Manuals / Kerio Tech / Computer Equipment / Network Router

Kerio Tech Firewall6 manual Users can override WWW content rules, Users can connect using VPN, 207

Models: Firewall6

1 398

Download 398 pages 11.9 Kb

Page 207

Image 207

13.5 User groups

Figure 13.20 Creating a user group — members’ user rights

Additional rights:

Users can override WWW content rules

User belonging to the group can customize personal Web content ﬁltering settings independently of the global conﬁguration (for details see chapters 10.3 a 9.4).

User can unlock URL rules

This option allows its members one-shot bypassing of denial rules for blocked web- sites (if allowed by the corresponding URL rule — see chapter 10.2). All performed unlock actions are traced in the Security log.

Users can connect using VPN

Members of the group can connect to the local network via the Internet using the Kerio VPN Client (for details, see chapter 21).

User can use Clientless SSL-VPN

Members of this group will be allowed to access shared ﬁles and folders in the local network via the Clientless SSL-VPNweb interface. For details, see chapter 22.

207

Page 207

Image 207

Kerio Tech Firewall6 manual Users can override WWW content rules, Users can connect using VPN, 207

Contents

Kerio Technologies Administrator’s GuidePage Contents 113 Remote Administration and Update Checks 209 Kerio Clientless SSL-VPN 355 393 Quick Checklist Page Basic Features IntroductionKerio WinRoute Firewall Kerio WinRoute Firewall Additional FeaturesUser quotas Antivirus controlTransparent support for Active Directory Email alertsPort collision Conﬂicting softwareClientless SSL-VPN Collision of low-level driversAntivirus applications System requirements InstallationInstallation Steps to be taken before the installationInstallation and Basic Conﬁguration Guide Custom installation selecting optional components Protection of the installed product Conﬂicting Applications and System Services WinRoute Components WinRoute Firewall EngineWinRoute Engine Monitor Kerio Administration Console WinRoute Engine MonitorWinRoute Engine Monitor Upgrade and Uninstallation Upgrade and Uninstallation UninstallationTypically the path C\Program Files\Kerio\WinRoute Firewall Conﬁguration Wizard Upgrade from WinRoute ProUpdate Checker Setting of administration username and passwordRemote Access Enable remote accessRemote IP address Initial conﬁguration Allowing remote administration Administration Window WinRoute AdministrationHelp menu WinRoute AdministrationAdministration Window Main menu FileAdministration Window Status barDetection of WinRoute Firewall Engine connection drop-out Column customization in Interfaces View SettingsView Settings Product Registration and Licensing License types and number of usersLicense types optional components Deciding on a number of users licenses License types and number of usersHomepage License informationProduct CopyrightNumber of users License IDSubscription expiration date Product expiration dateRegistration of the trial version Registration of the product in the Administration ConsoleTrial version registration security code Registration of the product in the Administration ConsoleTrial version registration other information Trial version registration Trial ID Registration of the purchased productProduct Registration and Licensing Registration of the product in the Administration Console 10 Product registration user information 12 Product registration summary Update of registration informationProduct registration at the website Subscription / Update ExpirationBubble alerts Subscription / Update Expiration15 The notice that the subscription has already expired User counterUser counter Start WinRouteLicense counter License release IP Address and Mask Settings for Interfaces and Network ServicesNetwork interfaces InterfaceModify Dial or Hang Up /Enebale, DisableAdapter info AddVPN server RefreshSpecial interfaces Dial-InInterface type selection Bind this interfaceRAS Entry Use login data from the RAS entryUse the following login data Interface nameDial-up demand dial ConnectionAdvanced Hangup if idleEdit Interface parameters Connection FailoverCurrent connection Connection Failover SetupEnable automatic connection failover Connection FailoverConﬁguration of primary and secondary Internet connection Primary connection Secondary connectionDial-up Use DNS Forwarder conﬁguration DNS ForwarderEnable DNS forwarding DNS ForwarderDNS forwarding Use custom forwarding Enable cache for faster response of repeated queriesEnable DNS forwarding