You just connected to FortiClient VPN. The icon says “connected.” You feel safe. But open a browser and visit ipleak.net. Your real IP is still sitting there in plain view.
That’s the problem with FortiClient VPN privacy . The tool was designed so IT departments can give employees secure access to the company network. Privacy was never the default priority. If you’re using it to hide your traffic from your ISP, a landlord, or a public Wi-Fi snoop, you need to change several settings first.
This checklist walks you through exactly what to toggle, test, and verify so FortiClient actually protects your privacy—not just your corporate login.
Why FortiClient VPN Privacy Needs a Manual Tune-Up
FortiClient is not a consumer VPN. It’s a corporate endpoint security client that happens to include a VPN module. The default configuration assumes a trusted network on the other end. That means:
- The kill switch is optional, not automatic
- Split tunneling is often enabled
- IPv6 traffic can leak outside the tunnel
- DNS requests may still hit your local router
If you want real privacy—the kind that prevents your ISP from seeing your browsing or a coffee shop hacker from grabbing your session—you can’t just click “connect.” You have to lock down the client.
The 5-Step FortiClient VPN Privacy Checklist
Step 1: Enable the Kill Switch (It’s Off by Default)
Open FortiClient. Go to Settings > VPN > Kill Switch. Toggle it to On.
Test it: disconnect the VPN manually and see if your internet stops completely. If you can still load a page, the kill switch isn’t working. Try reinstalling the VPN module or check if your IT policy blocks the change.
Step 2: Pick the Right Protocol
FortiClient defaults to Automatic, which often picks SSL VPN. SSL VPN tunnels can leak DNS in certain setups. Switch to WireGuard (if your server supports it) or OpenVPN.
Go to the VPN connection settings and change Protocol from Auto to WireGuard or OpenVPN (TCP).
Step 3: Block IPv6 Manually
FortiClient does not always route IPv6 traffic through the tunnel. If your ISP assigns you an IPv6 address, your real location can leak.
On Windows, go to Network Settings > Change adapter options > Right-click your active connection > Properties and uncheck Internet Protocol Version 6 (TCP/IPv6).
On Mac, go to System Settings > Network > Advanced > TCP/IP > Configure IPv6 and set it to Link-local only.
Step 4: Disable Split Tunneling
Split tunneling sends some traffic through the VPN and some through your normal internet connection. For privacy, you want everything forced through the tunnel.
In FortiClient, under your VPN connection settings, find Split Tunneling and set it to Disable or Route all traffic through VPN.
If your employer forces split tunneling for work apps, you can’t bypass that. Consider using a separate VPN for personal traffic.
Step 5: Run a Leak Test Every Time
Connect the VPN. Visit ipleak.net and dnsleaktest.com. Check three things:
- Your visible IP matches the VPN server’s IP
- Your DNS servers are the VPN’s DNS, not your ISP’s
- No IPv6 address appears
If you see your real IP or ISP DNS, go back through steps 1–4. One wrong setting breaks the whole chain.
Common Mistakes Beginners Make
- Trusting the green icon. A connected VPN icon does not mean private traffic. Leaks happen silently.
- Skipping the IPv6 block. Many users test with IPv4 sites only and never realize IPv6 is leaking.
- Using the free FortiClient version. The free version lacks the full VPN client. You may need the paid EMS version or a separate cheap VPN for personal use.
- Assuming the kill switch activates on disconnect. It only works if you enabled it and if your OS allows it. Test it.
Mini Scenario: The Remote Worker Who Thought “Connected” Meant “Hidden”
Maria works remotely for a bank. She installed FortiClient VPN per company policy. To watch Netflix during lunch, she also wanted to hide her traffic from her ISP. She clicked “Connect” on FortiClient and started browsing. A friend later showed her ipleak.net. Her real home IP was visible, along with her ISP’s DNS servers.
Why? FortiClient had split tunneling enabled by default. Her Netflix traffic went straight out her home connection. The kill switch was off. And IPv6 was leaking her router’s address.
After following the five steps above—disabling split tunneling, enabling kill switch, blocking IPv6, switching to OpenVPN, and running a leak test—her traffic finally stayed inside the tunnel.
FAQ
Q: Can FortiClient VPN be trusted for total privacy?
A: Yes, if you manually configure it. Out of the box, it’s built for corporate access, not anonymity. Follow the checklist above.
Q: Why does my FortiClient VPN leak DNS?
A: Usually because split tunneling is on, or the protocol is set to Automatic and picks SSL VPN, which can bypass the tunnel for DNS queries.
Q: Is FortiClient VPN free?
A: There is a free version, but it lacks the full VPN client. For personal privacy, many users prefer a dedicated secure VPN or a budget VPN that’s designed for privacy from the start.
Q: Does the kill switch work on Mac?
A: It works on Windows and sometimes on Mac, but it’s less reliable. Test it manually after every update.
Q: Can I use FortiClient for both work and personal privacy?
A: You can, but only if you disable split tunneling and run a leak test. If your employer forces split tunneling, use a separate VPN for personal traffic.
