GlobalProtect-openconnect

# GlobalProtect-openconnect A modern GlobalProtect VPN client for Linux, built on OpenConnect with full support for SSO authentication. This project provides both command-line and graphical interfaces for seamless VPN connectivity.

> **Inspired by** [gp-saml-gui](https://github.com/dlenski/gp-saml-gui) ## Table of Contents - [Features](#features) - [Usage](#usage) - [Command-Line Interface](#command-line-interface) - [Graphical User Interface](#graphical-user-interface) - [Installation](#installation) - [Debian / Ubuntu](#debian--ubuntu) - [Arch Linux / Manjaro](#arch-linux--manjaro) - [Fedora 38+ / Rawhide](#fedora-38--rawhide) - [openSUSE Leap 15.6+ / Tumbleweed](#opensuse-leap-156--tumbleweed) - [Other RPM-based Distributions](#other-rpm-based-distributions) - [Alpine Linux](#alpine-linux) - [Gentoo](#gentoo) - [NixOS](#nixos) - [Official Docker Image](#official-docker-image) - [Other Distributions](#other-distributions) - [Building from Source](#building-from-source) - [Frequently Asked Questions](#frequently-asked-questions) - [License](#license) ## Features - **Cross-Platform Linux Support** – Optimized for various Linux distributions - **Dual Interface** – Available as both CLI and GUI applications - **Flexible Authentication** – Supports SSO, non-SSO, FIDO2 (e.g., YubiKey), and client certificate authentication - **Browser Integration** – Authenticate using your default browser or any specified browser - **Multi-Portal Support** – Connect to multiple portals and gateways - **Direct Gateway Connection** – Bypass portal selection when needed - **Auto-Connect** – Automatically connect on system startup - **System Tray Integration** – Convenient system tray icon (requires [gnome-shell-extension-appindicator](https://extensions.gnome.org/extension/615/appindicator-support/) on GNOME) ## Usage ### Command-Line Interface The CLI version is fully open source and feature-rich, providing nearly identical functionality to the GUI version. #### Basic Commands ``` … ``` > **Tip:** Use `gpclient help ` for detailed information on a specific command. #### External Browser Authentication For browser-based authentication with the CLI: **Method 1:** Using sudo with environment preservation: ```bash sudo gpclient connect --browser ``` **Method 2:** Using authentication piping: ```bash gpauth --browser 2>/dev/null | sudo gpclient connect --cookie-on-stdin ``` **Browser Options:** - Use `--browser` to auto-select Chrome, Firefox, then the system default browser - Use `--browser default` to use the system default browser - Use `--browser ` to specify a browser (e.g., `firefox`, `chrome`) - Use `--browser remote` for headless servers – this provides a URL you can access from another machine to complete authentication ### Graphical User Interface The GUI application provides an intuitive interface for managing VPN connections. Launch it from your application menu or via the terminal: ```bash gpclient launch-gui ``` > [!Note] > > The GUI version is partially open source. The background service ([gpservice](./apps/gpservice/)) is open source, while the GUI wrapper is proprietary. ## Installation > [!Note] > > For older Linux distributions, use [v2.3.13](https://github.com/yuezk/GlobalProtect-openconnect/releases/tag/v2.3.13) instead of the latest release. It provides release assets for common distro families, including Debian/Ubuntu (`.deb`), Arch Linux / Manjaro (`.pkg.tar.zst`), RPM-based distros such as Fedora / RHEL / Rocky / AlmaLinux / CentOS (`.rpm`), and generic Linux tarballs (`.bin.tar.xz`). ### Debian / Ubuntu #### Option 1: Install from PPA (Recommended) ```bash sudo add-apt-repository ppa:yuezk/globalprotect-openconnect sudo apt-get update sudo apt-get install globalprotect-openconnect ``` > [!Note] > > **For Linux Mint users:** If you encounter a GPG