GlobalProtect-openconnect

https://github.com/yuezk/globalprotect-openconnect
Admin
GlobalProtect-openconnect is a modern GlobalProtect VPN client for Linux, built on OpenConnect with...
Tokens:7,574
Snippets:87
Trust Score:9.3
License:GPL-3.0
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### Install manually with make

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Install the extracted binaries using make.

```bash
sudo make install
```

--------------------------------

### Build and install on FreeBSD

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/docs/bsd-source-build.md

Builds the project with Cargo and installs it on FreeBSD using gmake.

```sh
cd gp
cargo build --release --workspace

sudo gmake install-bsd
```

--------------------------------

### Build and install on OpenBSD

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/docs/bsd-source-build.md

Builds the project with Cargo and installs it on OpenBSD using gmake.

```sh
cd gp
cargo build --release --workspace

doas gmake install-bsd
```

--------------------------------

### Install from Guru overlay on Gentoo

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Enables the guru overlay, syncs it, and installs the package using emerge.

```bash
sudo eselect repository enable guru
sudo emerge --sync guru
sudo emerge --ask --verbose net-vpn/GlobalProtect-openconnect
```

--------------------------------

### Install package on FreeBSD

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Installs a downloaded FreeBSD package using pkg.

```bash
sudo pkg install ./globalprotect-openconnect-*-freebsd-*.pkg
```

--------------------------------

### Install from PPA on Debian/Ubuntu

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Adds the GlobalProtect-openconnect PPA and installs the package using apt. Recommended for Debian/Ubuntu systems.

```bash
sudo add-apt-repository ppa:yuezk/globalprotect-openconnect
sudo apt-get update
sudo apt-get install globalprotect-openconnect
```

--------------------------------

### Extract manual installation archive

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Download and extract the release archive for manual installation.

```bash
tar -xJf globalprotect-openconnect_${version}_${arch}.bin.tar.xz
```

--------------------------------

### Basic gpclient configuration with openconnect-args

Source: https://github.com/yuezk/globalprotect-openconnect/wiki/Configuration

Shows the basic structure of the gpclient configuration file. The [*] section defines default settings, and each VPN gateway address gets its own section. The openconnect-args key passes extra parameters to the openconnect command.

```ini
[*]
openconnect-args=<value>

[vpn1.company.com]
openconnect-args=--servercert pin-sha256:y4vQpQl/w0NPJ4eKY11kC3jvg6Dvx0FzxYArz4/X6x0=
```

--------------------------------

### Check gpclient help

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/docs/bsd-source-build.md

Checks the CLI help for gpclient after installation.

```sh
gpclient --help
```

--------------------------------

### Install from AUR on Arch Linux/Manjaro

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Installs the globalprotect-openconnect-git package from the AUR using the yay helper.

```bash
yay -S globalprotect-openconnect-git
```

--------------------------------

### Install package on Arch Linux/Manjaro

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Installs a downloaded .pkg.tar.zst package using pacman.

```bash
sudo pacman -U globalprotect-openconnect-*.pkg.tar.zst
```

--------------------------------

### Install FreeBSD dependencies with pkg

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/docs/bsd-source-build.md

Installs build and runtime dependencies on FreeBSD using pkg.

```sh
sudo pkg install git rust libiconv gettext-tools autoconf automake libtool patch \
  gmake pkgconf libxml2 gnutls p11-kit nettle gmp gnome-keyring \
  libayatana-appindicator polkit webkit2-gtk_41
```

--------------------------------

### Install OpenBSD dependencies with pkg_add

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/docs/bsd-source-build.md

Installs build and runtime dependencies on OpenBSD using pkg_add.

```sh
doas pkg_add git rust libiconv gettext-tools autoconf-2.72 automake-1.17 \
  libtool patch gmake pkgconf libxml gnutls p11-kit nettle gmp \
  gnome-keyring polkit webkitgtk41
```

--------------------------------

### Install package on OpenBSD

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Installs a downloaded OpenBSD package using pkg_add with -D unsigned.

```bash
doas pkg_add -D unsigned ./globalprotect-openconnect-*-openbsd-*.tgz
```

