You connected to your company VPN. The green icon is on. You’re safe, right?
Not necessarily.
FortiClient is built for network access, not privacy. Default settings leave IPv6 traffic unblocked, DNS queries visible, and the kill switch disabled. If you’re using it on public Wi-Fi or a personal device, your real IP can leak without you noticing.
This checklist fixes that. It takes ten minutes and requires no admin access.
Why a checklist beats trusting the green icon
FortiClient’s default configuration assumes you’re inside a trusted corporate network. It doesn’t think about coffee shops, hotel Wi-Fi, or your home router’s quirks.
If you want actual privacy, you need to override those defaults. A checklist forces you to check settings you’d otherwise skip. It also catches the three most common leaks: IPv6, DNS, and an inactive kill switch.
6-step FortiClient VPN privacy checklist
Step 1: Force the kill switch on
FortiClient does not enable its kill switch by default. Without it, if the VPN drops, your traffic goes straight to your ISP.
How to check: Open FortiClient → Settings → Advanced. Look for “Block all traffic if VPN connection is lost” or similar wording. Enable it. If you don’t see this option, your IT team may have locked it. Ask them to enable it—or consider a personal secure VPN for sensitive traffic.
Step 2: Block IPv6 traffic manually
FortiClient often ignores IPv6. Your IPv4 traffic is tunneled, but IPv6 requests go straight to the internet. This is a common leak source.
How to fix: Disable IPv6 on your network adapter. On Windows: Settings → Network & Internet → Advanced network settings → More network adapter options → Right-click your adapter → Properties → Uncheck “Internet Protocol Version 6 (TCP/IPv6)”. Restart.
Step 3: Run a DNS leak test after every connection
FortiClient can leak your DNS requests even when the VPN appears active. Corporate DNS servers often reveal your real location.
How to test: Connect to your VPN. Go to ipleak.net or dnsleaktest.com. Run the extended test. If you see anything other than your VPN exit node’s DNS servers, you have a leak.
Step 4: Disable split tunneling unless you absolutely need it
Split tunneling sends some traffic through the VPN and some through your regular connection. Useful for local printing. Bad for privacy.
How to check: In FortiClient, go to Settings → Split Tunneling. If it’s enabled, traffic to local networks bypasses the VPN. If you don’t need it, disable it.
Step 5: Force a privacy-focused protocol
FortiClient defaults to Auto protocol, which may use weak or leak-prone modes.
How to change: In the VPN connection profile, switch the protocol to “IPsec with strong encryption” or “SSL VPN with strict tunnel mode.” Avoid “TCP over SSL” unless necessary—it can bypass firewalls but also leaks metadata.
Step 6: Verify the kill switch by actually killing the connection
Don’t assume the kill switch works. Test it.
How to test: Connect your VPN. Run a continuous ping (ping 8.8.8.8 -t on Windows). Disconnect the VPN forcefully (disable your network adapter or close the FortiClient process). If the ping stops, the kill switch works. If it keeps replying, your traffic leaked.
Common mistakes that break your privacy
- Assuming the kill switch is on. It’s off by default. Check it.
- Forgetting to test IPv6. Most people test IPv4 only. IPv6 leaks are silent.
- Using split tunneling without realizing it. Your IT team may have enabled it for corporate resources. Your personal traffic leaks.
- Not re-testing after updates. FortiClient updates sometimes reset advanced settings. Re-run this checklist after every major update.
Mini scenario: The consultant who thought “connected” meant “invisible”
Maria works as a consultant for three different clients. She uses FortiClient to access each client’s internal systems. She also uses a personal VPN for privacy for her own research.
One afternoon, she connects to Client A’s VPN. The green icon appears. She opens a browser and starts searching for competitor data. She doesn’t realize FortiClient has split tunneling enabled, and her DNS requests are going through her local ISP. Client A’s IT team sees DNS queries to competitor domains. They flag her account.
If Maria had run a DNS leak test after connecting, she would have caught the split tunneling issue immediately. A simple cheap VPN alternative for personal use would have kept her traffic separate without relying on her client’s VPN settings.
FAQ
Q: Does FortiClient work on Linux?
A: Yes, FortiClientVPN has a Linux client. The same checklist applies, but you’ll need to disable IPv6 via sysctl and test DNS leaks manually.
Q: What if I can’t change FortiClient settings because of admin restrictions?
A: Then you rely entirely on your IT team’s configuration. Ask them to confirm kill switch and IPv6 blocking. If they can’t, don’t use FortiClient for personal privacy.
Q: How often should I re-run this checklist?
A: After every FortiClient update and every time you connect to a new network (hotel, coffee shop, airport).
