Manuale d’uso / di manutenzione del prodotto 6 del fabbricante Kerio Tech
Vai alla pagina of 368
Ker io WinR o ut e Fi r e w al l 6 Administrator’s Guide Kerio Technologies s.r.o..
Kerio Technologies s.r.o. All rights reserved. This guide provides detailed description on configuration and administration of Kerio WinRoute Firewall , version 6.
3 Contents 1 Quick Checklist ................................................................ 7 2 Introduction ................................................................... 9 2.1 What’s new in 6.7.1 ............................................
4 7.5 Policy routing ........................................................... 9 5 7.6 User accounts and groups in traffic rules ................................. 9 8 7.7 Partial Retirement of Protocol Inspector .................................. 9 9 7.
5 15 User Accounts and Groups ................................................... 1 9 0 15.1 Viewing and definitions of user accounts ............................... 1 9 1 15.2 Local user accounts .................................................... 1 9 3 15.
6 22.9 Filter Log .............................................................. 2 7 6 22.10 Http log ............................................................... 2 7 7 22.11 Security Log ........................................................... 2 7 8 22.
7 Chapter 1 Quick Checklist In this chapter you can find a brief guide for a quick setup of Kerio WinRoute Firewall (referred to as “ WinRoute ” within this document). After this setup the firewall should be immediately available and able to share your Internet connection and protect your local network.
Chapter 1 Quick Checklist 8 9. Select an antivirus and define types of objects that will be scanned. If you choose the integrated McAfee antivirus application, check automatic update settings and edit them if necessary. External antivirus must be installed before it is set in WinRoute , otherwise it is not available in the combo box.
9 Chapter 2 Introduction 2.1 What’s new in 6.7.1 In version 6.7.1, WinRoute brings the following new features: Kerio WinRoute Firewall Software Appliance / VMware Virtual Appliance Kerio WinRoute Firewall is now available as a so called software appliance ( Software Ap- pliance / VMware Virtual Appliance ).
Chapter 2 Introduction 10 Support for Windows 7 Kerio WinRoute Firewall now includes full support for the new operating system Microsoft Windows 7 . 2.
2.3 System requirements 11 • 53/UDP — DNS module, • 67/UDP — DHCP server , • 1900/UDP — the SSDP Discovery service, • 2869/TCP — the UPnP Host service. The SSDP Discovery and UPnP Host services are included in the UPnP support (refer to chapter 18.
Chapter 2 Introduction 12 • 50 MB free disk space for installation of Kerio WinRoute Firewall . • Disk space for statistics (see chapter 21 ) and logs (in accordance with traffic flow and logging level — see chapter 22 ).
2.4 Installation - Windows 13 Note: 1. WinRoute installation packages include the Kerio Administration Console . The separate Kerio Administration Console installation package (file kerio-kwf-admin * .exe ) is de- signed for full remote administration from another host.
Chapter 2 Introduction 14 Figure 2.1 Installation — customization by selecting optional components • Kerio WinRoute Firewall Engine — core of the application. • VPN Support — proprietary VPN solution developed by Kerio Technologies ( Kerio VPN ).
2.4 Installation - Windows 15 • all checked components will be installed or updated, • all checked components will not be installed or will be removed During an update, all components that are intended to remain must be ticked. 2. The installation program does not allow to install the Administration Console separately.
Chapter 2 Introduction 16 2. Universal Plug and Play Device Host and SSDP Discovery Service The services support UPnP (Universal Plug and Play) in the Windows XP , Windows Server 2003 , Windows Vista and Windows Server 2008 operating systems. However, these services collide with the UPnP support in WinRoute (refer to chapter 18.
2.5 Initial configuration wizard (Windows) 17 warning log. This helps assure that the service will be enabled/started immediately after the WinRoute installation. 2. On Windows XP Service Pack 2 , Windows Server 2003 , Windows Vista and Windows Server 2008 , WinRoute registers in the Security Center automatically.
Chapter 2 Introduction 18 Password and its confirmation must be entered in the dialog for account settings. Name Admin can be changed in the Username edit box. Note: If the installation is running as an upgrade, this step is skipped since the administrator account already exists.
2.6 Upgrade and Uninstallation - Windows 19 Enable remote access This option enables full access to the WinRoute computer from a selected IP address Remote IP address IP address of the computer from where you will be connecting (e.g. terminal services client).
Chapter 2 Introduction 20 Figure 2.5 Uninstallation — asking user whether files created in WinRoute should be deleted Keeping these files may be helpful for copying of the configuration to another host or if it is not sure whether the SSL certificates were issued by a trustworthy certification authority.
2.7 Installation - Software Appliance and VMware Virtual Appliance 21 Start of the installation Software Appliance ISO image of the installation CD can be burned on a physical CD and then the CD can be used for installation of the system on the target computer (either physical or virtual).
Chapter 2 Introduction 22 virtual computer allows this) adapter or install WinRoute Software Appliance on another type of virtual machine. If such issue arises, it is highly recommended to consult the problem with the Kerio Technologies technical support (see chapter 26 ).
2.8 Upgrade - Software Appliance / VMware Virtual Appliance 23 2.8 Upgrade - Software Appliance / VMware Virtual Appliance WinRoute can be upgraded by the following two methods: • by starting the system from the installation CD (or a mounted ISO) of the new version.
Chapter 2 Introduction 24 2.10 WinRoute Engine Monitor (Windows) WinRoute Engine Monitor is a standalone utility used to control and monitor the WinRoute Firewall Engine status.
2.11 The firewall’s console (Software Appliance / VMware Virtual Appliance) 25 Note: 1. If a limited version of WinRoute is used (e.g. a trial version), a notification is displayed 7 days before its expiration. This information is displayed until the expiration.
Chapter 2 Introduction 26 Shutting down / restarting the firewall If you need to shut your computer down or reboot it, these options provide secure closure of the Kerio WinRoute Firewall Engine and shutdown of the firewall’s operating system.
27 Chapter 3 WinRoute Administration For WinRoute configuration, two tools are available: The Web Administration interface The Web Administration interface allows both remote and local administration of the firewall via a common web browser.
Chapter 3 WinRoute Administration 28 The following chapters of this document address individual sections of the Administration Console , the module which allows full configuration. The Web Administration interface is almost identical as the Administration Console and its sections.
3.1 Administration Console - the main window 29 • The left column contains the tree view of sections. The individual sections of the tree can be expanded and collapsed for easier navigation. Administration Console remembers the current tree settings and uses them upon the next login.
Chapter 3 WinRoute Administration 30 for authentication of the firewall when connecting to the administration from another host (see Kerio Administration Console — Help ). • Administrator’s guide — this option displays the administrator’s guide in HTML Help format.
3.2 Administration Console - view preferences 31 Note: After a connection failure, the Web Administration interface is redirected and opened at the login page automatically.
32 Chapter 4 Product Registration and Licensing When purchased, Kerio WinRoute Firewall must be registered, Upon registration of the product, so called license key is generated.
4.2 License information 33 cannot be updated. The time for updates can be extended by purchasing a sub- scription. • product expiration date — specifies the date by which WinRoute stops functioning and blocks all TCP/IP traffic at the host where it is installed.
Chapter 4 Product Registration and Licensing 34 Figure 4.1 Administration Console welcome page providing license information Product name of the product ( WinRoute ) Copyright Copyright information. Homepage Link to the Kerio WinRoute Firewall homepage (information on pricing, new versions, etc.
4.3 Registration of the product in the Administration Console 35 Number of users Maximal number of hosts (unique IP addresses) that can be connected to the Internet via WinRoute at the same time (for details, refer to chapter 4.6 ). Company Name of the company (or a person) to which the product is registered.
Chapter 4 Product Registration and Licensing 36 Registration of the trial version By registrating the trial version, users get free email and telephonic technical support for the entire trial period. In return, Kerio Technologies gets valuable feedback from these users.
4.3 Registration of the product in the Administration Console 37 Figure 4.3 Trial version registration — user information Figure 4.4 Trial version registration — other information 4. The fourth page provides the information summary. If any information is incorrect, use the Back button to browse to a corresponding page and correct the data.
Chapter 4 Product Registration and Licensing 38 Figure 4.5 Registration of the trial version — summary Figure 4.6 Trial version registration — Trial ID At this point, an email message (in the lang.
4.3 Registration of the product in the Administration Console 39 Registration of the purchased product Follow the Register product with a purchased license number link to run the registration wiz- ard.
Chapter 4 Product Registration and Licensing 40 Figure 4.8 Product registration — license numbers of additional components, add-ons and subscription.
4.3 Registration of the product in the Administration Console 41 Figure 4.9 Product registration — user information 4. Page four includes optional information. It is not obligatory to answer these questions, however, the answers help Kerio Technologies accommodate demands of as many cus- tomers as possible.
Chapter 4 Product Registration and Licensing 42 Figure 4.10 Product registration — other information Figure 4.11 Product registration — summary 1. The license key is generated only for the operating system on which WinRoute was installed during the registration ( Windows / Linux ).
4.4 Product registration at the website 43 work connection, etc.), simply restart the wizard and repeat the registration. 4.4 Product registration at the website If, by any reason, registration of WinRoute cannot be performed from the Administration Con- sole , it is still possible to register the product at Kerio Technologies website.
Chapter 4 Product Registration and Licensing 44 Administrators are informed in two ways: • By a pop-up bubble tip (this function is featured by the WinRoute Engine Monitor mod- ule), • by an pop-up window upon a login to the Administration Console (only in case of expiration of subscription).
4.6 User counter 45 4.6 User counter This chapter provides a detailed description on how WinRoute checks whether number of licensed users has not been exceeded. The WinRoute license does not limit number of user accounts. Number of user accounts does not affect number of licensed users.
Chapter 4 Product Registration and Licensing 46 License release Idleness time (i.e. time for which no packet with a corresponding IP address meeting all conditions is detected) is monitored for each record in the table of clients.
47 Chapter 5 Network interfaces WinRoute is a network firewall. This implies that it represents a gateway between two or more networks (typically between the local network and the Internet) and controls traffic passing through network adapters ( Ethernet , WiFi , dial-ups, etc.
Chapter 5 Network interfaces 48 change of a network adapter etc., there is no need to edit traffic rules — simple adding of the new interface in the correct group will do.
49 you do not consider RAS clients as parts of trustworthy networks for any reason, you can move the Dial-In interface to Other interfaces . Note: 1. If both RAS server and WinRoute are used, the RAS server must be configured to assign clients IP addresses of a subnet which is not used by any segment of the local network.
