GlobalProtect-openconnect

A modern GlobalProtect VPN client for Linux, built on OpenConnect with full support for SSO authentication. This project provides both command-line and graphical interfaces for seamless VPN connectivity.

Inspired by gp-saml-gui

Table of Contents

• Features
• Usage

- Command-Line Interface - Graphical User Interface

• Installation

- Debian / Ubuntu - Arch Linux / Manjaro - Fedora 38+ / Rawhide - openSUSE Leap 15.6+ / Tumbleweed - Other RPM-based Distributions - Alpine Linux - Gentoo - NixOS - Official Docker Image - Other Distributions

• Building from Source
• Frequently Asked Questions
• License

Features

• Cross-Platform Linux Support – Optimized for various Linux distributions
• Dual Interface – Available as both CLI and GUI applications
• Flexible Authentication – Supports SSO, non-SSO, FIDO2 (e.g., YubiKey), and client certificate authentication
• Browser Integration – Authenticate using your default browser or any specified browser
• Multi-Portal Support – Connect to multiple portals and gateways
• Direct Gateway Connection – Bypass portal selection when needed
• Auto-Connect – Automatically connect on system startup
• System Tray Integration – Convenient system tray icon (requires gnome-shell-extension-appindicator on GNOME)

Usage

Command-Line Interface

The CLI version is fully open source and feature-rich, providing nearly identical functionality to the GUI version.

Basic Commands

Usage: gpclient [OPTIONS] <COMMAND>
Commands:   connect     Connect to a portal server   disconnect  Disconnect from the server   launch-gui  Launch the GUI   help        Print this message or the help of the given subcommand(s)
Options:       --fix-openssl        Get around the OpenSSL 'unsafe legacy renegotiation' error       --ignore-tls-errors  Ignore TLS errors   -h, --help               Print help   -V, --version            Print version

Tip: Use gpclient help <command> for detailed information on a specific command.

External Browser Authentication

For browser-based authentication with the CLI:

Method 1: Using sudo with environment preservation:

sudo gpclient connect --browser <portal>

Method 2: Using authentication piping:

gpauth <portal> --browser 2>/dev/null | sudo gpclient connect <portal> --cookie-on-stdin

Browser Options:

• Use --browser to auto-select Chrome, Firefox, then the system default browser
• Use --browser default to use the system default browser
• Use --browser <browser> to specify a browser (e.g., firefox, chrome)
• Use --browser remote for headless servers – this provides a URL you can access from another machine to complete authentication

Graphical User Interface

The GUI application provides an intuitive interface for managing VPN connections. Launch it from your application menu or via the terminal:

gpclient launch-gui

[!Note]

>

The GUI version is partially open source. The background service (gpservice) is open source, while the GUI wrapper is proprietary.

Installation

[!Note]

>

For older Linux distributions, use v2.3.13 instead of the latest release. It provides release assets for common distro families, including Debian/Ubuntu (.deb), Arch Linux / Manjaro (.pkg.tar.zst), RPM-based distros such as Fedora / RHEL / Rocky / AlmaLinux / CentOS (.rpm), and generic Linux tarballs (.bin.tar.xz).

Debian / Ubuntu

Option 1: Install from PPA (Recommended)

sudo add-apt-repository ppa:yuezk/globalprotect-openconnect
sudo apt-get update
sudo apt-get install globalprotect-openconnect

[!Note]

>

For Linux Mint users: If you encounter a GPG key error, import the key manually:

> sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7937C393082992E5D6E4A60453FC26B43838D761

>

Option 2: Install from DEB Package

Download the latest .deb package from the releases page, then install:

sudo apt install --fix-broken globalprotect-openconnect_*.deb

Arch Linux / Manjaro

Option 1: Install from AUR

Package: globalprotect-openconnect-git

You can install it using an AUR helper like yay:

yay -S globalprotect-openconnect-git

Option 2: Install from the Official Extra Repository

The package is also available in the official Arch Linux Extra repository.