--------------------------------

### Install from COPR on Fedora/RHEL

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Enables the COPR repository and installs the package using dnf on Fedora 38+ and Rawhide.

```bash
sudo dnf copr enable yuezk/globalprotect-openconnect
sudo dnf install globalprotect-openconnect
```

--------------------------------

### Install RPM package on RPM-based distros

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Installs a downloaded .rpm package using rpm.

```bash
sudo rpm -i globalprotect-openconnect-*.rpm
```

--------------------------------

### Launch GUI

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Launches the graphical user interface for managing VPN connections. Use this command to start the GUI application from the terminal.

```bash
gpclient launch-gui
```

--------------------------------

### Install from Extra repository on Arch Linux

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Installs the official globalprotect-openconnect package and the libappindicator dependency from the Extra repository.

```bash
sudo pacman -S libappindicator globalprotect-openconnect
```

--------------------------------

### Install APK package on Alpine Linux

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Installs a downloaded .apk package using apk with --allow-untrusted.

```bash
sudo apk add --allow-untrusted globalprotect-openconnect-*.apk
```

--------------------------------

### Verify FreeBSD binaries

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/docs/bsd-source-build.md

Verifies the installed binaries on FreeBSD.

```sh
gpclient --version
gpauth --version
```

--------------------------------

### Set Autoconf and Automake versions on OpenBSD

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/docs/bsd-source-build.md

Sets environment variables to use the installed Autoconf and Automake versions on OpenBSD.

```sh
export AUTOCONF_VERSION=2.72
export AUTOMAKE_VERSION=1.17
```

--------------------------------

### Install DEB package on Debian/Ubuntu

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Installs a downloaded .deb package with apt, using --fix-broken to resolve dependencies.

```bash
sudo apt install --fix-broken globalprotect-openconnect_*.deb
```

--------------------------------

### Test CLI client

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Displays help information for the gpclient CLI client to verify the build.

```bash
./target/release/gpclient --help
```

--------------------------------

### Show help for connect command

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/packaging/docker/README.md

Shows help for the connect command.

```bash
docker run --rm yuezk/globalprotect-openconnect:<version> help connect
```

--------------------------------

### Build project with GUI helper

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Runs the build inside the DevContainer with privileged access and network capabilities. Pass BUILD_GUI_HELPER=0 to make to exclude the GUI helper.

```bash
docker run --privileged --cap-add=NET_ADMIN --device=/dev/net/tun \
  --tty -v "$(pwd)":/workspace -w /workspace gpoc-devcontainer \
  bash -c "export PATH=/usr/local/cargo/bin:\$PATH && make build"
```

--------------------------------

### Show top-level help

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/packaging/docker/README.md

Shows top-level help for the container.

```bash
docker run --rm yuezk/globalprotect-openconnect:<version> --help
```

--------------------------------

### gpclient CLI help output

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Displays the full command-line help for the gpclient binary, listing subcommands (connect, disconnect, launch-gui, hip, help) and global options such as --fix-openssl, --ignore-tls-errors, --log-format, -v, -q, -h, and -V. Use this to see available commands and flags.

```bash
Usage: gpclient [OPTIONS] <COMMAND>

Commands:
  connect     Connect to a portal server
  disconnect  Disconnect from the server
  launch-gui  Launch the GUI
  hip         Generate HIP report
  help        Print this message or the help of the given subcommand(s)

Options:
      --fix-openssl              Uses extended compatibility mode for OpenSSL operations to support a broader range of systems and formats.
      --ignore-tls-errors        Ignore the TLS errors
      --log-format <LOG_FORMAT>  Log output format. JSON is intended for non-interactive consumers; interactive prompts remain text. [default: text] [possible values: text, json]
  -v, --verbose...               Enable verbose output, -v for debug, -vv for trace
  -q, --quiet...                 Decrease logging verbosity, -q for warnings, -qq for errors
  -h, --help                     Print help (see more with '--help')
  -V, --version                  Print version
```