key error, import the key manually: > ```bash > sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7937C393082992E5D6E4A60453FC26B43838D761 > ``` #### Option 2: Install from DEB Package Download the latest `.deb` package from the [releases](https://github.com/yuezk/GlobalProtect-openconnect/releases) page, then install: ```bash sudo apt install --fix-broken globalprotect-openconnect_*.deb ``` ### Arch Linux / Manjaro #### Option 1: Install from AUR Package: [globalprotect-openconnect-git](https://aur.archlinux.org/packages/globalprotect-openconnect-git/) You can install it using an AUR helper like [`yay`](https://github.com/Jguer/yay): ```bash yay -S globalprotect-openconnect-git ``` #### Option 2: Install from the Official Extra Repository The package is also available in the official Arch Linux Extra repository. Package: [globalprotect-openconnect](https://archlinux.org/packages/extra/x86_64/globalprotect-openconnect/) > [!Note] > > Since the official package does not include the system tray support dependency, you need to install `libappindicator` manually: ```bash sudo pacman -S libappindicator globalprotect-openconnect ``` #### Option 3: Install from Package Download the latest package from the [releases](https://github.com/yuezk/GlobalProtect-openconnect/releases) page, then install: ```bash sudo pacman -U globalprotect-openconnect-*.pkg.tar.zst ``` ### Fedora 38+ / Rawhide #### Install from COPR The package is available on [COPR](https://copr.fedorainfracloud.org/coprs/yuezk/globalprotect-openconnect/) for RPM-based distributions: ```bash sudo dnf copr enable yuezk/globalprotect-openconnect sudo dnf install globalprotect-openconnect ``` ### openSUSE Leap 15.6+ / Tumbleweed #### Install from OBS (openSUSE Build Service) Packages are available on the [openSUSE Build Service](https://build.opensuse.org/package/show/home:yuezk/globalprotect-openconnect). Follow the [installation instructions](https://software.opensuse.org//download.html?project=home%3Ayuezk&package=globalprotect-openconnect) for your distribution. ### Other RPM-based Distributions #### Install from RPM Package Download the latest RPM package from the [releases](https://github.com/yuezk/GlobalProtect-openconnect/releases) page: ```bash sudo rpm -i globalprotect-openconnect-*.rpm ``` ### Alpine Linux Download the latest `.apk` package from the [releases](https://github.com/yuezk/GlobalProtect-openconnect/releases) page, then install: ```bash sudo apk add --allow-untrusted globalprotect-openconnect-*.apk ``` The package uses Alpine's native musl build. Make sure the `community` repository is enabled so GUI dependencies such as `webkit2gtk-4.1`, `libsecret`, and `libayatana-appindicator` can be resolved. GUI-launched connections use polkit, and VPN tunnel creation requires `/dev/net/tun`. ### FreeBSD Download the latest FreeBSD package from the [releases](https://github.com/yuezk/GlobalProtect-openconnect/releases) page, then install: ```bash sudo pkg install ./globalprotect-openconnect-*-freebsd-*.pkg ``` To build from source, see [Building from Source on FreeBSD and OpenBSD](./docs/bsd-source-build.md). ### OpenBSD Download the latest OpenBSD package from the [releases](https://github.com/yuezk/GlobalProtect-openconnect/releases) page, then install: ```bash doas pkg_add -D unsigned ./globalprotect-openconnect-*-openbsd-*.tgz ``` To build from source, see [Building from Source on FreeBSD and OpenBSD](./docs/bsd-source-build.md). ### Gentoo Available via the `guru` and `lamdness` overlays: ```bash sudo eselect repository enable guru sudo emerge --sync guru sudo emerge --ask --verbose net-vpn/GlobalProtect-openconnect ``` ### NixOS This repository includes a flake for NixOS integration. #### Installation Steps Add the flake input and NixOS module to your `flake.nix`: The module builds the package with your