Chapter 5 Network interfaces 50 DNS IP address of the primary DNS server set on the interface. MAC Hardware (MAC) address of a corresponding network adapter. This entry is empty for dial-ups as its use would be meaningless there. Use the buttons at the bottom of the interface list to remove or edit properties of the chosen interface.
51 In WinRoute , it is specify to specify a special name for each interface (names taken from the operating system can be confusing and the new name may make it clear). It is also possible to change the group of the interface (Internet, secure local network, another network — e.
Chapter 5 Network interfaces 52 Adding new interface (Software Appliance / VMware Virtual Appliance) In the Software Appliance / VMware Virtual Appliance edition, WinRoute allows to add new network interfaces (dial-up, PPPoE and PPTP connections) right in the administration console.
53 Chapter 6 Internet Connection The basic function of WinRoute is connection of the local network to the Internet via one or more Internet connections (Internet links).
Chapter 6 Internet Connection 54 This involves selection of the Internet connection type in the Configuration → Interfaces sec- tion of the WinRoute configuration, setting corresponding interfaces for connection to the Internet and definition of corresponding traffic rules (see chapter 7.
6.1 Persistent connection with a single link 55 Figure 6.1 Traffic Policy Wizard — persistent connection with a single link Figure 6.2 Network Policy Wizard — selection of an interface for the Internet connection • to configure parameters of the selected interface, • to create a new interface ( PPPoE , PPTP or dial-up).
Chapter 6 Internet Connection 56 Resulting interface configuration When you finish set-up in Traffic Policy Wizard , the resulting configuration can be viewed under Configuration → Interfaces and edited if desirable.
6.2 Connection with a single leased link - dial on demand 57 6.2 Connection with a single leased link - dial on demand If the WinRoute host is connected to the Internet via dial-up, WinRoute can automatically dial the connection when users attempt to access the Internet.
Chapter 6 Internet Connection 58 Figure 6.4 Traffic Policy Wizard — dial on demand Figure 6.5 Network Policy Wizard — selection of an interface for the Internet connection • to configure parameters of the selected interface, • to create a new interface ( PPPoE , PPTP or dial-up).
6.2 Connection with a single leased link - dial on demand 59 Figure 6.6 Configuration of interfaces — an on-demand dial link The Internet interfaces group can include multiple dial-ups. However, only one of these links can be set for on-demand dialing.
Chapter 6 Internet Connection 60 Figure 6.7 Interface properties — dialing settings efficient to keep the link up persistently even in times with dense network communica- tion. For these purposes, it is possible to set time intervals for persistent connection and/or hang-up.
6.2 Connection with a single leased link - dial on demand 61 connection is recovered automatically. • If the connection is set to be hung-up at the moment of the outage, the con- nection will not be recovered. • In mode of on-demand dial (i.e. outside the intervals defined), connection will be recovered in response to the first request (i.
Chapter 6 Internet Connection 62 Warning WinRoute is running in the operating system as a service. Therefore, external applica- tions and operating system’s commands will run in the background only (in the SYSTEM account). The same rules are applied for all external commands and external programs called by scripts.
6.3 Connection Failover 63 Warning Connection failover is relevant only if performed by a persistent connection (i.e. the primary connection uses a network card or a persistently connected dial-up). Failing that, the sec- ondary connection would be activated upon each hang-up of the primary link automatically.
Chapter 6 Internet Connection 64 Figure 6.10 Traffic Policy Wizard — failover of a leased link by a dial-up Resulting interface configuration When you finish set-up in Traffic Policy Wizard , the resulting configuration can be viewed under Configuration → Interfaces and edited if desirable.
6.3 Connection Failover 65 The Internet interfaces group includes the Internet and the Dial-up link selected as primary and secondary (failover) on the third page of the wizard. The information provided in the Internet column states which link is used for primary and which one for secondary connection.
Chapter 6 Internet Connection 66 Note: 1. Probe hosts must not block ICMP Echo Requests ( PING ) since such requests are used to test availability of these hosts — otherwise the hosts will be always considered as unavailable. This is one of the cases where the primary default gateway cannot be used as the testing computer.
6.4 Network Load Balancing 67 Both the primary and the secondary link may be configured automatically by the DHCP proto- col. In that case, WinRoute looks all required parameters up in the operating system. It is recommended to check functionality of individual Internet links out before installing WinRoute .
Chapter 6 Internet Connection 68 On the third page of the wizard, add all links (one by one) which you intend to use for traffic load balancing. In the Software Appliance / VMware Virtual Appliance edition, the wizard allows: • to configure parameters of the selected interface, • to create a new interface ( PPPoE , PPTP or dial-up).
6.4 Network Load Balancing 69 Resulting interface configuration When you finish set-up in Traffic Policy Wizard , the resulting configuration can be viewed under Configuration → Interfaces and edited if desirable.
Chapter 6 Internet Connection 70 Advanced settings (optimization, dedicated links, etc.) In basic configuration, network load balancing is applied automatically with respect to their proposed speeds (see above). It is possible to use traffic rules to modify this algorithm (e.
71 Chapter 7 Traffic Policy Traffic Policy belongs to of the basic WinRoute configuration. All the following settings are displayed and can be edited within the table: • security (protection of the.
Chapter 7 Traffic Policy 72 Figure 7.1 Traffic Policy Wizard — introduction Steps 2 and 3— internet connection settings On the second page of the wizard, select how the LAN will be connected to the Internet with WinRoute (leased link, dial-up, leased link with connection failover or multiple links with net- work traffic load balancing).
7.1 Network Rules Wizard 73 Figure 7.2 Network Policy Wizard — enabling access to Internet services Allow access to the following services only Only selected services will be available from the local network. Note: 1. Defined restrictions will be applied also to the firewall itself.
Chapter 7 Traffic Policy 74 Figure 7.3 Network Policy Wizard — Kerio VPN Step 6 — specification of servers that will be available within the local network If any service (e.
7.1 Network Rules Wizard 75 Figure 7.5 Network Policy Wizard — mapping of the local service Note: Access to the Internet through WinRoute must be defined at the default gateway of the host, otherwise the service will not be available. Service Selection of a service to be enabled.
Chapter 7 Traffic Policy 76 Figure 7.7 Traffic Policy generated by the wizard FTP Service and HTTP Service These rules map all HTTP and HTTPS services running at the host with the 192.168.1.10 IP address (step 6). These services will be available at IP addresses of the “outbound” interface of the firewall (i.
7.1 Network Rules Wizard 77 NAT This rule sets that in all packets routed from the local network to the Internet, the source (private) IP address will be replaced by the address of the Internet interface through which the packet is sent from the firewall.
Chapter 7 Traffic Policy 78 7.2 How traffic rules work The traffic policy consists of rules ordered by their priority. When the rules are applied, they are processed from the top downwards and the first rule is applied that meets connection or packet parameters — i.
7.3 Definition of Custom Traffic Rules 79 The background color of each row with this rule can be defined as well. Use the Transparent option to make the background transparent (background color of the whole list will be used, white is usually set). Colors allow highlighting of rules or distinguishing of groups of rules (e.
Chapter 7 Traffic Policy 80 Warning If either the source or the destination computer is specified by DNS name, WinRoute tries to identify its IP address while processing a corresponding traffic rule. If no corresponding record is found in the cache, the DNS forwarder forwards the query to the Internet.
7.3 Definition of Custom Traffic Rules 81 Figure 7.11 Traffic rule — VPN clients / VPN tunnel in the source/destination address definition tunnel The All option covers all networks connected by all VPN tunnels defined which are active at the particular moment.
Chapter 7 Traffic Policy 82 Note: 1. If you require authentication for any rule, it is necessary to ensure that a rule ex- ists to allow users to connect to the firewall authentication page. If users use each various hosts to connect from, IP addresses of all these hosts must be considered.
7.3 Definition of Custom Traffic Rules 83 Figure 7.13 Traffic rule — setting a service Use the Remove button to remove all items defined (the Nothing value will be displayed in the item list). Whenever at least one service is added, the Nothing value will be removed automatically.
Chapter 7 Traffic Policy 84 Figure 7.14 Traffic rule — selecting an action Translation Source or/and destination IP address translation. Source IP address translation (NAT — Internet connection sharing) The source IP address translation can be also called IP masquerading or Internet connection sharing.
7.3 Definition of Custom Traffic Rules 85 Figure 7.15 Traffic rule — NAT — automatic IP address selection load balancing dividing the traffic among individual links may be not optimal in this case.
Chapter 7 Traffic Policy 86 Figure 7.16 Traffic rule — NAT — NAT with specific interface (its IP address) failure. If set as suggested, WinRoute will behave like in mode of automatic interface selection (see above) if the such failure occurs.
7.3 Definition of Custom Traffic Rules 87 Full cone NAT For all NAT methods it is possible to set mode of allowing of incoming packets coming from any address — so called Full cone NAT . If this option is off, WinRoute performs so called Port restricted cone NAT .
Chapter 7 Traffic Policy 88 Destination NAT (port mapping): Destination address translation (also called port mapping) is used to allow access to services hosted in private local networks behind the firewall. All incoming packets that meet defined rules are re-directed to a defined host (destination address is changed).
7.3 Definition of Custom Traffic Rules 89 Figure 7.19 Traffic rule — packet/connection logging Note: Connection cannot be logged for blocking and dropping rules (connection is not even established). The following columns are hidden in the default settings of the Traffic Policy window (for details on showing and hiding columns, see chapter 3.
Chapter 7 Traffic Policy 90 • Default — all necessary protocol inspectors (or inspectors of the services listed in the Service entry) will be applied on traffic meeting this rule. • None — no inspector will be applied (regardless of how services used in the Service item are defined).
7.4 Basic Traffic Rule Types 91 Destination The Internet interfaces group. With this group, the rule is usable for any type of Internet connection (see chapter 6 ) and it is not necessary to modify it even it Internet connection is changed. Service This entry can be used to define global limitations for Internet access.
Chapter 7 Traffic Policy 92 Figure 7.23 Traffic rule that makes the local web server available from the Internet Source Mapped services can be accessed by clients both from the Internet and from the local network.
7.4 Basic Traffic Rule Types 93 dropped. Therefore, it is recommended to put all rules for mapped services at the top of the table of traffic rules. Note: If there are separate rules limiting access to mapped services, these rules must precede mapping rules.
