softfour/openfortivpn-gw repository overview

⁠OpenFortiVPN Client Gateway (Ubuntu Noble)

softfour/openfortivpn-gw is a lightweight container based on Ubuntu 24.04 (noble) that runs an OpenFortiVPN client and configures NAT/masquerade and iptables rules to route traffic from the container network through the VPN tunnel (ppp0). It also supports static routes and forwarding restrictions to specific subnets.

⁠Features

• Base image: ubuntu:noble
• Installed packages: openfortivpn, iptables, iproute2, iputils-ping, net-tools, procps, tzdata
• Automatic setup via /entrypoint:
  • Optional static routes (env ROUTE_MAPS)
  • Firewall with NAT to ppp0
  • Forwarding restriction to subnets (env FIREWALL_SUBNETS)
  • VPN started with config: /opt/openfortivpn/client.conf

⁠Requirements

• Network capabilities to manage iptables

⁠Quick start

docker run -d --name forti-gw \
  --cap-add=NET_ADMIN \
  -e TZ=UTC \
  -e ROUTE_MAPS="10.10.0.0/16:192.168.1.1, 172.16.0.0/12:192.168.1.1" \
  -e FIREWALL_SUBNETS="192.168.1.0/24; 192.168.2.0/24" \
  -v $(pwd)/client.conf:/opt/openfortivpn/client.conf:ro \
  softfour/openfortivpn-gw:latest

services:
  forti-gw:
    image: softfour/openfortivpn-gw:latest
    container_name: forti-gw
    cap_add:
      - NET_ADMIN
    environment:
      TZ: "UTC"
      ROUTE_MAPS: "10.10.0.0/16:192.168.1.1,172.16.0.0/12:192.168.1.1"
      FIREWALL_SUBNETS: "192.168.1.0/24; 192.168.2.0/24"
    volumes:
      - ./client.conf:/opt/openfortivpn/client.conf:ro
    restart: unless-stopped

⁠Environment Variables

• TZ (default: UTC) – Container timezone.
• ROUTE_MAPS (optional) – Comma/semicolon/space-separated list of CIDR:GATEWAY. Example: 10.10.0.0/16:192.168.1.1, 172.16.0.0/12:192.168.1.1. Adds routes with ip route add <CIDR> via <GATEWAY> dev eth0.
• FIREWALL_SUBNETS (optional) – Comma/semicolon/space-separated list of subnets allowed to forward traffic to ppp0. If unset, forwarding is allowed for all traffic.

⁠Files and Paths

• OpenFortiVPN configuration required: /opt/openfortivpn/client.conf (mount via volume)
• Entrypoint: /entrypoint

⁠Security & Notes

• Applies MASQUERADE on traffic to ppp0, allowing ESTABLISHED,RELATED connections.
• Use ROUTE_MAPS for multi-network static routing.
• Restrict VPN access to specific subnets with FIREWALL_SUBNETS.

⁠License

This container uses open source packages from Ubuntu. Please verify licensing for OpenFortiVPN and dependencies in your environment.