VPN Comparison

Pritunl vs FortiClient vs IPsec VPN: Which to Use?

By the VPN Analyst team · Updated October 14, 2026 · 9 min read

Short answer: these three are not the same kind of thing. Pritunl is a VPN server you host yourself. FortiClient is Fortinet‘s VPN app, built to connect to a FortiGate firewall. IPsec is the security protocol that FortiClient (and many other tools) use under the hood.

So the real question in Pritunl vs FortiClient vs IPsec VPN is: do you want to run your own server, use the firewall you already own, or build on a plain standard? This guide answers that in plain words, with prices and facts checked on the official sites.

Pritunl vs FortiClient vs IPsec at a glance

Point	Pritunl	FortiClient	Plain IPsec
What it is	Self-hosted VPN server + app	Fortinet VPN app	Open protocol (IETF)
Protocols	WireGuard, OpenVPN (IPsec for site links)	IPsec, SSL VPN	IKEv2 + ESP
Needs	Your own Linux server	A FortiGate firewall	Any IPsec gateway
Price	Free, $10 or $70/mo per host	VPN-only app free; licensed tiers via sales	Free standard
Best for	Startups, DevOps, cloud teams	Fortinet shops	Site-to-site, mixed vendors

Checked on pritunl.com and Fortinet’s download page on October 14, 2026.

What each one really is (and why people mix them up)

Most comparison pages treat these as three rival products. They are not. Think of it like this:

• IPsec is the language. It’s a set of open standards for encrypting traffic between two points.
• FortiClient is a speaker of that language. It connects your laptop to a FortiGate, mostly over IPsec now.
• Pritunl is a whole system: a server with a web panel plus its own app. For user devices it speaks WireGuard and OpenVPN. It uses IPsec only for site-to-site links.

That’s why the search “forticlient vpn only ipsec” is so common. People want to know if the free FortiClient app can do an IPsec tunnel. It can.

Pritunl: the self-hosted option

Pritunl is an open source VPN server. You install it on your own Linux machine or cloud server, then manage users from a web panel. Its source code is public on GitHub.

What you get

• Protocols: WireGuard and OpenVPN for users. It works with any standard OpenVPN client, plus its own Pritunl Client for Windows, macOS and Linux.
• Server OS: Ubuntu, Debian, Rocky, AlmaLinux, Oracle Linux, Amazon Linux 2023 and Arch.
• No user caps: every plan allows unlimited servers, users and devices.
• Enterprise extras: single sign-on (SAML, Google, Duo, Radius), TPM and Apple Secure Enclave device checks, failover, AWS VPC routing, and IPsec or WireGuard site-to-site links.

Pritunl pricing

Plan	Price	Key adds
Community	Free	Single host, unlimited users
Premium	$10/month per host	Port forwarding, gateway links, Chromebook, config sync
Enterprise	$70/month per host	SSO, device auth, failover, site-to-site, API, plugins

Per-host pricing is the big win. A 200-person team pays the same as a 5-person team on one server. Most per-user VPNs can’t touch that.

The catch

You run it. Updates, backups, the server’s own security and uptime are on you. Support is email and community forums. If nobody on your team is comfortable on a Linux shell, this gets painful fast.

FortiClient: the Fortinet option

FortiClient is Fortinet’s endpoint app. Its job is to connect a laptop or phone to a FortiGate firewall. If your company already owns FortiGates, it’s the natural choice.

Free VPN-only vs licensed FortiClient

There are two very different FortiClients:

• FortiClient VPN-only (free): available for Windows, macOS, Linux, iOS and Android. Fortinet’s docs say it does IPsec and SSL VPN with user, certificate and FortiToken MFA login. It has no 24×7 support and only a limited version of remote access.
• Licensed FortiClient (ZTNA and EPP/APT editions): managed from FortiClient EMS. Adds zero trust posture checks, ZTNA, vulnerability scans, web filtering, central logs and support. Pricing is by quote through Fortinet or a partner.

Our take: the free app is fine for a small office with one FortiGate. Bigger teams usually end up on EMS for central control.

The catch

FortiClient lives inside the Fortinet world. It’s built for FortiGate, not as a general VPN app. And no matter the client, the security of your setup depends on keeping the FortiGate patched (more on that below).

Plain IPsec: the open standard

IPsec is a family of IETF standards, defined in RFC 4301. It’s not owned by anyone. Most firewalls, routers, cloud providers and operating systems speak it.

How IPsec works, simply

• IKEv2 (RFC 7296) sets up the tunnel and swaps keys over UDP port 500.
• ESP carries the encrypted data. It’s IP protocol 50, which has no ports.
• NAT traversal wraps ESP in UDP port 4500, so it works behind home routers.
• Tunnel mode wraps the whole packet (used for VPNs). Transport mode only encrypts the payload.

Source: strongSwan IPsec protocol guide.

When plain IPsec wins

• Site-to-site: joining two offices, or an office to AWS, Azure or Google Cloud.
• Mixed vendors: a Fortinet box on one end and a Cisco, Palo Alto or pfSense box on the other.
• No extra app: Windows, macOS and iOS have built-in IKEv2 VPN clients, and so do recent Android versions.

