the openfortivpn command without requiring a password.

```bash
# Edit sudoers
sudo visudo -f /etc/sudoers.d/openfortivpn
```

```sudoers
# Allow members of 'vpn' group to run openfortivpn
Cmnd_Alias  OPENFORTIVPN = /usr/bin/openfortivpn

%vpn       ALL = (ALL) NOPASSWD: OPENFORTIVPN
```

```bash
# Add user to vpn group
sudo usermod -aG vpn username
```

--------------------------------

### Use Specific pppd Plugin

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Specify a custom pppd plugin to be used for the VPN connection. Ensure the plugin path is correct for your system.

```bash
openfortivpn vpn-gateway:8443 -u foo --pppd-plugin=/usr/lib/pppd/2.4.9/some-plugin.so
```

--------------------------------

### Configuration File Usage for VPN Settings

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Utilizes a configuration file to manage persistent VPN settings. All command-line options can be specified in a key-value format within the file.

```bash
# Use a custom configuration file
openfortivpn -c /etc/openfortivpn/my-vpn.conf
```

```bash
# Default configuration file location: /etc/openfortivpn/config
```

```ini
# VPN gateway settings
host = vpn.example.org
port = 443
username = vpnuser
# password = VPNpassw0rd  # For security, use pinentry instead

# For secure password entry, use pinentry
pinentry = pinentry-gnome3

# Certificate trust (sha256 digest of server certificate)
trusted-cert = e46d4aff08ba6914e64daa85bc6112a422fa7ce16631bff0b592a28556f993db

# DNS and routing configuration
set-dns = 1
use-resolvconf = 1
set-routes = 1
half-internet-routes = 0

# pppd configuration
pppd-use-peerdns = 1

# TLS settings
insecure-ssl = 0
cipher-list = HIGH:!aNULL:!kRSA:!PSK:!SRP:!MD5:!RC4

# Auto-reconnect (0 = disabled, >0 = interval in seconds)
persistent = 0
```

--------------------------------

### Add Custom Routes with OpenFortiVPN Script

Source: https://github.com/adrienverge/openfortivpn/wiki/Home

This script dynamically adds routes for specified domains and IP ranges. It resolves domain names to IP addresses and then uses 'ip route add' to create the routes.

```bash
DOMAINS='example.com example.org'
IPS='10.0.0.0/8'

BASENAME=${0##*/}
INTERFACE=$1
DEVICE=$2
SPEED=$3
LOCALIP=$4
REMOTEIP=$5
IPPARAM=$6
ACTION=${0#/etc/ppp/}

let RESOLVED
for DOMAIN in $DOMAINS; do
  RESOLVED=`dig +short $DOMAIN | tail -n1`
  IPS="$IPS $RESOLVED"
done

for IP in $IPS; do
  ip route add $IP dev $INTERFACE
done
```

--------------------------------

### Connect to a VPN

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Basic command to connect to a VPN gateway with username authentication.

```shell
openfortivpn vpn-gateway:8443 --username=foo
```

--------------------------------

### Custom PPP ip-down Script for OpenFortiVPN Cleanup

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

This script cleans up network configurations, specifically restoring the original `/etc/resolv.conf` file when an openfortivpn VPN connection is terminated.

```bash
#!/bin/bash
# Cleanup script when VPN disconnects

case "$PPP_IPPARAM" in
    openfortivpn*) 
        rconf=/etc/resolv.conf
        [[ -f $rconf.openfortivpn ]] && cp -pv $rconf.openfortivpn $rconf
        exit 0
        ;; 
esac 2>&1 | logger -p daemon.debug -i -t "$0"

true
```

--------------------------------

### Provide OTP Directly

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Use this command to provide a one-time password directly when prompted for two-factor authentication.

```bash
openfortivpn vpn-gateway:8443 -u user --otp=123456
```

```bash
openfortivpn vpn-gateway:8443 -u user --otp=123456 --otp-delay=3
```

```bash
openfortivpn vpn-gateway:8443 -u user --otp-prompt="Enter token"
```

```bash
openfortivpn vpn-gateway:8443 -u user --no-ftm-push
```

--------------------------------

### Persistent Connection with Reconnection Interval

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Configure openfortivpn to automatically reconnect on connection failures. Specify the reconnection interval in seconds.

```bash
openfortivpn vpn-gateway:8443 -u foo --persistent=30
```

```bash
openfortivpn -c /etc/openfortivpn/config --persistent=60
```

