Kerio Tech KERIO WINROUTE FIREWALL 6 Service-Handbuch

Kerio WinRoute Firewall 6

Administrator’s Guide

Kerio Technologies s.r.o.

This guide provides detailed description on conﬁguration and administration of Kerio

WinRoute Firewall, version 6.7.1. All additional modiﬁcations and updates reserved. User

interfaces Kerio StaR and Kerio Clientless SSL-VPN are focused in a standalone document,

Kerio WinRoute Firewall — User’s Guide. The Kerio VPN Client application is described in

a stand-alone document Kerio VPN Client — User’s Guide.

For current version of the product, go to http://www.kerio.com/firewall/download. For

other documents addressing the product, see http://www.kerio.com/firewall/manual.

Information regarding registered trademarks and trademarks are provided in appendix A.

Products Kerio WinRoute Firewall and Kerio VPN Client include open source software. To

view the list of open source items included, refer to attachment B.

Contents

1 Quick Checklist ................................................................ 7

2 Introduction ................................................................... 9

2.1 What’s new in 6.7.1 ....................................................... 9

2.2 Conﬂicting software ..................................................... 10

2.3 System requirements .................................................... 11

2.4 Installation - Windows ................................................... 12

2.5 Initial conﬁguration wizard (Windows) .................................... 17

2.6 Upgrade and Uninstallation - Windows .................................... 19

2.7 Installation - Software Appliance and VMware Virtual Appliance ........... 20

2.8 Upgrade - Software Appliance / VMware Virtual Appliance ................ 23

2.9 WinRoute Components ................................................... 23

2.10 WinRoute Engine Monitor (Windows) ..................................... 24

2.11 The ﬁrewall’s console (Software Appliance / VMware Virtual Appliance) . . . . 25

3 WinRoute Administration ..................................................... 27

3.1 Administration Console - the main window ............................... 28

3.2 Administration Console - view preferences ................................ 31

4 Product Registration and Licensing ............................................ 32

4.1 License types and number of users ....................................... 32

4.2 License information ...................................................... 33

4.3 Registration of the product in the Administration Console ................ 35

4.4 Product registration at the website ....................................... 43

4.5 Subscription / Update Expiration ......................................... 43

4.6 User counter ............................................................ 45

5 Network interfaces ............................................................ 47

6 Internet Connection ........................................................... 53

6.1 Persistent connection with a single link ................................... 54

6.2 Connection with a single leased link - dial on demand ..................... 57

6.3 Connection Failover ...................................................... 62

6.4 Network Load Balancing ................................................. 66

7 Traﬃc Policy .................................................................. 71

7.1 Network Rules Wizard ................................................... 71

7.2 How traﬃc rules work ................................................... 78

7.3 Deﬁnition of Custom Traﬃc Rules ........................................ 78

7.4 Basic Traﬃc Rule Types .................................................. 90

7.5 Policy routing ........................................................... 95

7.6 User accounts and groups in traﬃc rules ................................. 98

7.7 Partial Retirement of Protocol Inspector .................................. 99

7.8 Use of Full cone NAT .................................................. 101

7.9 Media hairpinning ..................................................... 102

8 Conﬁguration of network services ........................................... 104

8.1 DNS module ........................................................... 104

8.2 DHCP server ........................................................... 110

8.3 Dynamic DNS for public IP address of the ﬁrewall ....................... 119

8.4 Proxy server ........................................................... 121

8.5 HTTP cache ............................................................ 124

9 Bandwidth Limiter ........................................................... 130

9.1 How the bandwidth limiter works and how to use it ..................... 130

9.2 Bandwidth Limiter conﬁguration ....................................... 130

9.3 Detection of connections with large data volume transferred ............ 135

10 User Authentication .......................................................... 137

10.1 Firewall User Authentication ........................................... 137

11 Web Interface ................................................................ 141

11.1 Web interface preferences .............................................. 141

11.2 User authentication at the web interface ................................ 146

12 HTTP and FTP ﬁltering ....................................................... 147

12.1 Conditions for HTTP and FTP ﬁltering .................................. 147

12.2 URL Rules ............................................................. 148

12.3 Content Rating System (Kerio Web Filter) ............................... 154

12.4 Web content ﬁltering by word occurrence ............................... 158

12.5 FTP Policy ............................................................. 162

13 Antivirus control ............................................................ 167

13.1 Conditions and limitations of antivirus scan ............................ 167