Package: globalprotect-openconnect

[!Note]

>

Since the official package does not include the system tray support dependency, you need to install libappindicator manually:

sudo pacman -S libappindicator globalprotect-openconnect

Option 3: Install from Package

Download the latest package from the releases page, then install:

sudo pacman -U globalprotect-openconnect-*.pkg.tar.zst

Fedora 38+ / Rawhide

Install from COPR

The package is available on COPR for RPM-based distributions:

sudo dnf copr enable yuezk/globalprotect-openconnect
sudo dnf install globalprotect-openconnect

openSUSE Leap 15.6+ / Tumbleweed

Install from OBS (openSUSE Build Service)

Packages are available on the openSUSE Build Service. Follow the installation instructions for your distribution.

Other RPM-based Distributions

Install from RPM Package

Download the latest RPM package from the releases page:

sudo rpm -i globalprotect-openconnect-*.rpm

Alpine Linux

Download the latest .apk package from the releases page, then install:

sudo apk add --allow-untrusted globalprotect-openconnect-*.apk

The package uses Alpine's native musl build. Make sure the community repository is enabled so GUI dependencies such as webkit2gtk-4.1, libsecret, and libayatana-appindicator can be resolved. GUI-launched connections use polkit, and VPN tunnel creation requires /dev/net/tun.

FreeBSD

Download the latest FreeBSD package from the releases page, then install:

sudo pkg install ./globalprotect-openconnect--freebsd-.pkg

To build from source, see Building from Source on FreeBSD and OpenBSD.

OpenBSD

Download the latest OpenBSD package from the releases page, then install:

doas pkg_add -D unsigned ./globalprotect-openconnect--openbsd-.tgz

To build from source, see Building from Source on FreeBSD and OpenBSD.

Gentoo

Available via the guru and lamdness overlays:

sudo eselect repository enable guru
sudo emerge --sync guru
sudo emerge --ask --verbose net-vpn/GlobalProtect-openconnect

NixOS

This repository includes a flake for NixOS integration.

Installation Steps

Add the flake input and package to your flake.nix:

{
  inputs = {
    # ... other inputs
    globalprotect-openconnect.url = "github:yuezk/GlobalProtect-openconnect";
  };
outputs = { self, nixpkgs, globalprotect-openconnect, ... }:     let       system = "x86_64-linux"; # or "aarch64-linux" for ARM64       hostname = "<your-host>";     in {       nixosConfigurations.${hostname} = nixpkgs.lib.nixosSystem {         inherit system;
modules = [           ./configuration.nix           {             services.ayatana-indicators.enable = true;
environment.systemPackages = [               globalprotect-openconnect.packages.${system}.default               nixpkgs.legacyPackages.${system}.gnomeExtensions.appindicator             ];           }         ];       };     }; }

Apply:

sudo nixos-rebuild switch
loginctl terminate-user "$USER"

After logging back in to GNOME, enable AppIndicator support if needed:

gnome-extensions enable appindicatorsupport@rgcjonas.gmail.com

Official Docker Image

The official Docker image provides the CLI tools on Alpine Linux:

docker pull yuezk/globalprotect-openconnect:<version>

Release images are tagged as vX.Y.Z, X.Y.Z, and latest.

Run it with access to the TUN device:

docker run --rm -it --cap-add=NET_ADMIN --device=/dev/net/tun \
  yuezk/globalprotect-openconnect:<version> \
  connect <portal> --cookie-on-stdin

For browser authentication in a headless environment, use remote browser authentication:

docker run --rm -it --cap-add=NET_ADMIN --device=/dev/net/tun \
  yuezk/globalprotect-openconnect:<version> \
  connect <portal> --browser remote

On a Linux host, add host networking if the VPN routes should affect the host network namespace:

docker run --rm -it --network host --cap-add=NET_ADMIN --device=/dev/net/tun \
  yuezk/globalprotect-openconnect:<version> \
  connect <portal> --browser remote

Without --network host, the VPN connection stays inside the container's network namespace. Docker Desktop on macOS and Windows does not make the host use the VPN through --network host; run gpclient on the host or use a container gateway setup for host traffic.