--------------------------------

### External browser authentication with sudo

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Runs the connect command with sudo while preserving the environment to allow the browser to be launched with the user's credentials. Use this method when you need to run the client with elevated privileges and want the browser to open automatically.

```bash
sudo gpclient connect --browser <portal>
```

--------------------------------

### Apply NixOS configuration and restart session

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Apply the NixOS configuration and terminate the user session to pick up the new environment.

```bash
sudo nixos-rebuild switch
loginctl terminate-user "$USER"
```

--------------------------------

### Run gpauth and pipe to gpclient

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/packaging/docker/README.md

Runs gpauth separately and pipes its remote-browser output into gpclient for authentication.

```bash
docker run --rm -it --entrypoint gpauth yuezk/globalprotect-openconnect:<version> \
  <portal> --browser remote 2>/dev/null \
  | docker run --rm -i --cap-add=NET_ADMIN --device=/dev/net/tun \
      yuezk/globalprotect-openconnect:<version> \
      connect <portal> --cookie-on-stdin
```

--------------------------------

### Connect with cookie authentication

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/packaging/docker/README.md

Runs the container to connect to a VPN portal using cookie authentication. Requires access to /dev/net/tun and the NET_ADMIN capability.

```bash
docker run --rm -it --cap-add=NET_ADMIN --device=/dev/net/tun \
  yuezk/globalprotect-openconnect:<version> \
  connect <portal> --cookie-on-stdin
```

--------------------------------

### Create unversioned Autoconf/Automake symlinks on OpenBSD

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/docs/bsd-source-build.md

Creates unversioned symlinks for Autoconf and Automake tools if the shell cannot resolve versioned commands automatically.

```sh
doas ln -sf /usr/local/bin/autoreconf-2.72 /usr/local/bin/autoreconf
doas ln -sf /usr/local/bin/autoconf-2.72 /usr/local/bin/autoconf
doas ln -sf /usr/local/bin/autoheader-2.72 /usr/local/bin/autoheader
doas ln -sf /usr/local/bin/autom4te-2.72 /usr/local/bin/autom4te
doas ln -sf /usr/local/bin/aclocal-1.17 /usr/local/bin/aclocal
doas ln -sf /usr/local/bin/automake-1.17 /usr/local/bin/automake
```

--------------------------------

### Run gpclient with sudo -E to fix 'cannot open display' error

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Use this command when encountering the 'cannot open display' error with the CLI. The -E flag preserves the environment, which is necessary for the display to work. Replace <portal> with your actual portal address.

```bash
sudo -E gpclient connect <portal>
```

--------------------------------

### Clone repository with submodules

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Clones the GlobalProtect-openconnect repository and initializes all submodules recursively.

```bash
git clone https://github.com/yuezk/GlobalProtect-openconnect.git
cd GlobalProtect-openconnect
git submodule update --init --recursive
```

--------------------------------

### Import GPG key for Linux Mint

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Manually imports the GPG key for the PPA on Linux Mint to resolve a GPG key error.

```bash
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7937C393082992E5D6E4A60453FC26B43838D761
```

--------------------------------

### NixOS flake configuration

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Add the flake input and enable the NixOS module. The module builds with your system's pkgs so the GUI and system share the same Nixpkgs versions.

```nix
{
  inputs = {
    # ... other inputs
    globalprotect-openconnect.url = "github:yuezk/GlobalProtect-openconnect";
  };

  outputs = { self, nixpkgs, globalprotect-openconnect, ... }:
    let
      system = "x86_64-linux"; # or "aarch64-linux" for ARM64
      hostname = "<your-host>";
    in {
      nixosConfigurations.${hostname} = nixpkgs.lib.nixosSystem {
        inherit system;

        modules = [
          ./configuration.nix
          globalprotect-openconnect.nixosModules.default
          {
            programs.globalprotect-openconnect.enable = true;

            environment.systemPackages = [
              nixpkgs.legacyPackages.${system}.gnomeExtensions.appindicator
            ];
          }
        ];
      };
    };
}
```