--------------------------------

### Secure Password Entry with Pinentry

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Configure openfortivpn to use a pinentry program for secure password input, preventing exposure on the command line or in config files. Choose the appropriate pinentry program for your environment (GNOME, KDE, macOS, or TTY).

```bash
openfortivpn vpn-gateway:8443 --username=foo --pinentry=pinentry-gnome3
```

```bash
openfortivpn vpn-gateway:8443 --username=foo --pinentry=pinentry-qt
```

```bash
openfortivpn vpn-gateway:8443 --username=foo --pinentry=pinentry-mac
```

```bash
openfortivpn vpn-gateway:8443 --username=foo --pinentry=pinentry-curses
```

--------------------------------

### OpenFortiVPN Configuration for Custom PPP Scripts

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Configuration settings for openfortivpn when using custom PPP scripts. This disables automatic DNS and route setting, relying instead on the provided scripts. The `pppd-ipparam` option is crucial for passing parameters to the scripts.

```ini
host = vpn-gateway
port = 8443
username = foo
set-routes = 0
set-dns = 0
pppd-use-peerdns = 1
pppd-ipparam = openfortivpn,192.168.77.88/10.0.0.1,192.168.77.233/10.0.0.1
```

--------------------------------

### Smartcard/PKCS#11 Authentication for VPN

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Authenticates using a smartcard or hardware security module via the PKCS#11 interface. This provides a secure way to manage private keys.

```bash
# Basic smartcard usage (auto-detect token)
openfortivpn vpn-gateway:8443 --username= --password= --user-cert=pkcs11:
```

```bash
# Specify token name
openfortivpn vpn-gateway:8443 --username= --password= \
  --user-cert="pkcs11:token=someuser"
```

```bash
# Full PKCS#11 URI with model and serial
openfortivpn vpn-gateway:8443 --username= --password= \
  --user-cert="pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=012345678;token=someuser"
```

```ini
host = vpn-gateway
port = 8443
username = 
password = 
user-cert = pkcs11:
# Or with specific token:
# user-cert = pkcs11:token=someuser
```

--------------------------------

### Specify Minimum TLS Version

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Enforce a minimum TLS version for the connection to enhance security. Use this when the VPN gateway supports newer TLS versions.

```bash
openfortivpn vpn-gateway:8443 -u foo --min-tls=1.2
```

--------------------------------

### Kernel Modules for PPP

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Specifies kernel module configurations required for PPP functionality on Linux. Ensure these modules are compiled if managing your kernel manually.

```text
CONFIG_PPP=m
CONFIG_PPP_ASYNC=m
```

--------------------------------

### Enable pppd Debug Logging

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Enable detailed debug logging for the underlying pppd process. This is useful for troubleshooting connection issues.

```bash
openfortivpn vpn-gateway:8443 -u foo --pppd-log=/var/log/pppd.log
```

--------------------------------

### Disable IP Routes and DNS

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Connect to a VPN without setting IP routes or adding VPN nameservers to resolv.conf.

```shell
openfortivpn vpn-gateway:8443 -u foo --no-routes --no-dns --pppd-no-peerdns
```

--------------------------------

### Display Kernel IP Routing Table

Source: https://github.com/adrienverge/openfortivpn/wiki/Home

Use the 'route' command to view the current IP routing table of the Linux kernel. This helps in verifying network configurations and understanding traffic routing.

```bash
$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.10.254  0.0.0.0         UG    600    0        0 wlp3s0
one.one.one.one *               255.255.255.255 UH    0      0        0 ppp0
IP-OF-FIRST-DOMAIN *               255.255.255.255 UH    0      0        0 ppp0
IP-OF-SECOND-DOMAIN *               255.255.255.255 UH    0      0        0 ppp0
link-local      *               255.255.0.0     U     1000   0        0 br-cc6b09fa8986
172.16.238.0    *               255.255.255.0   U     0      0        0 br-30ec352ff3e1
172.17.0.0      *               255.255.0.0     U     0      0        0 docker0
172.18.0.0      *               255.255.0.0     U     0      0        0 br-44b22a74e13d
172.19.0.0      *               255.255.0.0     U     0      0        0 br-cc6b09fa8986
172.20.0.0      *               255.255.0.0     U     0      0        0 br-2718c069c2ed
192.168.10.0    *               255.255.255.0   U     600    0        0 wlp3s0
```

--------------------------------

### Secure Password Storage with Pinentry

Source: https://github.com/adrienverge/openfortivpn/blob/master/README.md

Connect to a VPN using a pinentry program for secure password handling.

```shell
openfortivpn vpn-gateway:8443 --username=foo --pinentry=pinentry-mac
```

