WatchGuard officially has clients only for Windows and Mac. But I see that it uses openvpn internally. I couldn't connect to WG from Linux.
Is there someone who actually get this working? How?
Follow these instructions - http://customers.watchguard.com/articles/Article/2870?retURL=/apex/knowledgeHome&popup=false Tested in Ubuntu 11 and Fedora 15 with XTM 11.x
Here is what I did to get WatchGuard/Firebox SSL VPN working on Ubuntu 11.10:
Getting the needed files
You will need the following files:
From a Windows computer
You will need access to a window computer that you can install their client on.
From the Firebox SSL box
This is from the Watchguard site. I haven't tried these instructions directly but they look reasonable.
From their document:
Needed software on Ubuntu
You will need to install a number of packages to connect from Ubuntu (this assumes the desktop version, things are likely different for the server version).
Testing from the command line
You can test if the connection is working from the command line. You don't have to do this but it may make things easier.
From the directory you copied the config/crt files:
Setting up network manager
The network manager is the icon in the panel bar at the top (currently the up/down arrows). You will need a number of lines out of the
This is an example
The rest of the settings are in the Advanced area (the advanced button at the bottom). In the General tab:
Under the Security tab:
Under the TLS Authentication tab:
I also needed to check "use this connection only for resource on its network" under the IPv4 Settings tab under the "Routes..." button.
There maybe more needed to setup things depending on how the Firebox SSL is setup but hopefully this will help as a starting point. Also you may want to watch the sys log if you have problems (tail -fn0 /var/log/syslog)
Thank you guys, I just tried a procedure described on Watchguard site (http://customers.watchguard.com/articles/Article/2870?retURL=/apex/knowledgeHome&popup=false)
I wrote a script to launch the connection and it works just fine.
or for the minimalist:
Get the certificates & config
For Watchguard XTM devices running 11.8+
It appears that the https://yourrouter.tld/sslvpn.html page that is used to pickup the windows client now also includes a generic ovpn configuration download saving the steps in the workaround. Simply login and go to that directory to get your configuration file. Congratulations on being equal with your windows and mac buddies.
Skip down to the "Create New VPN Connection" step.
For Watchguard XTM devices running 11.7 or less
These can be retrieved directly from the firewall (replace server with your own):
Alternately (I believe this is less secure because the password is sent in the request)(replace server, user and pass with your own):
Move client.wgssl to where you want to store the config and certs, perhaps /etc/openvpn. This will tar bomb you, so you'll want to create the folder for it to extract into.
Create new VPN connection
Open Network Connections and Add new. For type, under VPN, select "Import a saved VPN configuration..." Browse for the client.ovpn file in the folder you extracted client.wgssl.
Edit the newly created connection to include your username and password, or set password to "Always Ask".
Warning: The password is saved in an encryption that can be reversed.
If you don't want the VPN to take over all your traffic, just the traffic going to the remote location go to IPv4 Settings tab -> Routes and check "Use this connection only for resources on its network"