Is there a real way to connect to WatchGuard's VPN from Linux?

Question

WatchGuard officially has clients only for Windows and Mac. But I see that it uses openvpn internally. I couldn't connect to WG from Linux.

Is there someone who actually get this working? How?

Answer 1

Here is what I did to get WatchGuard/Firebox SSL VPN working on Ubuntu 11.10:

Getting the needed files

You will need the following files:

• ca.crt
• client.crt
• client.pem
• client.ovpn

From a Windows computer

You will need access to a window computer that you can install their client on.

1. Follow the instructions for installing their client.
2. Log in for the first time (this will make a number of files in the WatchGuard directory)
3. Copy the files from the WatchGuard directly (Normally C:\Documents and Settings{Username}\Application Data\WatchGuard\Mobile VPN)
4. The important ones are ca.crt, client.crt, client.pem, and client.ovpn (note the client.pem maybe something else ending in .key).
5. Copy these files over to your Ubuntu system.

From the Firebox SSL box

This is from the Watchguard site. I haven't tried these instructions directly but they look reasonable.

http://customers.watchguard.com/articles/Article/2870?retURL=/apex/knowledgeHome&popup=false

From their document:

1. Start WatchGuard System Manager and connect to your Firebox or XTM device.
2. Start Firebox System Manager.
3. Click the Status Report tab.
4. Click Support, located at the bottom-right corner of the window.
5. Click Browse to select the path on your computer where you want to save the support file. Click Retrieve. Wait while your support file is downloaded from the Firebox. This can take up to 20-30 seconds. A dialog box appears to tell you when the download is complete. By default, the support file has a name like 192.168.111.1_support.tgz.
6. Unzip the support file to a location on your computer that you have easy access to.
7. Unzip the Fireware_XTM_support.tgz file contained within the original file to the same location.

Needed software on Ubuntu

You will need to install a number of packages to connect from Ubuntu (this assumes the desktop version, things are likely different for the server version).

• openvpn (Likely already installed) (sudo apt-get install openvpn)
• network-manager open vpn plug in (sudo apt-get install network-manager-openvpn)

Testing from the command line

You can test if the connection is working from the command line. You don't have to do this but it may make things easier.

From the directory you copied the config/crt files:

sudo openvpn --config client.ovpn

Setting up network manager

The network manager is the icon in the panel bar at the top (currently the up/down arrows). You will need a number of lines out of the client.ovpn file so open it in an editor for reference.

This is an example client.ovpn:

dev tun
client
proto tcp-client
ca ca.crt
cert client.crt
key client.pem
tls-remote "/O=WatchGuard_Technologies/OU=Fireware/CN=Fireware_SSLVPN_Server"
remote-cert-eku "TLS Web Server Authentication"
remote 1.2.3.4 1000
persist-key
persist-tun
verb 3
mute 20
keepalive 10 60
cipher AES-256-CBC
auth SHA1
float 1
reneg-sec 3660
nobind
mute-replay-warnings
auth-user-pass

1. Click on the network manager icon
2. Select VPN Connections->Configure VPN...
3. Select Add.
4. Select the VPN tab
5. For User Certificate select the client.crt file (from the cert line)
6. For CA Certificate select the ca.crt file (from the ca line)
7. For Private Key select the client.pem file. (from the key line)
8. For my setup I also needed to set the type to Password with Certificates (TLS) (from the auth-user-pass line).
9. Gateway comes from the remote line. You need to copy the server name or IP address. In this example "1.2.3.4"

The rest of the settings are in the Advanced area (the advanced button at the bottom). In the General tab:

1. Use custom gateway port uses the last number from the remote line. In this example "1000"
2. Use TCP connection come from the proto line. In this case tcp-client.

Under the Security tab:

1. Cipher comes from the cipher line. (In this example AES-256-CBC)
2. 'HMAC Authentication' comes from the auth line. (In this example SHA1)

Under the TLS Authentication tab:

1. Subject Match comes from the `tls-remote' line. (In this example /O=WatchGuard_Technologies/OU=Fireware/CN=Fireware_SSLVPN_Server)

I also needed to check "use this connection only for resource on its network" under the IPv4 Settings tab under the "Routes..." button.

There maybe more needed to setup things depending on how the Firebox SSL is setup but hopefully this will help as a starting point. Also you may want to watch the sys log if you have problems (tail -fn0 /var/log/syslog)

Answer 2

Try this.

http://blog.microcozm.net/2010/03/watchguard-mobile-vpn-with-ssl-client.html

Answer 3

Follow these instructions - http://customers.watchguard.com/articles/Article/2870?retURL=/apex/knowledgeHome&popup=false Tested in Ubuntu 11 and Fedora 15 with XTM 11.x

Answer 4

I am not going to say it is impossible, but I have not found any easy, user friendly solution that is like using the PPTP VPN and Windows. If you find something, please post it here because I have been looking for this for several months.