Chapter 7 Traffic Policy 94 Limiting Internet Access Sometimes, it is helpful to limit users access to the Internet services from the local network. Access to Internet services can be limited in several ways. In the following examples, the limitation rules use IP translation.
7.5 Policy routing 95 Alternatively you can define the rule to allow only authenticated users to access specific services. Any user that has a user account in WinRoute will be allowed to access the Internet after authenticating to the firewall.
Chapter 7 Traffic Policy 96 marginal traffic (web browsing, online radio channels, etc.). To meet this crucial requirement of an enterprise data traffic, it is necessary to consider and employ, besides the destination IP address, additional information when routing packets from the LAN to the Internet, such as source IP address, protocol, etc.
7.5 Policy routing 97 Figure 7.31 Policy routing — setting NAT for a reserved link Figure 7.32 Policy routing — a link reserved for a specific server Note: In the second rule, automatic interface selection is used. This means that the Internet 4Mbit link is also used for network traffic load balancing.
Chapter 7 Traffic Policy 98 IP address will be used). To any other services, load balancing per connection will be applied — thus maximally efficient use of the capacity of available links will be reached. Meeting of the requirements will be guaranteed by using two NAT traffic rules — see fig- ure 7.
7.7 Partial Retirement of Protocol Inspector 99 counting reasons — see chapter 4.6 ). However, this NAT rule blocks any connection unless the user is authenticated.
Chapter 7 Traffic Policy 100 Example A banking application (client) communicates with the bank’s server through its proper proto- col which uses TCP protocol at the port 2000 . Supposing the banking application is run on a host with IP address 192.168.
7.8 Use of Full cone NAT 101 Note: In the default configuration of the Traffic rules section, the Protocol inspector column is hidden. To show it, modify settings through the Modify columns dialog (see chapter 3.
Chapter 7 Traffic Policy 102 Figure 7.39 Definition of a Full cone NAT traffic rule • Source — IP address of an SIP telephone in the local network. • Destination — name or IP address of an SIP server in the Internet. Full cone NAT will apply only to connection with this server.
7.9 Media hairpinning 103 Example: Two SIP telephones in the LAN Let us suppose two SIP telephones are located in the LAN. These telephones authenticate at a SIP server in the Internet. The parameters may be as follows: • IP addresses of the phones: 192.
104 Chapter 8 Configuration of network services This chapter provides guidelines for setting of basic services in WinRoute helpful for easy configuration and smooth access to the Internet: • DNS m.
8.1 DNS module 105 The DNS module configuration By default, DNS server (the DNS forwarder service), cache (for faster responses to repeated requests) and simple DNS names resolver are enabled in WinRoute . The configuration can be fine-tuned in Configuration → DNS .
Chapter 8 Configuration of network services 106 Note: 1. Time period for keeping DNS logs in the cache is specified individually in each log (usually 24 hours). 2. Use of DNS also speeds up activity of the WinRoute’s non-transparent proxy server (see chapter 8.
8.1 DNS module 107 Figure 8.2 Editor of the Hosts system file Local DNS domain In the When resolving name from the ’hosts’ file or lease table combine it with DNS domain below entry, specify name of the local DNS domain.
Chapter 8 Configuration of network services 108 Enable DNS forwarding The DNS module allows forwarding of certain DNS requests to specific DNS servers.
8.1 DNS module 109 queries concerning names and reversed queries are independent from each other. For better reference, it is recommended to start with all rules concerning queries for names and continue with all rules for reversed queries, or vice versa.
Chapter 8 Configuration of network services 110 Warning In rules for DNS requests, it is necessary to enter an expression matching the full DNS name! If, for example, the kerio.c * expression is introduced, only names kerio.cz , kerio.com etc. would match the rule and host names included in these domains (such as www.
8.2 DHCP server 111 DHCP Server Configuration To configure the DHCP server in WinRoute go to Configuration → DHCP Server . Here you can define IP scopes, reservations or optional parameters, and view information about occupied IP addresses or statistics of the DHCP server.
Chapter 8 Configuration of network services 112 Figure 8.6 DHCP server — default DHCP parameters DNS server Any DNS server (or multiple DNS servers separated by semicolons) can be defined. We recommend you to use the WinRoute’s DNS module as the primary server (first in the list) — IP address of the WinRoute host.
8.2 DHCP server 113 Figure 8.7 DHCP server — IP scopes definition First address, Last address First and last address of the new scope. Note: If possible, we recommend you to define the scope larger than it would be defined for the real number of users within the subnet.
Chapter 8 Configuration of network services 114 Example In 192.168.1.0 subnet you intend to create two scopes: from 192.168.1.10 to 192.168.1.49 and from 192.168.1.61 to 192.168.1.100 . Addresses from 192.168.1.50 to 192.168.1.60 will be left free and can be used for other purposes.
8.2 DHCP server 115 Figure 8.9 DHCP server — DHCP settings To view configured DHCP parameters and their values within appropriate IP scopes see the right column in the Address Scope tab. Note: Simple DHCP server statistics are displayed at the right top of the Address Scope tab.
Chapter 8 Configuration of network services 116 Figure 8.11 DHCP server — reserving an IP address • hardware (MAC) address of the host — it is defined by hexadecimal numbers separated by colons, i.
8.2 DHCP server 117 Figure 8.12 DHCP server — list of leased and reserved IP addresses • MAC Address — hardware address of the host that the IP address is assigned to (in- cluding name of the network adapter manufacturer).
Chapter 8 Configuration of network services 118 the MAC address or name of the host that the address is currently assigned to. The Scopes tab with a dialog where the appropriate address can be leased will be opened automatically. All entries except for the Description item will be already defined with appropriate data.
8.3 Dynamic DNS for public IP address of the firewall 119 Warning 1. DHCP server cannot assign addresses to RAS clients connecting to the RAS server directly at the WinRoute host (for technical reasons, it is not possible to receive DHCP queries from the local RAS server).
Chapter 8 Configuration of network services 120 • free — user can choose from several second level domains (e.g. no-ip.org , ddns.info , etc.) and select a free host name for the domain (e.g. company.ddns.info ). • paid service — user registers their own domain (e.
8.4 Proxy server 121 Figure 8.14 Setting cooperation with dynamic DNS server On the Dynamic DNS tab, select a DDNS provider, enter DNS name for which dynamic record will be kept updated and set user name and password for access to updates of the dynamic record.
Chapter 8 Configuration of network services 122 Proxy server can receive and process clients’ queries locally. The line will not be dialed if access to the requested page is forbidden. 3. WinRoute is deployed within a network with many hosts where proxy server has been used.
8.4 Proxy server 123 Enable non-transparent proxy server This option enables the HTTP proxy server in WinRoute on the port inserted in the Port entry ( 3128 port is set by the default).
Chapter 8 Configuration of network services 124 where 192.168.1.1 is the IP address of the WinRoute host and number 3128 represents the port of the proxy server (see above).
8.5 HTTP cache 125 Figure 8.16 HTTP cache configuration Enable cache on proxy server Enables the cache for HTTP traffic via WinRoute’s proxy server (see chapter 8.
Chapter 8 Configuration of network services 126 Warning Changes in this entry will not be accepted unless the WinRoute Firewall Engine is restarted. Old cache files in the original folder will be removed automatically. Cache size Size of the cache file on the disk.
8.5 HTTP cache 127 Warning Some web servers may attempt to bypass the cache by too short/long TTL. • Ignore server Cache-Control directive — WinRoute will ignore directives for cache control of Web pages. Pages often include a directive that the page will not be saved into the cache.
Chapter 8 Configuration of network services 128 Rules within this dialog are ordered in a list where the rules are read one by one from the top downwards (use the arrow buttons on the right side of the window to reorder the rules). Description Text comment on the entry (informational purpose only) URL URL for which cache TTL will be specified.
8.5 HTTP cache 129 Figure 8.19 HTTP cache administration dialog Example Search for the * ker?o * string lists all objects with URL matching the specification, such as kerio , kerbo , etc. Each line with an object includes URL of the object, its size in bytes (B) and number of hours representing time left to the expiration .
130 Chapter 9 Bandwidth Limiter The main problem of shared Internet connection is when one or more users download or upload big volume of data and occupy great part of the line connected to the Internet (so called bandwidth). The other users are ten limited by slower Internet connection or also may be affected by failures of certain services (e.
9.2 Bandwidth Limiter configuration 131 Figure 9.1 Bandwidth Limiter configuration The Bandwidth Limiter module enables to define reduction of speed of incoming traffic (i.
Chapter 9 Bandwidth Limiter 132 services if too much big data volumes are transferred). If they are lower, full line capacity is often not employed. Warning For optimal configuration, it is necessary to operate with real capacity of the line. This value may differ from the information provided by ISP.
9.2 Bandwidth Limiter configuration 133 Figure 9.2 Bandwidth Limiter — network services Figure 9.3 Bandwidth Limiter — selection of network services IP Addresses and Time Interval It may be also .
Chapter 9 Bandwidth Limiter 134 addresses across the local network and the Internet. Where user workstations use fixed IP addresses, it is also possible to apply this function to individual users. It is also possible to apply bandwidth limiter to a particular time interval (e.
9.3 Detection of connections with large data volume transferred 135 cally. With exception of special conditions (testing purposes) it is highly recommended not to change the default values! Figure 9.
Chapter 9 Bandwidth Limiter 136 Examples: The detection of connections transferring large data volumes will be better understood through the following examples. The default configuration of the detection is as follows: at least 200 KB of data must be transferred while there is no interruption for 5 sec or more.
137 Chapter 10 User Authentication WinRoute allows administrators to monitor connections (packet, connection, Web pages or FTP objects and command filtering) related to each user. The username in each filtering rule represents the IP address of the host(s) from which the user is connected (i.
Chapter 10 User Authentication 138 • Redirection — when accessing any website (unless access to this page is explicitly allowed to unauthenticated users — see chapter 12.2 ). Login by re-direction is performed in the following way: user enters URL pages that he/she intends to open in the browser.
10.1 Firewall User Authentication 139 Redirection to the authentication page If the Always require users to be authenticated when accessing web pages option is en- abled, user authentication will be required for access to any website (unless the user is already authenticated).
Chapter 10 User Authentication 140 available for other operating systems. For details, refer to chapter 25.3 . Automatically logout users when they are inactive Timeout is a time interval (in minutes) of allowed user inactivity. When this period ex- pires, the user is automatically logged out from the firewall.
141 Chapter 11 Web Interface WinRoute includes a special web server which provides an interface where statistics can be viewed ( Kerio StaR ), as well as for setting of some user account parameters and for firewall administration via web browser ( Web Administration ).