--------------------------------

### Use pppd Call Script

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Utilize a pppd call script for managing the VPN connection, particularly useful for unprivileged access on Debian/Ubuntu systems.

```bash
openfortivpn vpn-gateway:8443 -u foo --pppd-call=openfortivpn
```

--------------------------------

### Persistent Connection in INI File

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Set the persistent connection option and reconnection interval within the openfortivpn configuration file.

```ini
host = vpn-gateway
port = 8443
username = foo
persistent = 30
```

--------------------------------

### Custom Route Management with pppd Scripts

Source: https://github.com/adrienverge/openfortivpn/wiki/Home

Disable default routing in openfortivpn and use a custom pppd ip-up script to manage specific network routes, allowing selective traffic through the VPN.

```sh
#!/bin/bash
#
# Example script for /etc/ppp/ip-up.d/openfortivpn
#
# Can be used to make internet work as usual having VPN running and only route Traffic
# for specified Networks to the VPN
#
# To use this, you may disable routing in /etc/openfortivpn/config like that:
#set-routes = 0
#half-internet-routes = 0
#
# Whitelist here all domains and ips (may be masked) that need to go through FortiVPN
# Domains are separated by a space

```

--------------------------------

### VPN Connection with Authentication Realm

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Connects to a VPN that requires a specific authentication realm, typically when the server manages multiple authentication domains.

```bash
# Connect with authentication realm
openfortivpn vpn-gateway:8443 --username=foo --realm=employees
```

```ini
# Realm in configuration file
# realm = employees
```

--------------------------------

### Disable Both Openfortivpn and pppd DNS Handling

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Completely disable DNS configuration by both openfortivpn and the underlying pppd process. This is useful when DNS is managed externally.

```bash
openfortivpn vpn-gateway:8443 -u foo --no-dns --pppd-no-peerdns
```

--------------------------------

### Set Custom Interface Name

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Assign a custom interface name to the VPN connection. Note that this feature may require a patched version of pppd.

```bash
openfortivpn vpn-gateway:8443 -u foo --pppd-ifname=fortivpn0
```

--------------------------------

### Evaluate ipparam in pppd Scripts

Source: https://github.com/adrienverge/openfortivpn/wiki/Home

Use this pattern within pppd ip-up or ip-down scripts to correctly evaluate the ipparam environment variable, which may contain shell expansions.

```sh
ipparam_raw=$6
ipparam=$(eval echo $ipparam_raw)
```

--------------------------------

### Lower Security Level for Older Servers

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Use a lower security level for TLS connections when connecting to older VPN servers that may not support higher security levels.

```bash
openfortivpn vpn-gateway:8443 -u foo --seclevel-1
```

--------------------------------

### Disable Automatic DNS Configuration

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Prevent openfortivpn from automatically configuring DNS servers. This allows for manual DNS management.

```bash
openfortivpn vpn-gateway:8443 -u foo --no-dns
```

--------------------------------

### Trust Specific Server Certificate

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Securely connect by trusting a specific server certificate using its SHA256 digest. This prevents man-in-the-middle attacks.

```bash
openfortivpn vpn-gateway:8443 -u foo \
  --trusted-cert=e46d4aff08ba6914e64daa85bc6112a422fa7ce16631bff0b592a28556f993db
```

--------------------------------

### Pass Custom ipparam to pppd Scripts

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Pass custom parameters to pppd scripts using the ipparam option. This allows for dynamic configuration of scripts based on connection details.

```bash
openfortivpn vpn-gateway:8443 -u foo --pppd-ipparam='device=$DEVICE'
```

--------------------------------

### Disable Automatic Route Configuration

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Prevent openfortivpn from automatically configuring IP routes. This provides full control over routing when the VPN tunnel is established.

```bash
openfortivpn vpn-gateway:8443 -u foo --no-routes
```

--------------------------------

### Custom Cipher List

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Define a custom cipher list for the TLS connection. This allows fine-grained control over the encryption algorithms used.

```bash
openfortivpn vpn-gateway:8443 -u foo --cipher-list="HIGH:!MD5:!RC4"
```

--------------------------------

### Cookie-Based Authentication

Source: https://context7.com/adrienverge/openfortivpn/llms.txt

Authenticate using a pre-obtained session cookie. This is useful when integrating with external authentication tools or complex SSO flows.

```bash
openfortivpn vpn-gateway:8443 --cookie=SVPNCOOKIE_VALUE
```

```bash
echo "SVPNCOOKIE_VALUE" | openfortivpn vpn-gateway:8443 --cookie-on-stdin
```

```bash
openfortivpn-webview https://vpn-gateway/remote/login | \
  openfortivpn vpn-gateway:8443 --cookie-on-stdin
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.