Clear cache10 Speciﬁc settings of DNS forwarding 11 DNS forwarding a new rule Simple DNS resolutionCombine the name ... with DNS domain Before forwarding a queryDhcp server Dhcp server Dhcp Server ConﬁgurationDeﬁnition of Scopes and Reservations Domain Lease timeDNS server Wins server15 Dhcp server IP scopes deﬁnition DescriptionFirst address, Last address Subnet maskExclusions Parameters 00bca5f21e50 Lease ReservationsLeases Bc-a5-f2-1e-5020 Dhcp server list of leased and reserved IP addresses Windows RAS Dhcp server advanced optionsDeclined options Proxy serverEnable non-transparent proxy server Proxy serverProxy Server Conﬁguration 22 Http proxy server settings Enable connection to any TCP portHttp//192.168.1.13128/pac/proxy.pac Forward to parent proxy serverHttp protocol TTL Enable cache on transparent proxyEnable cache on proxy server Http cacheCache size Http cacheMemory cache size Max Http object sizeCache Options URL URL Speciﬁc SettingsTTL Cache status and administration26 Http cache administration dialog Network Rules Wizard Traﬃc PolicyNetwork Rules Wizard InformationSelection of Internet connection type Network Policy Wizard selection of a connected adapter Network adapter or dial-up selectionAllow access to all services Internet access limitationsEnabling Kerio VPN traﬃc Allow access to the following services onlyService Service is running onGenerating the rules NATIcmp traﬃc Rules Created by the WizardLocal Traﬃc Firewall Traﬃc How traﬃc rules work Deﬁnition of Custom Traﬃc RulesName 12 Traﬃc rule name, color and rule description Source, DestinationIP range e.g Deﬁnition of Custom Traﬃc Rules 100 Service101 Action102 Log103 Translation20 Traﬃc rule destination address translation 104Valid on Protocol inspector105 Destination Basic Traﬃc Rule TypesIP Translation NAT Source107 TranslationPlacing the rule Port mapping108 Limiting Internet Access Multihoming109 110 111 Exclusions112 Speed limits for users with their quota exceeded How the bandwidth limiter works and how to use itSpeed limits for big data volumes transmissions Bandwidth Limiter114 Setting limit valuesBandwidth Limiter conﬁguration Bandwidth LimiterServices Advanced Options115 116 IP Addresses and Time Interval117 Bandwidth Limiter selection of network services118 Detection of connections with large data volume transferredDetection of connections with large data volume transferred Examples119 120 User Authentication Firewall User Authentication121 User Authentication User authentication advanced options122 Automatic authentication Ntlm Firewall User AuthenticationRedirection to the authentication Enable non-transparent proxy server authentication124 Automatically logout users when they are inactiveWeb Interface Parameters Conﬁguration Enable Kerio SSL-VPN serverEnable Web Interface Http Web InterfaceWinRoute server name Enable secured Web Interface HttpsAllow access only from these IP addresses Web Interface127 Conﬁguration of ports of the Web InterfaceSSL Certiﬁcate for the Web Interface Generate or Import Certiﬁcate128 SSL certiﬁcate of WinRoute’s Web interface 129130 Login/logoutWeb Interface Language Preferences Users loggedLogin/logout Drdolittle@usoffice.company.com131 User password authentication Log out132 Status information and user statistics Status information and user statistics133 134 User preferencesSave settings User preferences135 136 10 Editing user passwordHttp protocol FTP protocol137 Conditions for Http and FTP ﬁltering URL Rules138 139 URL Rules140 URL Rules DeﬁnitionIf user accessing the URL is URL matches criteria141 142 Allow access to the Web siteDenial options Valid at time intervalValid for IP address group Valid if Mime type is144 WWW content scanning optionsScan content for viruses according to scanning rules Deny Web pages containing145 Http Inspection Advanced Options146 Global rules for Web elementsAllow Html ActiveX objects Allow Script Html tagsAllow cross-domain referrer Content Rating System ISS OrangeWeb FilterAllow Html JavaScript pop-up windows Allow applet Html tags148 ISS OrangeWeb Filter conﬁgurationISS OrangeWeb Filter Deployment Enable ISS OrangeWeb FilterCategorize each page regardless of Http rules ServerISS OrangeWeb Filter rule 150151 Web content ﬁltering by word occurrence152 Deﬁnition of rules ﬁltering by word occurrence153 Word groups154 Deﬁnition of forbidden wordsKeyword WeightFTP Policy Group156 If user accessing the FTP server isFTP Rules Deﬁnition FTP server is15 FTP Rule basic parameters 158 Content159 Antivirus control Conditions and limitations of