A GlobalProtect VPN client built on OpenConnect. It provides command-line tools (gpclient) and the GP Connect desktop application for macOS, Linux, FreeBSD, and OpenBSD.
Disclaimer: GP Connect is an independent third-party client for GlobalProtect VPN networks. It is not affiliated with or endorsed by Palo Alto Networks, Inc.
Inspired by gp-saml-gui
- Features
- Usage
- Installation
- Building from Source
- Troubleshooting
- NetworkManager Integration
- Licensing
- Multi-Platform – macOS (Apple silicon), Linux, FreeBSD, and OpenBSD
- Dual Interfaces – Fast terminal CLI (
gpclient) and desktop GUI (GP Connect) - Native Shell on Linux – Ultra-low-memory native desktop GUI alongside the webview interface
- Flexible Routing – Full System VPN tunnel or local SOCKS5 proxy mode
- Modern Authentication – SAML / SSO, MFA, FIDO2 (YubiKey), client certificates, and external browser login
- Automated HIP Reports – Built-in HIP report generation or custom scripts
- Multi-Portal & Direct Gateway – Manage multiple saved portals or connect directly to a gateway
- Desktop Integration – Theme-aware system tray icon, auto-connect on launch, and reconnect on wake
The open-source gpclient CLI handles authentication, connection lifecycle, and HIP generation:
# Connect to a portal server
sudo gpclient connect <portal>
# Connect using browser authentication (SSO / SAML)
sudo gpclient connect <portal> --browser
# Connect directly to a gateway server
sudo gpclient connect <gateway> --as-gateway
# Connect with automatic HIP report generation
sudo gpclient connect <portal> --hip
# Headless / remote server authentication (prints auth URL to open in any browser)
sudo gpclient connect <portal> --browser manual
# Disconnect
sudo gpclient disconnectRun gpclient --help or gpclient <command> --help to view all available commands and options.
- macOS: Open GP Connect from Applications.
- Linux / BSD: Launch GP Connect from your application menu or run:
gpclient launch-gui
Tip
On Linux, try Native Shell for lower memory usage. Switch between Native Shell and Tauri in Settings → General → Interface.
Requires Apple silicon and macOS 13+. Includes both GP Connect and the gpclient CLI.
brew install --cask yuezk/gp-connect/gp-connectDownload the .dmg from the releases page and drag GP Connect into Applications.
sudo add-apt-repository ppa:yuezk/globalprotect-openconnect
sudo apt-get update
sudo apt-get install globalprotect-openconnectDownload the latest .deb from the releases page:
sudo apt install ./globalprotect-openconnect_*.deb# Official Extra repository
sudo pacman -S globalprotect-openconnect
# AUR (git main)
yay -S globalprotect-openconnect-gitEnable the COPR repository:
sudo dnf copr enable yuezk/globalprotect-openconnect
sudo dnf install globalprotect-openconnectPackages are available on the openSUSE Build Service. Follow the OBS instructions for your distribution.
Download the latest .apk package from the releases page:
sudo apk add --allow-untrusted globalprotect-openconnect-*.apk(Requires community repository enabled for WebKitGTK and AppIndicator dependencies).
Download the latest FreeBSD package from the releases page:
sudo pkg install ./globalprotect-openconnect-*-freebsd-*.pkgDownload the latest OpenBSD package from the releases page:
doas pkg_add -D unsigned ./globalprotect-openconnect-*-openbsd-*.tgzAvailable via the guru repository:
sudo eselect repository enable guru
sudo emerge --sync guru
sudo emerge --ask net-vpn/GlobalProtect-openconnectAdd the flake to your flake.nix:
{
inputs.globalprotect-openconnect.url = "github:yuezk/GlobalProtect-openconnect";
outputs = { self, nixpkgs, globalprotect-openconnect, ... }: {
nixosConfigurations.<hostname> = nixpkgs.lib.nixosSystem {
modules = [
globalprotect-openconnect.nixosModules.default
{
programs.globalprotect-openconnect.enable = true;
}
];
};
}
}Apply changes:
sudo nixos-rebuild switchRun the CLI client in an official Alpine container:
docker run --rm -it --cap-add=NET_ADMIN --device=/dev/net/tun \
yuezk/globalprotect-openconnect:latest \
connect <portal> --browser manual(Add --network host on Linux if VPN routes should apply to the host network).
Download globalprotect-openconnect_${version}_${arch}.bin.tar.xz from the releases page:
tar -xJf globalprotect-openconnect_*.bin.tar.xz
cd globalprotect-openconnect_*
sudo make install- Rust 1.91 or later
- Build tools:
make,pkg-config,autoconf,automake,libtool,gettext - Libraries:
gmp,gnutls,nettle,libxml2,zlib,lz4,p11-kit,libsecret, andwebkit2gtk-4.1(or GTK 4 for Native Shell) - Polkit (
pkexec) for privileged tunnel setup
(For FreeBSD and OpenBSD instructions, see Building from Source on FreeBSD and OpenBSD).
git clone --recursive https://github.com/yuezk/GlobalProtect-openconnect.git
cd GlobalProtect-openconnect
make build
sudo make installBuild Options:
INCLUDE_GUI=1– Download and install the matching desktop application bundle.BUILD_WEBVIEW_AUTH=0– Buildgpauthwithout embedded browser authentication (uses external browser or manual mode).BUILD_GUI_HELPER=0– Skip building the helper UI.
- Headless / Remote Login: When running without a desktop display or over SSH, use
--browser manual. Open the printed URL in any browser and paste the callback URL back into the terminal. - Diagnostics: If you encounter issues, run
gpclient diagnosticsor follow the diagnostics guide when opening an issue.
- WMP/GlobalProtect-SAML-NetworkManager – NetworkManager VPN plugin with SAML/SSO support for GNOME and KDE Plasma
- jdpipe/networkmanager-gpclient – NetworkManager VPN plugin that uses
gpclient
- CLI (
gpclient): Free and open source (GPL-3.0). - GUI (GP Connect): Commercial desktop application with a free trial.
| Component | Type | License |
|---|---|---|
| gpapi | Crate | MIT |
| openconnect | Rust wrapper crate | MIT |
| upstream OpenConnect | C library | LGPL-2.1 |
| common | Crate | MIT |
| browser-launcher | Crate | MIT |
| auth | Crate | GPL-3.0 |
| gpservice | Application | GPL-3.0 |
| gpclient | Application | GPL-3.0 |
| gpauth | Application | GPL-3.0 |
| gpgui-helper | Application | GPL-3.0 |