NixOS configuration's `pkgs`, so the GlobalProtect GUI and the system use the same Nixpkgs dependency versions. ``` … ``` Apply: ```bash sudo nixos-rebuild switch loginctl terminate-user "$USER" ``` After logging back in to GNOME, enable AppIndicator support if needed: ```bash gnome-extensions enable [email protected] ``` ### Official Docker Image The official Docker image provides the CLI tools on Alpine Linux: ```bash docker pull yuezk/globalprotect-openconnect: ``` Release images are tagged as `vX.Y.Z`, `X.Y.Z`, and `latest`. Run it with access to the TUN device: ```bash docker run --rm -it --cap-add=NET_ADMIN --device=/dev/net/tun \ yuezk/globalprotect-openconnect: \ connect --cookie-on-stdin ``` For browser authentication in a headless environment, use remote browser authentication: ```bash docker run --rm -it --cap-add=NET_ADMIN --device=/dev/net/tun \ yuezk/globalprotect-openconnect: \ connect --browser remote ``` On a Linux host, add host networking if the VPN routes should affect the host network namespace: ```bash docker run --rm -it --network host --cap-add=NET_ADMIN --device=/dev/net/tun \ yuezk/globalprotect-openconnect: \ connect --browser remote ``` Without `--network host`, the VPN connection stays inside the container's network namespace. Docker Desktop on macOS and Windows does not make the host use the VPN through `--network host`; run `gpclient` on the host or use a container gateway setup for host traffic. Alternatively, pipe `gpauth` remote-browser output into `gpclient`: ```bash docker run --rm -it --entrypoint gpauth yuezk/globalprotect-openconnect: \ --browser remote 2>/dev/null \ | docker run --rm -i --cap-add=NET_ADMIN --device=/dev/net/tun \ yuezk/globalprotect-openconnect: \ connect --cookie-on-stdin ``` The image includes `gpclient` and `gpauth` only. It does not include embedded webview authentication, `gpgui-helper`, or `gpgui`. ### Other Distributions #### Manual Installation 1. **Install dependencies:** - `webkit2gtk` - `libsecret` - `libayatana-appindicator` or `libappindicator-gtk3` 2. **Download and extract:** Download `globalprotect-openconnect_${version}_${arch}.bin.tar.xz` from the [releases](https://github.com/yuezk/GlobalProtect-openconnect/releases) page: ```bash tar -xJf globalprotect-openconnect_${version}_${arch}.bin.tar.xz ``` 3. **Install:** ```bash sudo make install ``` ## Building from Source You can build the application from source using either a DevContainer (recommended) or a local development environment. ### Method 1: Using DevContainer (Recommended) This project includes a DevContainer configuration that provides a consistent, reproducible build environment with all dependencies pre-installed. #### Prerequisites - [Docker](https://docs.docker.com/get-docker/) - [Visual Studio Code](https://code.visualstudio.com/) (optional, for IDE support) - [Dev Containers extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers) (if using VS Code) #### Build Steps 1. **Clone the repository:** ```bash git clone https://github.com/yuezk/GlobalProtect-openconnect.git cd GlobalProtect-openconnect git submodule update --init --recursive ``` 2. **Build the DevContainer image:** ```bash docker build -t gpoc-devcontainer .devcontainer/ ``` 3. **Build the project:** To build everything including the GUI helper run this command: ```bash docker run --privileged --cap-add=NET_ADMIN --device=/dev/net/tun \ --tty -v "$(pwd)":/workspace -w /workspace gpoc-devcontainer \ bash -c "export PATH=/usr/local/cargo/bin:\$PATH && make build" ``` To build without the GUI helper run the same command as above, but with `BUILD_GUI_HELPER=0` passed as an argument to `make`. 5. **Locate build artifacts:** The compiled binaries will be available in `target/release/`: - `gpclient` – CLI client - `gpservice` – Background service - `gpauth` – Authentication helpe