Chapter 11 Web Interface 142 Figure 11.1 Configuration of WinRoute’s Web Interface The name need not be necessarily identical with the host name, however, there must exist an appropriate entry in DNS for proper name resolution. The SSL certificate for the secure web interface (see below) should be also issued for the server (i.
11.1 Web interface preferences 143 Configuration of ports of the Web Interface Use the TCP ports section to set ports for unencrypted and encrypted versions of the Web interface (default ports are 4080 for the unencrypted and 4081 for the encrypted version of the Web interface).
Chapter 11 Web Interface 144 SSL Certificate for the Web Interface The principle of an encrypted WinRoute Web interface is based on the fact that all communi- cation between the client and server is encrypted to protect it from wiretapping and misuse of the transmitted data.
11.1 Web interface preferences 145 Figure 11.3 SSL certificate of WinRoute’s Web interface Figure 11.4 Creating a new “self-signed” certificate for WinRoute’s Web interface A new ( self-signed ) certificate is unique. It is created by your company, addressed to your company and based on the name of your server.
Chapter 11 Web Interface 146 Verisign , Thawte , SecureSign , SecureNet , Microsoft Authenticode , etc.). To import a certificate, open the certificate file ( * .crt ) and the file including the correspond- ing private key ( * .key ). These files are stored in sslcert under the WinRoute’s installation directory.
147 Chapter 12 HTTP and FTP filtering WinRoute provides a wide range of features to filter traffic using HTTP and FTP protocols. These protocols are the most spread and the most used in the Internet. Here are the main purposes of HTTP and FTP content filtering: • to block access to undesirable Web sites (i.
Chapter 12 HTTP and FTP filtering 148 An appropriate protocol inspector is activated automatically unless its use is denied by traffic rules. For details, refer to chapter 7.3 . 2. Connections must not be encrypted. SSL encrypted traffic (HTTPS and FTPS protocols) cannot be monitored.
12.2 URL Rules 149 access to other web pages, a rule denying access to any URL must be placed at the end of the rule list. The following items (columns) can be available in the URL Rules tab: • Description — description of a particular rule (for reference only).
Chapter 12 HTTP and FTP filtering 150 Figure 12.2 URL Rule — basic parameters for example a rule allowing access to certain pages without authentication can be defined. 2. Unless authentication is required, the do not require authentication option is ineffective.
12.2 URL Rules 151 (wildcard matching) to substitute any number of characters (i.e. * .kerio.com * ) Server names represent any URL at a corresponding server ( www.
Chapter 12 HTTP and FTP filtering 152 Figure 12.3 URL Rule — advanced parameters Denial options Advanced options for denied pages. Whenever a user attempts to open a page that is denied by the rule, WinRoute will display: • A page informing the user that access to the required page is denied as it is blocked by the firewall.
12.2 URL Rules 153 another page (see below). • A blank page — user will not be informed why access to the required page was denied. • Another page — user’s browser will be redirected to the specified URL. This op- tion can be helpful for example to define a custom page with a warning that access to the particular page is denied.
Chapter 12 HTTP and FTP filtering 154 HTTP Inspection Advanced Options Click on the Advanced button in the HTTP Policy tab to open a dialog where parameters for the HTTP inspection module can be set.
12.3 Content Rating System (Kerio Web Filter) 155 According to the classification of the page the user will be either allowed or denied to access the page. To speed up URL rating the data that have been once acquired can be stored in the cache and kept for a certain period.
Chapter 12 HTTP and FTP filtering 156 Categorize each page regardless of HTTP rules If this option is enabled, Kerio Web Filter categorization will be applied to any web pages (i.
12.3 Content Rating System (Kerio Web Filter) 157 Figure 12.7 Kerio Web Filter rule.
Chapter 12 HTTP and FTP filtering 158 Figure 12.8 Selection of Kerio Web Filter categories Note: 1. You can define multiple URL rules that will use the Kerio Web Filter rating technology.
12.4 Web content filtering by word occurrence 159 So called forbidden words are used to filter out web pages containing undesirable words. URL rules (see chapter 12.
Chapter 12 HTTP and FTP filtering 160 • On the Content Rules tab, check the Deny Web pages containing... option to enable filtering by word occurrence.
12.4 Web content filtering by word occurrence 161 Individual groups and words included in them are displayed in form of trees. To enable filtering of particular words use checkboxes located next to them. Unchecked words will be ignored. Due to this function it is not necessary to remove rules and define them again later.
Chapter 12 HTTP and FTP filtering 162 Weight Word weight the level of how the word affects possible blocking or allowing of access to websites. The weight should respect frequency of the particular word in the language (the more common word, the lower weight) so that legitimate webpages are not blocked.
12.5 FTP Policy 163 FTP Rules Definition To create a new rule, select a rule after which the new rule will be added, and click Add . You can later use the arrow buttons to reorder the rule list. Checking the box next to the rule can be used to disable the rule.
Chapter 12 HTTP and FTP filtering 164 Open the General tab to set general rules and actions to be taken. Description Description of the rule (information for the administrator).
12.5 FTP Policy 165 Figure 12.15 FTP Rule — advanced settings Valid at time interval Selection of the time interval during which the rule will be valid (apart from this inter- val the rule will be ignored). Use the Edit button to edit time intervals (for details see chapter 14.
Chapter 12 HTTP and FTP filtering 166 Scan content for viruses according to scanning rules Use this option to enable/disable scanning for viruses for FTP traffic which meet this rule. This option is available only for allowing rules — it is meaningless to apply antivirus check to denied traffic.
167 Chapter 13 Antivirus control WinRoute provides antivirus check of objects (files) transmitted by HTTP, FTP, SMTP and POP3 protocols. In case of HTTP and FTP protocols, the WinRoute administrator can specify which types of objects will be scanned.
Chapter 13 Antivirus control 168 For details, see chapter 13.4 . • Object transferred by other than HTTP, FTP, SMTP and POP3 protocols cannot be checked by an antivirus. • If a substandard port is used for the traffic, corresponding protocol inspector will not be applied automatically.
13.2 How to choose and setup antiviruses 169 Figure 13.2 Antivirus selection (integrated antivirus) Figure 13.3 Scheduling McAfee updates Check for update every ... hours Time interval of checks for new updates of the virus database and the antivirus engine (in hours).
Chapter 13 Antivirus control 170 Last update check performed ... ago Time that has passed since the last update check. Virus database version Database version that is currently used. Scanning engine version McAfee scanning engine version used by WinRoute .
13.2 How to choose and setup antiviruses 171 Use the Options button to set advanced parameters for the selected antivirus. Dialogs for in- dividual antiviruses differ (some antivirus programs may not require any additional settings). For detailed information on installation and configuration of individual antivirus programs, refer to http://www.
Chapter 13 Antivirus control 172 network send their email via an SMTP server located in the Internet. Checking of outgoing SMTP traffic is not apt for local SMTP servers sending email to the Internet. An example of a traffic rule for checking of outgoing SMTP traffic is shown at figure 13.
13.3 HTTP and FTP scanning 173 To set parameters of HTTP and FTP antivirus check, open the HTTP, FTP scanning tab in Configuration → Content Filtering → Antivirus .
Chapter 13 Antivirus control 174 Warning When handling files in the quarantine directory, please consider carefully each action you take, otherwise a virus might be activated and the WinRoute host co.
13.3 HTTP and FTP scanning 175 Figure 13.8 Definition of an HTTP/FTP scanning rule Description Description of the rule (for reference of the WinRoute administrator only) Condition Condition of the rule: • HTTP/FTP filename — this option filters out certain filenames (not entire URLs) transmitted by FTP or HTTP (e.
Chapter 13 Antivirus control 176 If the object does not match with any rule, it will be scanned automatically. If only selected object types are to be scanned, a rule disabling scanning of any URL or MIME type must be added to the end of the list (the Skip all other files rule is predefined for this purpose).
13.4 Email scanning 177 Figure 13.9 Settings for SMTP and POP3 scanning The quarantine subdirectory under the WinRoute directory is used for the quarantine (the typical path is C:Program FilesKerioWin.
Chapter 13 Antivirus control 178 • Enable TLS. This alternative is suitable for such cases where protection from wiretap- ping is prior to antivirus check of email. Hint In such cases, it is recommended to install an antivirus engine at individual hosts that would perform local antivirus check.
13.5 Scanning of files transferred via Clientless SSL-VPN (Windows) 179 Transfer directions Use the top section of the SSL-VPN Scanning tab to set to which transfer direction the antivirus check will be applied.
180 Chapter 14 Definitions 14.1 IP Address Groups IP groups are used for simple access to certain services (e.g. WinRoute’s remote administration, Web server located in the local network available from the Internet, etc.). When setting access rights a group name is used.
14.2 Time Ranges 181 Figure 14.2 IP group definition Type Type of the new item: • Host (IP address or DNS name of a particular host), • Network / Mask (subnet with a corresponding mask), • IP r.
Chapter 14 Definitions 182 Figure 14.3 WinRoute’s time intervals Time range types When defining a time interval three types of time ranges (subintervals) can be used: Absolute The time interval is.
14.3 Services 183 Figure 14.4 Time range definition Valid on Defines days when the interval will be valid. You can either select particular weekdays ( Selected days ) or use one of the predefined options ( All Days , Weekday — from Monday to Friday, Weekend — Saturday and Sunday).
Chapter 14 Definitions 184 Figure 14.5 WinRoute’s network services Clicking on the Add or the Edit button will open a dialog for service definition. Figure 14.6 Network service definition Name Service identification within WinRoute . It is strongly recommended to use a concise name to keep the program easy to follow.
14.3 Services 185 Description Comments for the service defined. It is strongly recommended describing each definition, especially with non-standard services so that there will be minimum confusion when referring to the service at a later time. Protocol The communication protocol used by the service.
Chapter 14 Definitions 186 Figure 14.8 Service definition — source and destination port setting Protocol Inspectors WinRoute includes special subroutines that monitor all traffic using application protocols, such as HTTP, FTP or others.
14.4 URL Groups 187 Note: 1. Generally, protocol inspectors cannot be applied to secured traffic (SSL/TLS). In this case, WinRoute “perceives” the traffic as binary data only. This implies that such traffic cannot be deciphered. 2. Under certain circumstances, appliance of a protocol inspector is not desirable.