Alternatively, pipe gpauth remote-browser output into gpclient:

docker run --rm -it --entrypoint gpauth yuezk/globalprotect-openconnect:<version> \
  <portal> --browser remote 2>/dev/null \
  | docker run --rm -i --cap-add=NET_ADMIN --device=/dev/net/tun \
      yuezk/globalprotect-openconnect:<version> \
      connect <portal> --cookie-on-stdin

The image includes gpclient and gpauth only. It does not include embedded webview authentication, gpgui-helper, or gpgui.

Other Distributions

Manual Installation

• Install dependencies:

- webkit2gtk - libsecret - libayatana-appindicator or libappindicator-gtk3

• Download and extract:

Download globalprotect-openconnect${version}${arch}.bin.tar.xz from the releases page:

tar -xJf globalprotect-openconnect${version}${arch}.bin.tar.xz

• Install:

sudo make install

Building from Source

You can build the application from source using either a DevContainer (recommended) or a local development environment.

Method 1: Using DevContainer (Recommended)

This project includes a DevContainer configuration that provides a consistent, reproducible build environment with all dependencies pre-installed.

Prerequisites

• Docker
• Visual Studio Code (optional, for IDE support)
• Dev Containers extension (if using VS Code)

Build Steps

• Clone the repository:

git clone https://github.com/yuezk/GlobalProtect-openconnect.git
   cd GlobalProtect-openconnect
   git submodule update --init --recursive

• Build the DevContainer image:

docker build -t gpoc-devcontainer .devcontainer/

• Build the project:

To build everything including the GUI helper run this command:

docker run --privileged --cap-add=NET_ADMIN --device=/dev/net/tun \
     --tty -v "$(pwd)":/workspace -w /workspace gpoc-devcontainer \
     bash -c "export PATH=/usr/local/cargo/bin:\$PATH && make build"

To build without the GUI helper run the same command as above, but with BUILDGUIHELPER=0 passed as an argument to make.

• Locate build artifacts:

The compiled binaries will be available in target/release/: - gpclient – CLI client - gpservice – Background service - gpauth – Authentication helper - gpgui-helper – GUI helper

Alternative: Using VS Code

• Open the project in VS Code
• When prompted, click "Reopen in Container" (or run Dev Containers: Reopen in Container)
• Once the container is ready, open a terminal and run:

make build

Method 2: Local Development Build

Prerequisites

• Rust 1.89 or later
• Tauri dependencies
• OpenConnect source-build dependencies: autoconf, automake, autopoint/gettext, libtool, patch, pkg-config, libxml2, zlib, lz4, gnutls, p11-kit, nettle, and gmp development packages
• pkexec and gnome-keyring (or pam_kwallet on KDE)
• nodejs and pnpm (optional)

Build Steps

• Download source code:

Download globalprotect-openconnect-${version}.tar.gz from the releases page.

• Extract and build:

tar -xzf globalprotect-openconnect-${version}.tar.gz
   cd globalprotect-openconnect-${version}
   make build

• Install:

sudo make install

> Note: DESTDIR is not currently supported.

Testing Your Build

Verify the CLI client is working correctly:

./target/release/gpclient --help

Build Options

• BUILDGUIHELPER=0 – Build CLI components only (excludes GUI)
• OFFLINE=1 – Build in offline mode using vendored dependencies

Frequently Asked Questions

Q: How do I resolve the "Secure Storage not ready" error?

Solution 1: Update to version 2.2.0 or later, which includes a file-based storage fallback.

Solution 2: Install the gnome-keyring package and restart your system.

See related issues: #321, #316

Q: How do I fix the "cannot open display" error when using CLI?

If you encounter (gpauth:18869): Gtk-WARNING **: 10:33:37.566: cannot open display:, try running the command with sudo -E:

sudo -E gpclient connect <portal>

See related issue: #316

Licensing

Trial and Pricing

The CLI version is completely free and open source. The GUI version is a paid application with a 7-day trial period after installation.

Open Source Licenses

This project consists of multiple components, each with its own license:

| Component | Type | License | |-----------|------|---------| | gpapi | Crate | MIT | | openconnect | Crate | GPL-3.0 | | common | Crate | GPL-3.0 | | auth | Crate | GPL-3.0 | | gpservice | Application | GPL-3.0 | | gpclient | Application | GPL-3.0 | | gpauth | Application | GPL-3.0 | | gpgui-helper | Application | GPL-3.0 |