13.2 How to choose and setup antiviruses ................................... 168

13.3 HTTP and FTP scanning ................................................ 172

13.4 Email scanning ........................................................ 176

13.5 Scanning of ﬁles transferred via Clientless SSL-VPN (Windows) ........... 178

14 Deﬁnitions ................................................................... 180

14.1 IP Address Groups ..................................................... 180

14.2 Time Ranges .......................................................... 181

14.3 Services ............................................................... 183

14.4 URL Groups ........................................................... 187

15 User Accounts and Groups ................................................... 190

15.1 Viewing and deﬁnitions of user accounts ............................... 191

15.2 Local user accounts .................................................... 193

15.3 Local user database: external authentication and import of accounts . . . . . 203

15.4 User accounts in Active Directory — domain mapping ................... 204

15.5 User groups ........................................................... 210

16 Administrative settings ...................................................... 214

16.1 System conﬁguration (Software Appliance / VMware Virtual Appliance) . . 214

16.2 Setting Remote Administration ......................................... 215

16.3 Update Checking ...................................................... 216

17 Advanced security features .................................................. 218

17.1 P2P Eliminator ......................................................... 218

17.2 Special Security Settings ............................................... 221

18 Other settings ................................................................ 224

18.1 Routing table .......................................................... 224

18.2 Universal Plug-and-Play (UPnP) ......................................... 227

18.3 Relay SMTP server ..................................................... 229

19 Status Information ........................................................... 231

19.1 Active hosts and connected users ...................................... 231

19.2 Network connections overview ......................................... 238

19.3 List of connected VPN clients ........................................... 242

19.4 Alerts ................................................................. 243

20 Basic statistics ............................................................... 248

20.1 Volume of transferred data and quota usage ............................ 248

20.2 Interface statistics ..................................................... 250

21 Kerio StaR - statistics and reporting .......................................... 254

21.1 Monitoring and storage of statistic data ................................ 254

21.2 Settings for statistics and quota ........................................ 256

21.3 Connection to StaR and viewing statistics ............................... 259

22 Logs ......................................................................... 262

22.1 Log settings ........................................................... 262

22.2 Logs Context Menu .................................................... 265

22.3 Alert Log .............................................................. 269

22.4 Conﬁg Log ............................................................. 269

22.5 Connection Log ........................................................ 270

22.6 Debug Log ............................................................. 271

22.7 Dial Log ............................................................... 273

22.8 Error Log .............................................................. 275

22.9 Filter Log .............................................................. 276

22.10 Http log ............................................................... 277

22.11 Security Log ........................................................... 278

22.12 Sslvpn Log ............................................................ 280

22.13 Warning Log ........................................................... 280

22.14 Web Log ............................................................... 281

23 Kerio VPN .................................................................... 283

23.1 VPN Server Conﬁguration .............................................. 284

23.2 Conﬁguration of VPN clients ........................................... 289

23.3 Interconnection of two private networks via the Internet (VPN tunnel) . . . 291

23.4 Exchange of routing information ....................................... 296

23.5 Example of Kerio VPN conﬁguration: company with a ﬁlial oﬃce ......... 297

23.6 Example of a more complex Kerio VPN conﬁguration .................... 310

24 Kerio Clientless SSL-VPN (Windows) .......................................... 335

24.1 Conﬁguration of WinRoute’s SSL-VPN ................................... 335

24.2 Usage of the SSL-VPN interface ......................................... 337

25 Speciﬁc settings and troubleshooting ......................................... 338

25.1 Conﬁguration Backup and Transfer ..................................... 338

25.2 Conﬁguration ﬁles ..................................................... 339

25.3 Automatic user authentication using NTLM ............................. 340

25.4 FTP on WinRoute’s proxy server ........................................ 343

25.5 Internet links dialed on demand ........................................ 346

26 Technical support ............................................................ 351

26.1 Essential Information .................................................. 351

26.2 Tested in Beta version ................................................. 352

A Legal Notices ................................................................. 353