Chapter 14 Definitions 188 Matching fields next to each item of the group can be either checked to activate or unchecked to disable the item. This way you can deactivate items with no need to remove them and to define them again.
14.4 URL Groups 189 Description The item’s description (comments and notes for the administrator)..
190 Chapter 15 User Accounts and Groups User accounts in WinRoute improve control of user access to the Internet from the local net- work. User accounts can be also used to access the WinRoute administration using the Admin- istration Console or the Web Administration interface.
15.1 Viewing and definitions of user accounts 191 Transparent cooperation with Active Directory (Active Directory mapping) WinRoute can use accounts and groups stored in Active Directory directly — no import to the local database is performed. Specific WinRoute parameters are added by the template of the corresponding account.
Chapter 15 User Accounts and Groups 192 The searching is helpful especially when the domain includes too many accounts which might make it difficult to look up particular items. Hiding / showing disabled accounts It is possible to disable accounts in WinRoute .
15.2 Local user accounts 193 Note: It is also possible to select more than one account by using the Ctrl and Shift keys to perform mass changes of parameters for all selected accounts. In mapped Active Directory domains, it is not allowed to create or/and remove user accounts.
Chapter 15 User Accounts and Groups 194 Figure 15.2 Local user accounts in WinRoute Step 1 — basic information Figure 15.3 Creating a user account — basic parameters Name Username used for login to the account.
15.2 Local user accounts 195 Warning The user name is not case-sensitive. We recommend not to use special characters (non- English languages) which might cause problems when authenticating at the firewall’s web interfaces. Full name A full name of the user (usually first name and surname).
Chapter 15 User Accounts and Groups 196 Warning 1. Passwords may contain printable symbols only (letters, numbers, punctuation marks). Password is case-sensitive. We recommend not to use special characters (non-English languages) which might cause problems when authenticating via the Web interface.
15.2 Local user accounts 197 Step 3 — access rights Figure 15.5 Creating a new user account — user rights Each user must be assigned one of the following three levels of access rights. No access to administration The user has no rights to access the WinRoute administration.
Chapter 15 User Accounts and Groups 198 is displayed. The unlock feature must also be enabled in the corresponding URL rule (for details, refer to chapter 12.2 ). User can dial RAS connection If the Internet connection uses dial-up lines, users with this right will be allowed to dial and hang up these lines in the Web interface (see chapter 11 ).
15.2 Local user accounts 199 Figure 15.6 Creating a new user account — data transmission quota make such users to reduce their network activities). For detailed information, see chapter 9 . Check the Notify user by email when quota is exceeded option to enable sending of warn- ing messages to the user in case that a quota is exceeded.
Chapter 15 User Accounts and Groups 200 Don’t block further traffic mode • resetting of the data volume counter of the user (see chapter 20.1 ). 2. Actions for quota-exceeding are not applied if the user is authenticated at the firewall. This would block all firewall traffic as well as all local users.
15.2 Local user accounts 201 Pop-up windows Automatic opening of new browser windows — usually pop-up windows with advertise- ments. This option will allow / block the window.open() method in JavaScript . <Applet> HTML tags Applets in Java . Cross-domain referers This option allows / blocks the Referer item included in an HTTP header.
Chapter 15 User Accounts and Groups 202 Figure 15.8 Creating a new user account — IP addresses for VPN client and automatic logins Automatic login can be set for the firewall (i.e. for the WinRoute host) or/and for any other host(s) (i.e. when the user connects also from an additional workstation, such as notebooks, etc.
15.3 Local user database: external authentication and import of accounts 203 15.3 Local user database: external authentication and import of accounts User in the local database can be authenticated either at the Active Directory domain or at the Windows NT domain (see chapter 15.
Chapter 15 User Accounts and Groups 204 Figure 15.9 Import of accounts from Active Directory Figure 15.10 Importing accounts from the Windows NT domain 15.4 User accounts in Active Directory — domain mapping In WinRoute , it is possible to directly use user accounts from one or more Active Directory domain(s).
15.4 User accounts in Active Directory — domain mapping 205 Directory and forward them to the corresponding domain server. If another DNS server is used, user authentication in the Active Directory may not work correctly. • For mapping of multiple domains: 1.
Chapter 15 User Accounts and Groups 206 The first page of the wizard requires the full name of the Active Directory domain (e.g. company.com ) and name and password of a user with rights to add hosts to domains.
15.4 User accounts in Active Directory — domain mapping 207 Figure 15.13 Advanced options for cooperation with the Active Directory. If WinRoute is installed on Windows , it is possible to allow authentication compatible with older systems (i.e. authentication via the Windows NT domain).
Chapter 15 User Accounts and Groups 208 Secured connection to the domain server For higher security (to prevent from tapping of traffic and exploiting user passwords), connection to the Active Directory can be encrypted.
15.4 User accounts in Active Directory — domain mapping 209 Use buttons Add or Edit to open a dialog for a new domain definition and enter parameters of the mapped domain.
Chapter 15 User Accounts and Groups 210 15.5 User groups User accounts can be sorted into groups. Creating user groups provides the following benefits: • Specific access rights can be assigned to a group of users. These rights complement rights of individual users.
15.5 User groups 211 The searching is helpful especially when the domain includes too many groups which might make it difficult to look up particular items. Creating a new local user group In the Domain combo box in Groups , select Local User Database.
Chapter 15 User Accounts and Groups 212 Using the Add and Remove buttons you can add or remove users to/from the group. If user accounts have not been created yet, the group can be left empty and users can be added during the account definition (see chapter 15.
15.5 User groups 213 Additional rights: Users can override WWW content rules User belonging to the group can customize personal web content filtering settings (see chapter 15.
214 Chapter 16 Administrative settings 16.1 System configuration (Software Appliance / VMware Virtual Appli- ance) In the Software Appliance / VMware Virtual Appliance edition, the WinRoute administration console allows setting of a few basic parameters of the firewall’s operating system.
16.2 Setting Remote Administration 215 firewall’s system time. The time zone also includes information about daylight saving time settings. Kerio Technologies offers the following free NTP servers for this purpose: 0.kerio.pool.ntp.org , 1.kerio.pool.
Chapter 16 Administrative settings 216 Hint In WinRoute , you can use a similar method to allow or block remote administration of Kerio MailServer — for connection via the Administration Console , use the predefined service KMS Admin , for the Web Administration use HTTPS .
16.3 Update Checking 217 • 2 minutes after each startup of the WinRoute Firewall Engine , • and then every 24 hours. Results of each attempted update check (successful or not) is logged into the Debug log (see chapter 22.6 ). Check also for beta versions Enable this option if you want WinRoute to perform also update checks for beta versions.
218 Chapter 17 Advanced security features 17.1 P2P Eliminator Peer-to-Peer ( P2P ) networks are world-wide distributed systems, where each node can repre- sent both a client and a server. These networks are used for sharing of big volumes of data (this sharing is mostly illegal).
17.1 P2P Eliminator 219 Figure 17.1 Detection settings and P2P Eliminator allowance of only certain services and length of the period for which restrictions will be ap- plied). The email is sent only if a valid email address (see chapter 15.1 ) is specified in the particular user account.
Chapter 17 Advanced security features 220 Note: 1. If a user who is allowed to use P2P networks (see chapter 15.1 ) is connected to the fire- wall from a certain host, no P2P restrictions are applied to this host. Settings in the P2P Eliminator tab are always applied to unauthorized users.
17.2 Special Security Settings 221 Number of suspicious connections Big volume of connections established from the client host is a typical feature of P2P networks (usually one connection for each file).
Chapter 17 Advanced security features 222 Figure 17.4 Security options — Anti-Spoofing and cutting down number of connections for one host Anti-Spoofing Anti-Spoofing checks whether only packets with allowed source IP addresses are received at individual interfaces of the WinRoute host.
17.2 Special Security Settings 223 These restrictions protects firewall ( WinRoute host) from overload and may also help protect it from attacks to the target server, reduce activity and impact of a worm or Trojan horse.
224 Chapter 18 Other settings 18.1 Routing table Using Administration Console you can view or edit the system routing table of the host where WinRoute is running. This can be useful especially to resolve routing problems remotely (it is not necessary to use applications for terminal access, remote desktop, etc.
18.1 Routing table 225 Note: Changes in the routing table might interrupt the connection between the WinRoute Fire- wall Engine and the Administration Console .
Chapter 18 Other settings 226 Figure 18.2 Adding a route to the routing table Network, Network Mask IP address and mask of the destination network. Interface Selection of an interface through which the specific packet should be forwarded. Gateway IP address of the gateway (router) which can route to the destination network.
18.2 Universal Plug-and-Play (UPnP) 227 Removing routes from the Routing Table Using the Remove button in the WinRoute admin console, records can be removed from the routing table. The following rules are used for route removal: • Static routes in the Static Routes folder are managed by WinRoute .
Chapter 18 Other settings 228 Enable UPnP This option enables UPnP. Warning If WinRoute is running on Windows XP , Windows Server 2003 , Windows Vista or Windows Server 2008 , check that the following.
18.3 Relay SMTP server 229 18.3 Relay SMTP server WinRoute provides a function which enables notification to users or/and administrators by email alerts. These alert messages can be sent upon various events, for example when a virus is detected (see chapter 13.
Chapter 18 Other settings 230 be used for reference in recipient’s mail client or for email classification. This is why it is always recommended to specify sender’s email address in WinRoute . Connection test Click Test to test functionality of sending of email via the specified SMTP server.
231 Chapter 19 Status Information WinRoute activities can be well monitored by the administrator (or by other users with ap- propriate rights). There are three types of information — status monitoring, statistics and logs. • Communication of each computer, users connected or all connections using WinRoute can be monitored.
Chapter 19 Status Information 232 Figure 19.1 List of active hosts and users connected to the firewall User Name of the user which is connected from a particular host.
19.1 Active hosts and connected users 233 Connections Total number of connections to and from the host. Details can be displayed in the context menu (see below) Authentication method Authentication me.
Chapter 19 Status Information 234 User quota Use this option to show quota of the particular user ( Administration Console switches to the User quota tab in Status → Statistics and selects the particular user automatically). The User quota option is available in the context menu only for hosts from which a user is connected to the firewall.
19.1 Active hosts and connected users 235 Login information Information on logged-in users: • User — name of a user, DNS name (if available) and IP address of the host from which the user is connected • Login time — date and time when a user logged-in, authentication method that was used and inactivity time (idle).
Chapter 19 Status Information 236 • FTP — DNS name or IP address of the server, size of downloaded/saved data, information on currently downloaded/saved file (name of the file including the path, size of data downloaded/uploaded from/to this file).