The downside: IPsec has many settings, and both ends must match. One wrong proposal (cipher, hash, DH group) and the tunnel won’t come up. Strict firewalls that block UDP 500 and 4500 can also stop it.

The FortiGate SSL VPN change you need to know

SSL VPN tunnel mode is removed in FortiOS 7.6.3 and later, on all FortiGate models. Old tunnel-mode settings don’t carry over on upgrade. Fortinet tells admins to move FortiClient users to IPsec VPN before upgrading.

• Smaller F-series boxes (40F and 60F variants) already lost SSL VPN in FortiOS 7.6.0.
• Browser-only “web mode” lives on as Agentless VPN on models that still support it.
• Fortinet points browser users to ZTNA agentless web access, added in 7.6.1.

Source: Fortinet Community technical tip on SSL VPN support. This is why “FortiClient vs IPsec” is no longer a real choice for FortiGate users. On current FortiOS, FortiClient full-tunnel access is IPsec.

Security: which is safer?

All three can be very secure. How you run them matters more than which one you pick.

• Pritunl: WireGuard is small and modern. OpenVPN is mature and widely audited. Your weak spot is the server you manage, so patch it and lock down the web panel.
• FortiClient + FortiGate: strong crypto, but the firewall faces the internet. FortiOS SSL VPN has had serious bugs, like CVE-2024-21762, a critical flaw that attackers exploited. Patch fast, every time.
• IPsec: a proven standard. Use IKEv2 with modern ciphers (AES-GCM) and certificates or strong MFA. Avoid old IKEv1 and weak pre-shared keys.

Winner: tie. Each is only as safe as its patching and config.

Cost: what you’ll really pay

• Pritunl: $0 to $70 a month per host, plus your server bill. Unlimited users on every plan.
• FortiClient: the VPN-only app is free, but you need a FortiGate, and its license and support cost extra. EMS-managed tiers are quote-only.
• IPsec: the protocol is free. Open source servers like strongSwan are free too. You pay in setup time.

Winner: Pritunl for most small teams starting from zero. If you already paid for a FortiGate, FortiClient VPN-only adds nothing to the bill.

Setup and daily use

Task	Pritunl	FortiClient	Plain IPsec
First setup	Easy if you know Linux	Easy on FortiGate GUI	Hardest, many settings
Adding users	Web panel, send a profile link	FortiGate users or EMS	Certs or accounts per user
User app	Pritunl Client or any OpenVPN app	FortiClient	Built-in OS client
SSO / MFA	Enterprise plan	FortiToken, SAML via FortiGate	Depends on gateway

Winner: Pritunl for a fresh setup. FortiClient if the FortiGate is already in place.

Verdict: which one should you choose?

• Choose Pritunl if you have no firewall VPN yet, run Linux or cloud servers, and want WireGuard with flat per-host pricing.
• Choose FortiClient if you already own FortiGates. Plan your move to IPsec before FortiOS 7.6.3.
• Choose plain IPsec for office-to-office or office-to-cloud links, or when your gear comes from several brands.

Many teams end up using two of them: IPsec between sites, plus Pritunl or FortiClient for people working from home.

Need a VPN for personal privacy instead of office access? Those are different tools. See our VPN comparisons, like Proton VPN vs Amnezia VPN (WireGuard-based) or Proton VPN vs Avast VPN.

Pritunl vs FortiClient vs IPsec: FAQ

Is FortiClient an IPsec VPN?

FortiClient is an app, not a protocol. It supports both IPsec and SSL VPN. On FortiOS 7.6.3 and later, SSL VPN tunnel mode is gone, so FortiClient connects to FortiGate over IPsec.

Does the free FortiClient VPN-only app support IPsec?

Yes. Fortinet’s feature comparison lists SSL VPN and IPsec VPN in the free standalone app, with user, certificate and FortiToken login. It doesn’t include 24×7 support or the zero trust and security modules.

Does Pritunl support IPsec?

Only for site-to-site links and VPC peering on the Enterprise plan. User devices connect to Pritunl with WireGuard or OpenVPN, not IPsec.

Can Pritunl replace FortiClient?

For remote access, yes, if you’re willing to run a Pritunl server. But it won’t use your FortiGate as the VPN gateway, and you lose Fortinet’s posture checks and EMS management.

Is Pritunl free?

The Community plan is free for a single host with unlimited users. Premium is $10 a month per host and Enterprise is $70 a month per host.

What ports does an IPsec VPN use?

UDP 500 for IKE, UDP 4500 for NAT traversal, and IP protocol 50 (ESP) when no NAT is in the way.

Which is fastest?

There’s no fair single benchmark across all three. WireGuard (in Pritunl) is often the quickest to connect and light on CPU. IPsec speed on a FortiGate depends a lot on the model’s hardware. Test on your own network.

Prices and features checked on pritunl.com, fortinet.com and docs.fortinet.com on October 14, 2026. Plans change, so confirm on the official sites before you buy. This page has no affiliate links for these products.