Wayland, VPNs, and Video Calls: The Honest State of Desktop Linux for Remote Work in 2025

The pitch for desktop Linux as a professional workstation has never been stronger. Hardware support has matured considerably, Wayland has reached a level of stability that makes daily driving genuinely viable, and the tooling available to developers on Linux is, by many measures, superior to what ships on Windows or macOS. But for the professional working within a corporate environment—connecting through a company VPN, attending video calls on Zoom or Teams, authenticating against Active Directory—the experience in 2025 remains one of capability punctuated by friction.

This report is not a celebration of Linux's progress, nor is it a catalog of its failures. It is an attempt to document, as precisely as possible, where the experience holds up and where it does not, based on extended use across GNOME 46 on Fedora 41 and KDE Plasma 6.1 on Kubuntu 24.04.

VPN Compatibility: Better Than It Was, Worse Than It Should Be

The majority of enterprise VPN deployments in the United States rely on one of three client ecosystems: Cisco AnyConnect (and its successor, Cisco Secure Client), Palo Alto GlobalProtect, or Fortinet FortiClient. All three maintain official Linux clients. None of them are without issues.

Cisco Secure Client on Fedora 41 installs without incident and connects reliably to split-tunnel configurations. The notable limitation is that the client uses a proprietary kernel module, ciscovpn.ko, that must be rebuilt against each new kernel. On a rolling-release system like Fedora, this means a kernel update can silently break VPN connectivity until the module is recompiled—a failure mode that is opaque to users who do not think to check kernel module status. Teams running Ubuntu LTS fare better here, as the longer kernel cadence reduces the frequency of this disruption.

GlobalProtect's Linux client is the most problematic of the three. Palo Alto's official Linux build lags behind the Windows and macOS releases, and several enterprise-specific features—most notably pre-logon authentication and host information profile (HIP) checks—are either absent or unreliable on Linux. Many organizations use GlobalProtect with HIP checks as a condition of network access, which can result in a Linux machine being silently placed on a restricted network segment without any clear error message. The open-source openconnect client handles GlobalProtect's authentication protocol adequately for basic connectivity but cannot satisfy HIP requirements.

FortiClient's Linux offering is functional for SSL VPN connections but lacks the endpoint compliance features present in its Windows counterpart. For organizations that do not enforce endpoint compliance checks, it works.

The practical recommendation for IT professionals evaluating Linux compatibility before committing to it as a primary work machine: contact your network security team and ask specifically whether HIP checks or endpoint compliance enforcement are required. That single question will determine whether your VPN situation is manageable or a genuine blocker.

Webcam and Microphone: The Wayland Complication

Webcam support under Linux has improved substantially with the widespread adoption of the USB Video Class (UVC) standard. The overwhelming majority of webcams—including the Logitech C920, C922, and MX Brio, as well as most laptop integrated cameras—work without any driver installation on modern kernels. That part of the story is genuinely good.

The complication arises at the application layer. Both Zoom and Microsoft Teams on Linux now use WebRTC-based video pipelines that interact with PipeWire for screen sharing and, increasingly, for camera access under Wayland. PipeWire's camera portal, implemented through xdg-desktop-portal, has stabilized considerably in the past year, but the experience is not uniform.

On GNOME 46 with PipeWire 1.0, Zoom's native Linux client handles camera and microphone access reliably in standard video calls. Screen sharing on Wayland requires the user to explicitly grant permission through the portal dialog on each session, which is a minor inconvenience but not a workflow blocker. The more significant issue is virtual background support: Zoom's Linux client does not implement the noise suppression and virtual background features available on Windows and macOS. For professionals in open-plan home offices, this is a tangible quality-of-life gap.

Microsoft Teams presents a different set of trade-offs. The native Electron-based Teams client was deprecated in favor of the Progressive Web App (PWA) delivered through a Chromium-based browser. Under Wayland, this approach works acceptably for video and audio but introduces friction around screen sharing. Sharing a single application window—rather than an entire display—requires browser-level portal support that behaves inconsistently across Chrome, Firefox, and Edge on Linux. Edge on Linux, somewhat counterintuitively, provides the most consistent Teams experience, as Microsoft's own browser implements the portal APIs more completely than its competitors.

Authentication Headaches: Kerberos, SSPI, and the Active Directory Problem

For organizations running Microsoft Active Directory, Linux workstations require explicit configuration to participate in domain authentication. The toolchain—typically sssd, realmd, and krb5—is mature and well-documented, but it does not configure itself. A Windows machine joined to an AD domain receives Group Policy, certificate enrollment, and single sign-on to internal web applications essentially automatically. A Linux machine requires deliberate setup work and ongoing maintenance.

Single sign-on to internal web applications that use Windows Integrated Authentication (Kerberos/NTLM) is functional on Linux when configured correctly, but the configuration is non-trivial and is not preserved across browser updates or profile resets. Certificate-based authentication using PKCS#11 smart cards works on Linux—the OpenSC project provides the necessary middleware—but hardware token support (YubiKey in FIDO2 mode, PIV mode smart cards) requires careful attention to which applications invoke which authentication stacks.

The Honest Bottom Line

Desktop Linux in 2025 is a viable professional platform for remote work, with meaningful caveats. Developers and IT professionals who control their own toolchain and work primarily in terminal environments, web browsers, and IDEs will encounter relatively little friction. Professionals whose workflows depend heavily on corporate VPN compliance enforcement, Microsoft Teams' full feature set, or seamless Active Directory integration will encounter friction that ranges from inconvenient to blocking, depending on their organization's specific configuration.

The improvements over the past two years are genuine. Wayland's stability, PipeWire's maturation, and the broader adoption of xdg-desktop-portal have resolved many of the issues that made Linux an impractical choice for video-call-heavy work. What remains are not fundamental architectural problems but integration gaps that reflect the reality that enterprise software vendors still treat Linux as a secondary platform.

For teams considering Linux deployment at scale, the investment in pre-deployment compatibility testing—specifically around VPN enforcement and authentication requirements—will pay dividends. The surprises in this space are rarely pleasant.