19.1 Active hosts and connected users 237 The following columns are hidden by default. They can be shown through the Modify columns dialog opened from the context menu (for details, see chapter 3.2 ). Source port, Destination port Source and destination port (only for TCP and UDP protocols).
Chapter 19 Status Information 238 Figure 19.6 Information on selected host and user — traffic histogram Select an item from the Time interval combo box to specify a time period which the chart will refer to (2 hours or 1 day). The x axis of the chart represents time and the y axis represents traffic speed.
19.2 Network connections overview 239 • connections from other hosts to services provided by the host with WinRoute • connections performed by clients within the Internet that are mapped to services run- ning in LAN WinRoute administrators are allowed to close any of the active connections.
Chapter 19 Status Information 240 Source, Destination IP address of the source (the connection initiator) and of the destination. If there is an appropriate reverse record in DNS, the IP address will be substituted with the DNS name. The following columns are hidden by default.
19.2 Network connections overview 241 Figure 19.8 Context menu for Connections Refresh This option will refresh the information in the Connections window immediately. This function is equal to the function of the Refresh button at the bottom of the window.
Chapter 19 Status Information 242 For each item either a color or the Default option can be chosen. Default colors are set in the operating system (the common setting for default colors is black font and white background).
19.4 Alerts 243 • IP address — public IP address of the host which the client connects from (see the Hostname column above). • Client status — connecting , authenticating ( WinRoute verifies .
Chapter 19 Status Information 244 Figure 19.12 Alert Definitions alert Type of the event upon which the alert will be sent: • Virus detected — antivirus engine has detected a virus in a file transmitted by HTTP, FTP, SMTP or POP3 (refer to chapter 13 ).
19.4 Alerts 245 cense/subscription (or license of any module integrated in WinRoute , such as Kerio Web Filter , the McAfee antivirus, etc.) is getting closer. The WinRoute admin- istrator should check the expiration dates and prolong a corresponding license or subscription (for details, refer to chapter 4 ).
Chapter 19 Status Information 246 In the Administration Console , alerts are displayed in the language currently set as preferred (see Kerio Administration Console — Help ). If alert templates in the language are not available, English version is used instead.
19.4 Alerts 247 Figure 19.14 Details of a selected event.
248 Chapter 20 Basic statistics Statistical information about users (volume of transmitted data, used services, categorization of web pages) as well as of network interfaces of the WinRoute host (volume of transmitted data, load on individual lines) can be viewed in WinRoute .
20.1 Volume of transferred data and quota usage 249 Figure 20.1 User statistics is related to the user (the IN direction stands for data received by the user, while OUT represents data sent by the user). Hiding/showing of columns is addressed in chapter 3.
Chapter 20 Basic statistics 250 Warning Be aware that using this option for the all users item resets counters of all users, including unrecognized ones! Note: Values of volumes of transferred data are also used to check user traffic quota (see chapter 15.
20.2 Interface statistics 251 Figure 20.3 Firewall’s interface statistics Example The WinRoute host connects to the Internet through the Public interface and the local network is connected to the LAN interface. A local user downloads 10 MB of data from the Internet.
Chapter 20 Basic statistics 252 Refresh This option will refresh the information on the Interface Statistics tab immediately. This function is equal to the function of the Refresh button at the bottom of the window. Auto refresh Settings for automatic refreshing of the information on the Interface Statistics tab.
20.2 Interface statistics 253 The period ( 2 hours or 1 day ) can be selected in the Time interval box. The selected time range is always understood as the time until now (“last 2 hours” or “last 24 hours”). The x axis of the chart represents time and the y axis represents traffic speed.
254 Chapter 21 Kerio StaR - statistics and reporting The WinRoute’s web interface provides detailed statistics on users, volume of transferred data, visited websites and web categories. This information may help figure out browsing activities and habits of individual users.
21.1 Monitoring and storage of statistic data 255 is represented by several files on the disk. This implies that any data is kept in the cache even if the WinRoute Firewall Engine is stopped or another problem occurs (failure of power supply, etc.) though not having been stored in the database yet.
Chapter 21 Kerio StaR - statistics and reporting 256 The following example addresses case of a mapped web server accessible from the Internet. Any (anonymous) user in the Internet can connect to the server. However, web servers are usually located on a special machine which is not used by any user.
21.2 Settings for statistics and quota 257 Enable/disable gathering of statistic data The Gather Internet Usage statistics option enables/disables all statistics (i.e. stops gath- ering of data for statistics). The Monitor user browsing behavior option enables monitoring and logging of browsing activity of individual users.
Chapter 21 Kerio StaR - statistics and reporting 258 Statistics and quota exceptions On the Exceptions tab, it is possible to define exceptions for statistics and for transferred data quota. This feature helps avoid gathering of irrelevant information.
21.3 Connection to StaR and viewing statistics 259 For details on IP groups, see chapter 14.1 . Users and groups Select users and/or user groups which will be excluded from the statistics and no quota will be applied to them. This setting has the highest priority and overrules any other quota settings in user or group preferences.
Chapter 21 Kerio StaR - statistics and reporting 260 Note: Within local systems, secured traffic would be useless and the browser would bother user with needless alerts. Remote access to the statistics It is also possible to access the statistics remotely, i.
21.3 Connection to StaR and viewing statistics 261 Updating data in StaR First of all, the StaR interface is used for gathering of statistics and creating of reviews for cer- tain periods. To WinRoute , gathering and evaluation of information for StaR means processing of large data volumes.
262 Chapter 22 Logs Logs are files where history of certain events performed through or detected by WinRoute are recorded and kept. Each log is displayed in a window in the Logs section. Each event is represented by one record line. Each line starts with a time mark in brackets (date and time when the event took place, in seconds).
22.1 Log settings 263 Figure 22.1 Log settings File Logging Use the File Logging tab to define file name and rotation parameters. Enable logging to file Use this option to enable/disable logging to file according to the File name entry (the .log extension will be appended automatically).
Chapter 22 Logs 264 Figure 22.2 File logging settings ter 21.2 ). Rotation follows the rules described above. Syslog Logging Parameters for logging to a Syslog can be defined in the External Logging tab.
22.2 Logs Context Menu 265 Enable Syslog logging Enable/disable logging to a Syslog server. If this option is disabled, none of the following parameters and settings will be available. Syslog server DNS name or IP address of the Syslog server. Facility Facility that will be used for the particular WinRoute log (depends on the Syslog server).
Chapter 22 Logs 266 The Save log option opens a dialog box where the following optional parameters can be set: Figure 22.5 Saving a log to a file • Target file — name of the file where the log will be saved. By default, a name derived from the file name is set.
22.2 Logs Context Menu 267 Hint Select a new encoding type if special characters are not printed correctly in non-English versions. Log Settings A dialog where log parameters such as log file name, rotation and Syslog parameters can be set. These parameters can also be set in the Log settings tab under Configuration → Accounting .
Chapter 22 Logs 268 Highlighting rules are ordered in a list. The list is processed from the top. The first rule meeting the criteria stops other processing and the found rule is highlighted by the particular color. Thanks to these features, it is possible to create even more complex combinations of rules, exceptions, etc.
22.3 Alert Log 269 22.3 Alert Log The Alert log provides a complete history of alerts generated by WinRoute (e.g. alerts upon virus detection, dialing and hanging-up, reached quotas, detection of P2P networks, etc.
Chapter 22 Logs 270 Example [18/Apr/2008 10:27:46] james - insert StaticRoutes set Enabled=’1’, Description=’VPN’, Net=’192.168.76.0’, Mask=’255.
22.6 Debug Log 271 • [18/Apr/2008 10:22:47] — date and time when the event was logged (note: Con- nection logs are saved immediately after a disconnection). • [ID] 613181 — WinRoute connection identification number • [Rule] NAT — name of the traffic rule which has been used (a rule by which the traffic was allowed or denied).
Chapter 22 Logs 272 Figure 22.8 Expression for traffic monitored in the debug log The expression must be defined with special symbols. After clicking on the Help button, a brief description of possible conditions and examples of their use will be displayed.
22.7 Dial Log 273 • WAN / Dial-up messages information about dialed lines (request dialing, auto disconnection down-counter), • Filtering — logs proving information on filtering of traffic passing through WinRoute (antivirus control, website classification, detection and elimination of P2P networks, dropped packets, etc.
Chapter 22 Logs 274 connection time 00:15:53, 1142391 bytes received, 250404 bytes transmitted The first log item is recorded upon reception of a hang-up request. The log provides information about interface name, client type, IP address and username.
22.8 Error Log 275 Another event is logged upon a successful connection (i.e. when the line is dialed, upon authentication on a remote server, etc.). 6. Connection error (e.g. error at the modem was detected, dial-up was disconnected, etc.) [15/Mar/2008 15:59:08] DNS query for "www.
Chapter 22 Logs 276 • 8100-8199 — errors of the Kerio Web Filter module • 8200-8299 — authentication subsystem errors • 8300-8399 — anti-virus module errors (anti-virus test not successful, problems when storing temporary files, etc.
22.10 Http log 277 Packet log example [16/Apr/2008 10:51:00] PERMIT ’Local traffic’ packet to LAN, proto:TCP, len:47, ip/port:195.39.55.4:41272 -> 192.
Chapter 22 Logs 278 An example of an HTTP log record in the Apache format 192.168.64.64 - jflyaway [18/Apr/2008:15:07:17 +0200] "GET http://www.kerio.
22.11 Security Log 279 Example [17/Jul/2008 11:46:38] Anti-Spoofing: Packet from LAN, proto:TCP, len:48, ip/port:61.173.81.166:1864 -> 195.39.55.10:445, flags: SYN, seq:3819654104 ack:0, win:16384, tcplen:0 • packet from — packet direction (either from , i.
Chapter 22 Logs 280 administration interface, WebAdmin SSL = secure web administration interface, Proxy = proxy server user authentication) • <IP address> — IP address of the computer from w.
22.14 Web Log 281 • 3000-3999 — warning from individual WinRoute modules (e.g. DHCP server, anti-virus check, user authentication, etc.) • 4000-4999 — license warnings (subscription expiration.
Chapter 22 Logs 282 Note: If the page title cannot be identified (i.e. for its content is compressed), the "Encoded content" will be reported.
283 Chapter 23 Kerio VPN WinRoute enables secure interconnection of remote private networks using an encrypted tun- nel and it provides clients secure access to their local networks via the Internet. This method of interconnection of networks (and of access of remote clients to local networks) is called virtual private network ( VPN ).