B Used open source items ...................................................... 354

Glossary of terms ............................................................ 357

Index ........................................................................ 364

Chapter 1

Quick Checklist

In this chapter you can ﬁnd a brief guide for a quick setup of Kerio WinRoute Firewall (referred

to as “WinRoute” within this document). After this setup the ﬁrewall should be immediately

available and able to share your Internet connection and protect your local network. For

a detailed guide refer to the separate WinRoute — Step-by-Step Conﬁguration guide.

If you are not sure how to set any of the Kerio WinRoute Firewall functions or features, look up

the appropriate chapter in this manual. For information about your Internet connection (such

as your IP address, default gateway, DNS server, etc.) contact your ISP.

Note: In this guide, the expression ﬁrewall represents the host where WinRoute is (or will be)

installed.

1. The ﬁrewall must include at least two interfaces — one must be connected to the local

network (e.g. Ethernet or WiFi network adapter), another must be connected to the Internet

(e.g. Ethernet or WiFi network adapter, USB ADSL modem, analog modem or an ISDN

adapter).

On Windows, test functionality of the Internet connection and of traﬃc among hosts within

the local network before you run the WinRoute installation. This test will reduce possible

problems with debugging and error detections.

2. Run WinRoute installation and in the wizard provide required basic parameters (for details,

see chapter 2.4 or 2.7).

3. Set interface groups and basic traﬃc rules using the Network Rules Wizard (see chap-

ter 7.1).

4. Run the DHCP server and set required IP ranges including their parameters (subnet mask,

default gateway, DNS server address/domain name). For details, see chapter 8.2.

5. Check DNS module settings. Deﬁne the local DNS domain if you intend to scan the hosts

ﬁle and/or the DHCP server table. For details, see chapter 8.1.

6. Set user mapping from the Active Directory domain or create/import local user accounts

and groups. Set user access rights. For details see chapter 15.

7. Deﬁne IP groups (chapter 14.1), time ranges (chapter 14.2) and URL groups (chapter 14.4),

that will be used during rules deﬁnition (refer to chapter 14.2).

8. Create URL rules (chapter 12.2) and set the Kerio Web Filter module (chapter 12.3). Set

HTTP cache and automatic conﬁguration of browsers (chapter 8.5). Deﬁne FTP rules (chap-

ter 12.5).

Chapter 1 Quick Checklist

9. Select an antivirus and deﬁne types of objects that will be scanned.

If you choose the integrated McAfee antivirus application, check automatic update settings

and edit them if necessary.

External antivirus must be installed before it is set in WinRoute, otherwise it is not available

in the combo box.

10. Using one of the following methods set TCP/IP parameters for the network adapter of

individual LAN clients:

•Automatic conﬁguration — activate the Obtain an IP address automatically option.

Do not set any other parameters.

•Manual conﬁguration — deﬁne IP address, subnet mask, default gateway address,

DNS server address and local domain name.

Use one of the following methods to set the Web browser at each workstation:

•Automatic conﬁguration — activate the Automatically detect settings option (Inter-

net Explorer) or specify URL for automatic conﬁguration (other types of browsers).

For details, refer to chapter 8.5.

•Manual conﬁguration — select type of connection via the local network or deﬁne

IP address and appropriate proxy server port (see chapter 8.4).

Chapter 2

Introduction

2.1 What’s new in 6.7.1

In version 6.7.1, WinRoute brings the following new features:

Kerio WinRoute Firewall Software Appliance / VMware Virtual Appliance

Kerio WinRoute Firewall is now available as a so called software appliance (Software Ap-

pliance / VMware Virtual Appliance). This appliance is distributed as a full installation

package with the ﬁrewall and operating system and can be installed on a physical or

virtual computer without an operating system. Software Appliance cannot be installed

on a computer with another operating system. Installation package of the standalone

product for installation on Linux is not available.