--------------------------------

### Build DevContainer image

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Builds the DevContainer image with the tag 'gpoc-devcontainer' from the .devcontainer directory.

```bash
docker build -t gpoc-devcontainer .devcontainer/
```

--------------------------------

### Extract and build from source tarball

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Extracts the downloaded source tarball and runs the build command.

```bash
tar -xzf globalprotect-openconnect-${version}.tar.gz
cd globalprotect-openconnect-${version}
make build
```

--------------------------------

### Clone GlobalProtect-openconnect repository

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/docs/bsd-source-build.md

Creates a workspace directory and clones the GlobalProtect-openconnect repository with submodules.

```sh
mkdir gp-build
cd gp-build
git clone --recurse-submodules https://github.com/yuezk/GlobalProtect-openconnect.git gp
```

--------------------------------

### Connect with remote browser authentication

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/packaging/docker/README.md

Runs the container to connect using remote browser authentication, suitable for headless environments.

```bash
docker run --rm -it --cap-add=NET_ADMIN --device=/dev/net/tun \
  yuezk/globalprotect-openconnect:<version> \
  connect <portal> --browser remote
```

--------------------------------

### Multi-line openconnect-args with quoted tokens

Source: https://github.com/yuezk/globalprotect-openconnect/wiki/Configuration

Demonstrates multi-line mode for openconnect-args when a single line exceeds the 200-character limit. Tokens with spaces can be wrapped in double quotes, and three consecutive double quotes represent a literal quote character.

```ini
[*]
openconnect-args=--certificate ~/work/paloalto/mycert.pem
        --servercert pin-sha256:y4vQpQl/w0NPJ4eKY11kC3jvg6Dvx0FzxYArz4/X6x0=
        --script "vpn-slice 10.0.0.0/8 10.171.63.202 myvm1 mydev1 myub18 --domain mydomain.mydomain2.com"
```

--------------------------------

### Enable AppIndicator GNOME extension

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

After logging back in to GNOME, enable the AppIndicator extension if needed.

```bash
gnome-extensions enable appindicatorsupport@rgcjonas.gmail.com
```

--------------------------------

### Connect with host networking

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/packaging/docker/README.md

Runs the container with host networking so VPN routes affect the host network namespace. Without --network host, the VPN stays inside the container. Docker Desktop on macOS/Windows does not make the host use the VPN through --network host.

```bash
docker run --rm -it --network host --cap-add=NET_ADMIN --device=/dev/net/tun \
  yuezk/globalprotect-openconnect:<version> \
  connect <portal> --browser remote
```

--------------------------------

### External browser authentication with gpauth piping

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Pipes the authentication output from gpauth into the connect command via stdin, allowing the client to read the cookie without exposing it in the shell history. Use this method when you need to run the client with sudo and want to avoid passing the cookie on the command line.

```bash
gpauth <portal> --browser 2>/dev/null | sudo gpclient connect <portal> --cookie-on-stdin
```

--------------------------------

### Build in VS Code container

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/README.md

Runs the build command inside the VS Code DevContainer environment.

```bash
make build
```

--------------------------------

### Pull Docker image

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/packaging/docker/README.md

Pulls the Docker image. Release images are tagged as vX.Y.Z, X.Y.Z, and latest.

```bash
docker pull yuezk/globalprotect-openconnect:<version>
```

--------------------------------

### Webview font size auto-scaling workaround

Source: https://github.com/yuezk/globalprotect-openconnect/blob/main/apps/gpgui-helper/dist/index.html

Adjusts the root font size to counteract automatic scaling in webviews. It calculates the ratio between the computed font size and the default 16px, then sets the root font size to 16 divided by that ratio.

```javascript
/* workaround to webview font size auto scaling */
var htmlFontSize = getComputedStyle(document.documentElement).fontSize;
var ratio = parseInt(htmlFontSize, 10) / 16;
document.documentElement.style.fontSize = 16 / ratio + "px";
```
Tokens:
Raw