How to Configure the Barracuda VPN Client (>= 5.3.10) for Linux

You must configure the VPN Client settings before you start the Barracuda VPN Client from the Linux command line. Version 5.3.10 now supports non-root users who are members of the vpnusers-group to communicate with the root-privileged daemon. The new group will be created during the installation/update of the new client. If shadow-utils is not installed, you will be presented with instructions to manually add users to the group.

For special characters in user credentials to work, the codepage must be configured to support UTF-8 on the Barracuda CloudGen Firewall.

For more information, see Step 1 in How to Configure Offline Firewall Authentication in the CloudGen Firewall documentation.

1. Start the Barracuda VPN Client. At the command line, enter: barracudavpn-qt

2. The splash screen window screen for the VPN Client for Linux is displayed.

Open

3. Click CONNECT to connect to the configured VPN server, or:

4. Click SETTINGS to get access to the configurations.

Open

VPN profiles enable you to manage different configurations for multiple VPN Client accesses.

Open

1. The standard profile’s name is Default. You can add a new profile by clicking '+'.

2. For renaming a profile, click the Rename button.

3. For deleting a profile, you must select it and click Delete.

As the tab General suggests, you must first configure the basic settings so that the VPN Client can authenticate against an authentication server.

Open

Configure the following fields:

• Authentication – Select the option from the drop-down menu that matches your requirements best:

  • Public Key – The personal license needs to be placed as vpnpers.lic in the profile directory. For the Default profile this is /etc/barracudavpn/profiles/Default/vpnpers.lic.

  • X509 Certificate

  • X509 Certificate + User/Password

  • User/Password only

• Server Address – Enter the IP address against the VPN Client must authenticate to.

• Server Port – The port number which the tunneling service must use for authentication. The preset value ‘691’ stands for the Barracuda Networks' VPN TINA tunnel implementation. If you must change the port number, ensure that the VPN server’s port on your firewall also matches this value.

• Change Server Password – Basically, your Linux VPN Client must be connected to change the server password.

• Change Local Password – To change the local password, you must first enter the current local password.

• Start minimized to system tray – If this check box is selected, the VPN Client will launch minimized in the UI.

• Start automatically on login – If the check box is selected, this option will launch the VPN Client on login automatically.

• Enable debug logging (daemon + UI) – If this check box is selected, logging for the daemon and the UI will be done more detailed for later debugging purposes.

General tab: TPM Credential Storage shows whether credentials are stored. Clear Stored Credentials deletes them.

In the Advanced Settings tab view, you can specify more detailed settings for the Barracuda VPN Client.

Open

In this section, not all settings are mandatory. Some settings depend on the configured proxy type.

• Special Mode – You can deactivate keepalive packets to the VPN server. You can select one of the following modes:

  • NONE – Normal operation.

  • SILENT – Deactivate keepalive packets to the VPN server. This mode allows adapters, such as ISDN cards, to hang up the line when idle. Otherwise, a connection is always triggered by communication between the client and server.

• Tunnel Mode – The protocol for the VPN tunnel. You can select TCP, UDP, Hybrid, or Optimized.

  • Hybrid (UDP + TCP) – Uses a combination of UDP and TCP. TCP traffic is tunneled via UDP and UDP user traffic is tunneled via TCP.

  • Optimized (UDP + TCP) – Uses a performance-optimized combination of UDP and TCP. All user traffic is tunneled as UDP (as in UDP mode) and VPN session information is sent through TCP for increased reliability.

• Tunnel Rekey Time – Time in minutes after which the client and server must exchange new keys.

• Tunnel Cipher – The tunnel encryption method. You can select from methods like AES128, AES256, AESCTR128, AESCTR256, CAST, Blowfish, 3DES, DES, NULL, CHACHA20.
  Note that CHACHA20 only provides POLY1305.

• Tunnel Auth – The tunnel authentication method. You can select from MD5, SHA, SHA256, and GCM.
  Note that GCM is only available for AES128/AES256.

• Source IP to use – The source IP address for your client.

• Keepalive – The timeout interval for reconnecting the tunnel. If you are using a GPRS connection, increase this setting to avoid permanent reconnects due to dropouts.

• Max Reconnect – The maximum number of attempts to reconnect to the VPN server after a breakdown of the VPN connection. A value of 0 is regarded to be unlimited.

• Write DNS – Specifies if the DNS configuration from the VPN or system is used. You can select one of the following options:

  • Yes – Use the DNS configuration that is provided by the VPN. The VPN domain that is configured on the VPN server is added to the search path in /etc/resolv.conf.

  • No – Use the DNS configuration from the system. 

  • Merge – Merge the DNS configurations from the VPN and system.

• DNS Mode – Depending on your individual requirement, chose one of the following options:

  • AUTO – The appropriate setting is selected automatically.

  • SYSTEMD_RESOLVED

  • RESOLV_CONF – The value determines which resolver must be used.

• Timeout (s) – Specifies the maximum period in seconds for the system to await the first connection.

• IPv6 Tunneling – Select either Yes or No if IPv6 traffic must be tunneled.

• OTP Mode – To activate OTP, set the value to DYNAMIC, STATIC or OFF.

In the Proxy Settings tab, configure as follows:

Open

• Proxy Type – If required, specify the proxy to be used. You can select one of the following types:

  • No Proxy – Uses a direct connection to the VPN server.

  • HTTP – Connect via an HTTP proxy, such as Squid.

  • Socks4 – Connect via a SOCKS4 server.

  • Socks5 – Connect via a SOCKS5 server.

• Proxy Server – Enter the IP address or host name of the proxy server.

• Proxy Port – Enter the proxy server port, e.g., 3128 or 8080

• Proxy Username – Enter the username to authenticate at the proxy server.

Finally, click Save to save or Cancel to discard all configuration values.

After configuring these parameters, restart the VPN client. During the next VPN session while trying to establish the connection, the VPN client will ask for the OTP if configured to do so.

Requires tpm2-tools and TPM 2.0 chip hardware. The user must be added to the tss group. When a user who isn't in the group starts the client, it offers to add them.

• Activate the check box for Use TPM in the login dialogue to seal your username and password to the TPM and store the sealed files under ~/.config/barracudavpn/. One set is created per profile. The sealed files only work with the TPM that created them.

After the login is confirmed, you can start using the VPN client. Continue with How to Establish a VPN Connection Using Barracuda VPN Client for Linux.