Kerio WinRoute Firewall in the Software Appliance / VMware Virtual Appliance edition

provides the same features as the Windows version, only with the Kerio Clientless SSL-

VPN interface missing.

Web administration interface (Web Administration)

The new Web Administration interface allows both remote and local administration of

the ﬁrewall without the need to install the Kerio Administration Console. This interface

allows conﬁguration of crucial WinRoute parameters — the interface, traﬃc policy, HTTP

and FTP ﬁltering rules, user accounts and groups, etc. However, the Kerio Administration

Console is still available and allow setting of all conﬁguration options.

The Web Administration interface is available at https://server:4081/admin (server

stands for the ﬁrewall name or IP address and 4081 for the default port of its web inter-

face).

Refer to chapter 3for more information.

Exporting and Importing Conﬁguration

WinRoute now includes also a special backup-and-recovery tool which allows to back up

and recover full conﬁguration including local user accounts and SSL certiﬁcates. These

functions allow easy and quick recovery of the ﬁrewall for cases of hardware failure,

transfer to another computer and cloning of an identical conﬁguration for multiple ﬁre-

walls. To export or import conﬁguration, go to the Web Administration interface.

More details can be found in chapter 25.1.

Kerio Web Filter, the new web page rating module

Kerio Web Filter is a special module, used for rating of web pages in accordance to their

content categories. In WinRoute, it replaces the ISS OrangeWeb Filter module. The way of

how ﬁltering rules are created is the same as before.

More details can be found in chapter 12.3.

Chapter 2 Introduction

Support for Windows 7

Kerio WinRoute Firewall now includes full support for the new operating system Microsoft

Windows 7.

2.2 Conﬂicting software

WinRoute can be run with most of common applications. However, there are certain applica-

tions that should not be run at the same host as WinRoute for this could result in collisions.

The computer where WinRoute is installed (the host) can be also used as a workstation. How-

ever, it is not recommended — user interaction may aﬀect performance of the operating sys-

tem which aﬀects WinRoute performance badly.

Collision of low-level drivers

WinRoute collides with system services and applications the low-level drivers of whose

use a similar or an identical technology. The security log contains the following types of

services and applications:

•The Internet Connection Firewall / Internet Connection Sharing system service.

WinRoute can detect and automatically disable this service.

•The system service Routing and Remote Access Service (RRAS) in Windows Server

operating systems. This service allows also sharing of Internet connection (NAT).

WinRoute can detect if NAT is active in the RRAS service; if it is, a warning is dis-

played. In reaction to the alert message, the server administrator should disable

NAT in the RRAS conﬁguration.

If NAT is not active, collisions should be avoided and WinRoute can be used hand

in hand with the RRAS service.

•Network ﬁrewalls — e.g. Microsoft ISA Server.

•Personal ﬁrewalls, such as Sunbelt Personal Firewall,Zone Alarm,Norton Personal

Firewall, etc.

•Software designed to create virtual private networks (VPN) — i.e. software appli-

cations developed by the following companies: CheckPoint,Cisco Systems,Nortel,

etc. There are many applications of this type and their features vary from vendor

to vendor.

Under proper circumstances, use of the VPN solution included in WinRoute is

recommended (for details see chapter 23). Otherwise, we recommend you to test

a particular VPN server or VPN client with WinRoute trial version or to contact

our technical support (see chapter 26).

Note: VPN implementation included in Windows operating system (based on the

PPTP protocol) is supported by WinRoute.

Port collision

Applications that use the same ports as the ﬁrewall cannot be run at the WinRoute host

(or the conﬁguration of the ports must be modiﬁed).

If all services are running, WinRoute uses the following ports:

Inhaltsverzeichnis

Andere Kerio Tech Software Handbücher

Kerio Tech

Kerio Tech Firewall6 Service-Handbuch

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Novell

Novell GROUPWISE 8 - INTERNET AGENT Bedienungsanleitung

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung