Set Up Sophos Firewall Remote Access on Linux

The easiest way to use Sophos Firewall Remote Access on Linux is SSL VPN with the standard OpenVPN client. Sophos Connect is not available for Linux. Download the .ovpn file from the VPN Portal and use it either in the terminal or through NetworkManager.

The previously recommended IPsec alternative using NetworkManager-strongSwan is not compatible with the current Sophos Firewall configuration: Under SFOS 22, Remote access VPN > IPsec only accepts IKEv1 profiles, while the NetworkManager-strongSwan plugin supports IKEv2 exclusively.

⚠️ Do not install an unofficial “Sophos Connect for Linux” and do not change the SFOS Remote Access profile to IKEv2 for this guide. The following OpenVPN method is the Linux path documented by Sophos.

Separate guides are available for other devices: Sophos Connect on Windows and Sophos Connect on macOS, as well as SSL VPN on iPhone and iPad and SSL VPN on Android.

Requirements

• A Remote Access SSL VPN policy is configured on Sophos Firewall.
• The user or their group is assigned to this policy.
• A matching firewall rule allows the required traffic from the VPN zone.
• The user can access the VPN Portal and sign in.
• The Linux system has local sudo privileges for package installation and starting OpenVPN.
• If MFA is enabled, sign-in including the verification code works.

Set up Sophos Firewall SSL VPN Remote Access describes the firewall-side configuration. If the .ovpn file is later missing from the VPN Portal, first check the assignment of the user or group to the SSL VPN policy.

Set up SSL VPN with OpenVPN

1. Install OpenVPN

On Debian and Ubuntu, install the OpenVPN client as follows:

sudo apt install openvpn

Other distributions also provide the package through their package manager. For graphical management under GNOME, the NetworkManager OpenVPN plugin can also be installed:

sudo apt install network-manager-openvpn-gnome

Do not confuse this plugin with network-manager-strongswan. It imports the .ovpn file and uses OpenVPN.

2. Download the OpenVPN configuration

1. Open the Sophos Firewall VPN Portal in a browser.
2. Sign in with the VPN user.
3. Under VPN > VPN configuration, click Download configuration for Windows, macOS, Linux.
4. If several OpenVPN variants are shown, select the configuration that matches the installed client.
5. Download the .ovpn file and store it securely.

The file can contain certificates and user-specific connection data. Do not distribute it through unencrypted email or public storage.

3. Start the connection in the terminal

Change to the directory containing the file and start OpenVPN. Example using the filename sophos-vpn.ovpn:

chmod 600 sophos-vpn.ovpn
sudo openvpn --config sophos-vpn.ovpn

OpenVPN prompts for the username and password and, if applicable, the MFA code. The connection runs in the foreground. Closing the terminal or stopping the process with Ctrl+C also disconnects the tunnel.

4. Import the connection into NetworkManager

1. Open the network settings.
2. Add a new VPN connection and select Import from file.
3. Select the downloaded .ovpn file.
4. Save the username if this is appropriate for the operating model.
5. Start the connection and enter the password and, if applicable, the MFA code.

NetworkManager is more convenient for daily use than keeping a terminal open. However, unattended autostart is not automatically possible with interactive sign-in or MFA. Credentials should not be stored in an unprotected file solely to enable autostart.

Why NetworkManager-strongSwan is not suitable here

Under SFOS 22, Sophos only allows IKEv1 profiles for Remote access VPN > IPsec where Dead Peer Detection is disabled or set to Disconnect. The NetworkManager-strongSwan plugin, by contrast, only establishes IKEv2 connections. The two endpoints therefore cannot negotiate a tunnel with the previously described workflow.

The strongSwan software itself still supports IKEv1, but this is not the same GUI path as the NetworkManager plugin. A manual IKEv1 configuration requires matching parameters, authentication, traffic selectors, and a tested client setup. Without a reliable target configuration, do not copy a generic example from the internet.

Sophos lists a compatible third-party client as an option for IPsec on Linux. However, the exported .tgb file does not contain all advanced settings from the Sophos Connect configuration and cannot simply be imported into NetworkManager as an IKEv2 profile. If IPsec is mandatory, the selected client must explicitly support the firewall’s IKEv1 setup and must be tested in the relevant environment. Sophos Connect or SSL VPN: Which Remote Access Solution Fits? helps with the general choice.

Verify the connection

After the connection is established, do not check only the client status. What matters is whether the route, DNS, and firewall rule match the intended destination.

These Linux commands are read-only. In the example, replace 10.20.30.40 with an allowed internal destination:

ip addr show
ip route get 10.20.30.40
getent hosts intranet.example.net

Expected results:

• OpenVPN reports a successful connection and a tunnel interface is present.
• The route check shows the VPN path for the internal destination instead of the normal internet gateway.
• The DNS check returns the internal address if the VPN policy distributes internal DNS servers.
• An allowed internal service is reachable; a deliberately disallowed destination remains blocked.
• The firewall’s Log Viewer shows the test traffic from the VPN zone with the expected rule.
• After signing in again, the MFA code is requested again as intended.

If the tunnel is established but no traffic flows, see Test a firewall rule with Log Viewer, Policy Test, and Packet Capture.

Common errors

• No Linux configuration in the VPN Portal: The user or group is not assigned to a Remote Access SSL VPN policy. Check the policy and Portal sign-in.
• OpenVPN reports an authentication error: Check the username, password, MFA process, group membership, and selected authentication method.
• The tunnel is established, but internal destinations remain unreachable: Check the permitted networks in the SSL VPN policy, the firewall rule from VPN to the destination zone, and the route to the internal network.
• IP addresses work, but internal names do not: Check the distributed DNS servers, search domain, and reachability of the internal DNS server.
• The terminal was closed and the connection was lost: This is normal when running openvpn --config directly. For graphical management, import the .ovpn file into NetworkManager.
• NetworkManager does not offer file import: The NetworkManager OpenVPN plugin is missing or the NetworkManager service has not yet loaded the newly installed plugin.
• An old .ovpn file no longer works: Download the file again after changes to the SSL VPN protocol, SSL server certificate or CA, Override hostname, or SSL VPN port.
• NetworkManager-strongSwan does not connect: Do not switch to IKEv2. The plugin is not compatible with the Sophos Firewall IKEv1 Remote Access profile.
• An alleged Sophos Connect client for Linux was found: Do not install it without verification. Sophos does not provide an official Linux client.

FAQ