Chapter 23 Kerio VPN 284 • No special user accounts must be created for VPN clients. User accounts in WinRoute (or domain accounts if the Active Directory is used — see chapter 10.1 ) are used for authentication. • Statistics about VPN tunnels and VPN clients can be viewed in WinRoute (refer to chap- ter 20.
23.1 VPN Server Configuration 285 Figure 23.2 VPN server settings — basic parameters The action will be applied upon clicking the Apply button in the Interfaces tab.
Chapter 23 Kerio VPN 286 later). 2. Regarding two VPN tunnels, it is also examined when establishing a connection whether the VPN subnet does not collide with IP ranges at the other end of the tunnel (remote endpoint).
23.1 VPN Server Configuration 287 Figure 23.4 VPN server settings — specification of DNS servers for VPN clients If the DNS module is already used as a DNS server for local hosts, it is recommended to use it also for VPN clients.
Chapter 23 Kerio VPN 288 WINS configuration for VPN clients The WINS service is used for resolution of hostnames to IP addresses within Microsoft Windows networks. Assigning of a WINS server address then allows VPN clients browse in LAN hosts ( Network Neighborhood / My Network Places ).
23.2 Configuration of VPN clients 289 Figure 23.6 VPN server settings — server port and routes for VPN clients Custom Routes Other networks to which a VPN route will be set for the client can be specified in this section. By default, routes to all local subnets at the VPN server’s side are defined — see chapter 23.
Chapter 23 Kerio VPN 290 Note: Remote VPN clients connecting to WinRoute are included toward the number of persons using the license (see chapters 4 and 4.6 ). Be aware of this fact when deciding on what license type should be purchased (or whether an add-on for upgrade to a higher number of users for the license should be bought).
23.3 Interconnection of two private networks via the Internet (VPN tunnel) 291 23.3 Interconnection of two private networks via the Internet (VPN tunnel) WinRoute with support for VPN (VPN support is .
Chapter 23 Kerio VPN 292 Name of the tunnel Each VPN tunnel must have a unique name. This name will be used in the table of inter- faces, in traffic rules (see chapter 7.
23.3 Interconnection of two private networks via the Internet (VPN tunnel) 293 Figure 23.9 VPN tunnel — certificate fingerprints DNS Settings DNS must be set properly at both sends of the tunnel so that it is possible to connect to hosts in the remote network using their DNS names.
Chapter 23 Kerio VPN 294 Figure 23.10 VPN tunnel’s routing configuration Connection establishment Active endpoints automatically attempt to recover connection whenever they detect that the correspo.
23.3 Interconnection of two private networks via the Internet (VPN tunnel) 295 Note: VPN tunnels keeps their connection (by sending special packets in regular time intervals) even if no data is transmitted. This feature protects tunnels from disconnection by other firewalls or network devices between ends of tunnels.
Chapter 23 Kerio VPN 296 2. Traffic rules set by this method allow full IP communication between the local network, remote network and all VPN clients. For access restrictions, define corresponding traffic rules (for local traffic, VPN clients, VPN tunnel, etc.
23.5 Example of Kerio VPN configuration: company with a filial office 297 Routes provided automatically Unless any custom routes are defined, the following rules apply to the interchange of routing.
Chapter 23 Kerio VPN 298 The server (default gateway) of the headquarters uses the public IP address 63.55.21.12 (DNS name is newyork.company.com ), the server of the branch office uses a dynamic IP address assigned by DHCP. The local network of the headquarters consists of two subnets, LAN 1 and LAN 2 .
23.5 Example of Kerio VPN configuration: company with a filial office 299 Common method The following actions must be taken in both local networks (i.e. in the main office and the filial): 1. It is necessary that WinRoute in version 6.0.0 or higher (older versions do not include Kerio VPN ) is installed at the default gateway.
Chapter 23 Kerio VPN 300 6. In traffic rules, allow traffic between the local network, remote network and VPN clients and set desirable access restrictions. In this network configuration, all desirable restric- tions can be set at the headquarter’s server.
23.5 Example of Kerio VPN configuration: company with a filial office 301 In step 5, select Create rules for Kerio VPN server . Status of the Create rules for Kerio Clientless SSL-VPN option is irrelevant (this example does not include Clientless SSL-VPN interface’s issues).
Chapter 23 Kerio VPN 302 Figure 23.17 Headquarter — DNS forwarding settings • Set the IP address of this interface ( 10.1.1.1 ) as a primary DNS server for the WinRoute host’s interface connected to the LAN 1 local network.
23.5 Example of Kerio VPN configuration: company with a filial office 303 • Set the IP address 10.1.1.1 as a primary DNS server also for the other hosts. Note: For proper functionality of DNS, the DNS database must include records for hosts in a corresponding local network.
Chapter 23 Kerio VPN 304 5. Create a passive end of the VPN tunnel (the server of the branch office uses a dynamic IP address). Specify the remote endpoint’s fingerprint by the fingerprint of the certificate of the branch office VPN server. Figure 23.
23.5 Example of Kerio VPN configuration: company with a filial office 305 Figure 23.21 Headquarter — final traffic rules Rules defined this way meet all the restriction requirements. Traffic which will not match any of these rules will be blocked by the default rule (see chapter 7.
Chapter 23 Kerio VPN 306 In this case, it would be meaningless to create rules for the Kerio VPN server and/or the Kerio Clientless SSL-VPN , since the server uses a dynamic public IP address). Therefore, leave these options disabled in step 5. Figure 23.
23.5 Example of Kerio VPN configuration: company with a filial office 307 Figure 23.25 Filial office — DNS forwarding settings Figure 23.26 Filial office — TCP/IP configuration at a firewall’s interface connected to the local network • Set the IP address 192.
Chapter 23 Kerio VPN 308 certificate provided by a certification authority is available). Note: A free subnet which has been selected is now specified automatically in the VPN network and Mask entries. Figure 23.27 Filial office — VPN server configuration For a detailed description on the VPN server configuration, refer to chapter 23.
23.5 Example of Kerio VPN configuration: company with a filial office 309 Figure 23.28 Filial office — definition of VPN tunnel for the headquarters Figure 23.29 Filial office — final traffic rules Note: It is not necessary to perform any other customization of traffic rules.
Chapter 23 Kerio VPN 310 VPN test Configuration of the VPN tunnel has been completed by now. At this point, it is recommended to test availability of the remote hosts from each end of the tunnel (from both local networks). For example, the ping or/and tracert operating system commands can be used for this testing.
23.6 Example of a more complex Kerio VPN configuration 311 The headquarters uses the DNS domain company.com , filials use subdomains santaclara.company.com and newyork.company.com . Configuration of individual local networks and the IP addresses used are shown in the figure.
Chapter 23 Kerio VPN 312 To provide correct forwarding of DNS requests from a WinRoute host, it is necessary to use an IP address of a network device belonging to the host as the primary DNS server.
23.6 Example of a more complex Kerio VPN configuration 313 The following sections provide detailed description of the Kerio VPN configuration both for the headquarter and the filial offices. Headquarters configuration 1. Install WinRoute (version 6.
Chapter 23 Kerio VPN 314 This step will create rules for connection of the VPN server as well as for communication of VPN clients with the local network (through the firewall).
23.6 Example of a more complex Kerio VPN configuration 315 Figure 23.35 Headquarter — TCP/IP configuration at a firewall’s interface connected to the local network.
Chapter 23 Kerio VPN 316 4. Enable the VPN server and configure its SSL certificate (create a self-signed certificate if no certificate provided by a certification authority is available). Note: A free subnet which has been selected is now specified automatically in the VPN network and Mask entries.
23.6 Example of a more complex Kerio VPN configuration 317 5. Create a passive endpoint of the VPN tunnel connected to the London filial. Use the fin- gerprint of the VPN server of the London filial office as a specification of the fingerprint of the remote SSL certificate.
Chapter 23 Kerio VPN 318 Figure 23.38 The headquarters — routing configuration for the tunnel connected to the London filial Warning In case that the VPN configuration described here is applied (see figure 23.
23.6 Example of a more complex Kerio VPN configuration 319 6. Use the same method to create a passive endpoint for the tunnel connected to the Paris filial.
Chapter 23 Kerio VPN 320 Figure 23.40 The headquarters — routing configuration for the tunnel connected to the Paris filial Figure 23.41 Headquarter — final traffic rules.
23.6 Example of a more complex Kerio VPN configuration 321 Configuration of the London filial 1. Install WinRoute (version 6.1.0 or higher) at the default gateway of the filial’s network. 2. Use Network Rules Wizard (see chapter 7.1 ) to configure the basic traffic policy in WinRoute .
Chapter 23 Kerio VPN 322 This step will create rules for connection of the VPN server as well as for communication of VPN clients with the local network (through the firewall). Figure 23.44 The London filial office — default traffic rules for Kerio VPN 3.
23.6 Example of a more complex Kerio VPN configuration 323 Figure 23.46 The London filial office — VPN server configuration For a detailed description on the VPN server configuration, refer to chapter 23.1 . 5. Create an active endpoint of the VPN tunnel which will connect to the headquarters server ( newyork.
Chapter 23 Kerio VPN 324 branch office server. Figure 23.47 The London filial office — definition of VPN tunnel for the headquarters.
23.6 Example of a more complex Kerio VPN configuration 325 Figure 23.48 The London filial — routing configuration for the tunnel connected to the headquarters.
Chapter 23 Kerio VPN 326 6. Create a passive endpoint of the VPN tunnel connected to the Paris filial. Use the finger- print of the VPN server of the Paris filial office as a specification of the fingerprint of the remote SSL certificate. Figure 23.
23.6 Example of a more complex Kerio VPN configuration 327 Figure 23.50 The London filial — routing configuration for the tunnel connected to the Paris branch office Figure 23.
Chapter 23 Kerio VPN 328 Configuration of the Paris filial 1. Install WinRoute (version 6.1.0 or higher) at the default gateway of the filial’s network. 2. Use Network Rules Wizard (see chapter 7.1 ) to configure the basic traffic policy in WinRoute .
23.6 Example of a more complex Kerio VPN configuration 329 3. Customize DNS configuration as follows: • In the WinRoute’s DNS module configuration, enable DNS forwarder (forwarding of DNS requests to other servers). • Enable the Use custom forwarding option and define rules for names in the company.
Chapter 23 Kerio VPN 330 Figure 23.55 The Paris filial office — VPN server configuration.
23.6 Example of a more complex Kerio VPN configuration 331 5. Create an active endpoint of the VPN tunnel which will connect to the headquarters server ( newyork.company.com ). Use the fingerprint of the VPN server of the headquarters as a specification of the fingerprint of the remote SSL certificate.
Chapter 23 Kerio VPN 332 Paris branch office server. Figure 23.57 The Paris filial — routing configuration for the tunnel connected to the headquarters.
23.6 Example of a more complex Kerio VPN configuration 333 6. Create an active endpoint of the tunnel connected to London (server gw-london.company.com ). Use the fingerprint of the VPN server of the London filial office as a specification of the fingerprint of the remote SSL certificate.
Chapter 23 Kerio VPN 334 Figure 23.59 The Paris filial — routing configuration for the tunnel connected to the London branch office Figure 23.60 The Paris filial office — final traffic rules connect to this branch office). VPN test The VPN configuration has been completed by now.
335 Chapter 24 Kerio Clientless SSL-VPN (Windows) Kerio Clientless SSL-VPN (thereinafter “ SSL-VPN ”) is a special interface used for secured remote access to shared items (files and folders) in the network protected by WinRoute via a web browser.
Chapter 24 Kerio Clientless SSL-VPN (Windows) 336 SSL-VPN interface configuration The SSL-VPN interface can be enabled/disabled on the Web Interface → SSL-VPN in the Config- uration → Advanced Options section.
24.2 Usage of the SSL-VPN interface 337 Allowing access from the Internet Access to the SSL-VPN interface from the Internet must be allowed by defining a traffic rule allowing connection to the firewall’s HTTPS service. For details, see chapter 7.
338 Chapter 25 Specific settings and troubleshooting This chapter provides description of advanced features and specific configurations of the fire- wall. It also includes helpful guidelines for solving of issues which might occur when you use WinRoute in your network.
25.2 Configuration files 339 25.2 Configuration files This chapter provides clear descriptions of WinRoute configuration and status files. This infor- mation can be helpful for example when troubleshooting specific issues in cooperation with the Kerio Technologies technical support department.
Chapter 25 Specific settings and troubleshooting 340 Status files In addition, WinRoute generates other files and directories where certain status information is saved: Files: dnscache.cfg DNS files stored in the DNS module’s cache (see chapter 8.
25.3 Automatic user authentication using NTLM 341 General conditions The following conditions are applied to this authentication method: 1. WinRoute Firewall Engine is running as a service or it is running under a user account with administrator rights to the WinRoute host.
Chapter 25 Specific settings and troubleshooting 342 The configuration of the WinRoute’s web interface must include a valid DNS name of the server on which WinRoute is running (for details, see chapter 11.
25.4 FTP on WinRoute’s proxy server 343 NTLM authentication arise, it is recommended to remove all usernames/passwords for the server where WinRoute is installed from the Password Manager . Firefox/SeaMonkey The browser displays the login dialog. For security reasons, automatic user authentica- tion is not used by default in the browser.
Chapter 25 Specific settings and troubleshooting 344 Terminal FTP clients (such as the ftp command in Windows or Linux ) do not allow config- uration of the proxy server. For this reason, they cannot be used for our purposes. 2. To connect to FTP servers, the proxy server uses the passive FTP mode.
25.4 FTP on WinRoute’s proxy server 345 Figure 25.3 Configuring proxy server in Internet Explorer 6.0 Hint To configure web browsers, you can use a configuration script or the automatic detection of configuration. For details, see chapter 8.4 . Note: Web browsers used as FTP clients enable only to download files.
Chapter 25 Specific settings and troubleshooting 346 Figure 25.4 Setting proxy server for FTP in Total Commander Hint The defined proxy server is indexed and saved to the list of proxy servers automatically. Later, whenever you are creating other FTP connections, you can simply select a corresponding proxy server in the list.
25.5 Internet links dialed on demand 347 If WinRoute receives a packet from the local network, it will compare it with the system routing table. If the packets goes out to the Internet, no record will be found, since there is no default route in the routing table.
Chapter 25 Specific settings and troubleshooting 348 from the local host to the Internet, the packet will be dropped by the operating system before the WinRoute driver is able to capture it. 2. Typically the server is represented by the DNS name within traffic between clients and an Internet server.
25.5 Internet links dialed on demand 349 5. The Proxy server in WinRoute (see chapter 8.4 ) also provides direct dial-up connections. A special page providing information on the connection process is opened (the page is refreshed in short periods). Upon a successful connection, the browser is redirected to the specified Website.
Chapter 25 Specific settings and troubleshooting 350 All DNS names missing a suitable rule will be dialed automatically by the DNS module when demanded. In Actions for DNS name, you can select either the Dial or the Ignore option. Use the second option to block dialing of the line in response to a request for this DNS name.
351 Chapter 26 Technical support Free email and telephone technical support is provided for Kerio WinRoute Firewall . Contacts and more information can be found at http://www.kerio.com/support . Our technical sup- port staff is ready to help you with any problem you might have.
Chapter 26 Technical support 352 as kerio_support_info.txt . Note: The kerio_support_info.txt is generated by the Administration Console . This implies that in case you connect to the administration r.
353 Appendix A Legal Notices Microsoft , Windows , Windows NT , Windows Vista , Internet Explorer , ActiveX , and Active Directory are registered trademarks or trademarks of Microsoft Corporation . Mac OS and Safari are registered trademarks or trademarks of Apple Computer, Inc.
354 Appendix B Used open source items Kerio WinRoute Firewall contains the following open-source software (open source): bindlib Copyright 1983, 1993 The Regents of the University of California. All rights reserved. Portions Copyright 1993 by Digital Equipment Corporation.
355 KVNET — driver Kerio Virtual Network Interface driver for Linux (driver for the Kerio VPN virtual network adapter) Copyright Kerio Technologies s.r.o. Homepage: http://www.kerio.com/ Kerio Virtual Network Interface driver for Linux is distributed and licensed under GPL version 2.
Appendix B Used open source items 356 PHP Copyright 1999-2006 The PHP Group. All rights reserved. This product includes PHP software available for free at: http://www.php.net/software/ php_mbstring Copyright 2001-2004 The PHP Group. Copyright 1998-2002 HappySize, Inc.
357 Glossary of terms ActiveX This Microsoft’s proprietary technology is used for creation of dynamic objects for web pages. This technology provides many features, such as writing to disk or execution of commands at the client (i.e. on the host where the Web page is opened).
Glossary of terms 358 DMZ DMZ (demilitarized zone) is a reserved network area where services available both from the Internet and from the LAN are run (e.g. a company’s public web server). DMZ provides an area, where servers accessible for public are be located separately, so they cannot be misused for cracking into the LAN.
359 Ident The Ident protocol is used for identification of user who established certain TCP connec- tion from a particular (multi-user) system. The Ident service is used for example by IRC servers, FTP servers and other services. More information (in English) can be found for example at Wikipedia .
Glossary of terms 360 will be redirected to this host. Packets that do not match with any record in the NAT table will be dropped. • destination address translation ( Destination NAT, DNAT , it is also called port mapping) — is used to enable services in the local network from the Internet.
361 Ports 1-1023 are reserved and used by well known services (e.g. 80 = WWW). Ports above 1023 can be freely used by any application. PPTP Microsoft’s proprietary protocol used for design of virtual private networks. See chapters and sections concerning VPN .
Glossary of terms 362 Routing table The information used by routers when making packet forwarding decisions (so called routes). Packets are routed according to the packet’s destination IP address. On Windows , routing table can be printed by the route print command, while on Unix systems ( Linux , Mac OS X , etc.
363 • RST (Reset) — request on termination of a current connection and on initiation of a new one • URG (Urgent) — urgent packet • PSH (Push) — request on immediate transmission of the data to upper TCP/IP layers • FIN (Finalize) — connection finalization TCP/IP Name used for all traffic protocols used in the Internet (i.
364 Index A Active Directory 196 domain mapping 204 import of user accounts 203 mapping of other domains 208 administration 27 remote 18 , 215 Administration Console 27 columns 31 views setup 31 alert.
365 local domain 107 dynamic DNS 119 F FTP 147 , 186 , 343 filtering rules 162 full cone NAT 87 G groups interface throughput charts 47 IP address 180 of forbidden words 160 URL 187 user groups 190 , 196 , 210 H H.
Index 366 M media hairpinning 102 multihoming 93 N NAT 84 , 90 full cone NAT 87 , 101 NT domain import of user accounts 203 NTLM 138 , 139 configuration of web browsers 343 deployment 340 WinRoute co.
367 traffic policy 71 created by wizard 75 default rule 77 definition 78 exceptions 95 Internet access limiting 94 wizard 71 transparent proxy 124 Trial ID 37 TTL 125 , 128 U uninstallation 19 update.
368.
Un punto importante, dopo l’acquisto del dispositivo (o anche prima di acquisto) è quello di leggere il manuale. Dobbiamo farlo per diversi motivi semplici:
Se non hai ancora comprato il Kerio Tech 6 è un buon momento per familiarizzare con i dati di base del prodotto. Prime consultare le pagine iniziali del manuale d’uso, che si trova al di sopra. Dovresti trovare lì i dati tecnici più importanti del Kerio Tech 6 - in questo modo è possibile verificare se l’apparecchio soddisfa le tue esigenze. Esplorando le pagine segenti del manuali d’uso Kerio Tech 6 imparerai tutte le caratteristiche del prodotto e le informazioni sul suo funzionamento. Le informazioni sul Kerio Tech 6 ti aiuteranno sicuramente a prendere una decisione relativa all’acquisto.
In una situazione in cui hai già il Kerio Tech 6, ma non hai ancora letto il manuale d’uso, dovresti farlo per le ragioni sopra descritte. Saprai quindi se hai correttamente usato le funzioni disponibili, e se hai commesso errori che possono ridurre la durata di vita del Kerio Tech 6.
Tuttavia, uno dei ruoli più importanti per l’utente svolti dal manuale d’uso è quello di aiutare a risolvere i problemi con il Kerio Tech 6. Quasi sempre, ci troverai Troubleshooting, cioè i guasti più frequenti e malfunzionamenti del dispositivo Kerio Tech 6 insieme con le istruzioni su come risolverli. Anche se non si riesci a risolvere il problema, il manuale d’uso ti mostrerà il percorso di ulteriori procedimenti – il contatto con il centro servizio clienti o il servizio più vicino.