antivirus scan160 161 Conditions and limitations of antivirus scan162 How to choose and setup antivirusesAntivirus control Integrated McAfeeCurrent virus database is Check for update every ... hoursLast update check performed ... ago Update nowAntivirus settings External antivirus164 An example of a traﬃc rule for outgoing Smtp traﬃc check 165Http and FTP scanning 167 Http and FTP scanningHttp and FTP scanning rules Condition168 169 Mime type170 Email scanning171 Email scanning172 IP Address Groups Creating and Editing IP Address Groups173 Type Time IntervalsDeﬁnitions NameDaily Time range typesAbsolute Weekly176 Time Interval TypeFrom, To Valid at daysServices Services177 Protocol Protocol inspector178 Source Port and Destination Port Protocol Inspectors179 180 URL Groups181 URL Groups182 Deﬁnitions Group183 User Accounts and GroupsInternal user database Import of user accounts from Active DirectoryViewing and deﬁnitions of user accounts User Accounts and Groups184 Local user accounts 186 Local user accountsAccounts mapped from the Active Directory domain Edit UserFull Name Local user accountsCreating a local user account Basic informationDomain template AuthenticationAccount is disabled Email AddressNT domain / Kerberos Groups189 190 Access rightsUser can override WWW content rules No access to administrationRead only access to administration Full access to administrationData transmission quota Transfer quota192 Content rules Quota exceed action193 194 User’s IP addresses195 Editing User AccountActive Directory NT domain196 197 Automatic import of user accounts from Active Directory198 Manual import of user accounts199 Active Directory domains mappingActive Directory domains mapping Domain mapping requirements200 Domain AccessSingle domain mapping Active Directory mapping13 Active Directory domain mapping 201NT authentication support Multiple domains mapping202 16 Conversion of user accounts 203User groups User groups Deﬁnitions204 205 User groupsCreating a new local user group Name and description of the group206 Group access rightsRead only access Group membersUsers can override WWW content rules Users can connect using VPN207 Users are allowed to use P2P networks Users are allowed to view statistics208 209 Remote Administration and Update ChecksSetting Remote Administration How to allow remote administration from the InternetUpdate Checking Remote Administration and Update Checks210 Check now Update CheckingCheck for new versions Check also for beta versions212 213 Advanced security features15.1 P2P Eliminator P2P Eliminator Conﬁguration214 Advanced security features15.1 P2P Eliminator Parameters for detection of P2P networks215 216 Special Security Settings217 Special Security SettingsAnti-Spooﬁng Connections Count LimitIPSec preferences VPN using IPSec ProtocolEnable Enable pass-through only for hosts219 VPN using IPSec ProtocolWinRoute’s IPSec conﬁguration IPSec client in local networkTraﬃc rule for one IPSec client in the local network 220221 IPSec server in local networkRouting table Other settings223 Routing tableRoute Types Static routesMetric Deﬁnitions of Dynamic and Static RulesNetwork, Network Mask GatewayHow demand dial works Demand DialDemand Dial Removing routes from the Routing Table226 227 Technical Peculiarities and Limitations228 Setting Rules for Demand Dial229 Dial of local DNS namesConﬁguration of the UPnP support Enable UPnPPort mapping timeout Universal Plug-and-Play UPnPLog connections Relay Smtp serverRelay Smtp server Log packets232 Smtp requires authenticationSpecify sender email address in From header Test233 Status Information Active hosts and connected users234 User Login timeLogin duration HostnameActive Hosts dialog options Detailed information on a selected host and user 238 Traﬃc informationActivity Description Connections239 240 Source, Destination241 Histogram242 Show connections related to the selected process243 Show connections related to the selected processOptions of the Connections Dialog Kill connection244 245 Color SettingsFont Color Background ColorAlerts Settings Alerts246 Alerts Alert247 248 Alert Templates\Program Files\Kerio\WinRoute Firewall\templates by default Alerts overview in Administration Console249 13 Details of a selected event 250Basic statistics Interface statistics251 252 Reset interface statisticsBasic statistics Interface Statistics menu253 Interface statisticsRemove interface statistics Graphical view of interface load254 User Statistics data volumes and quotasUser Statistics data volumes and quotas User Statistics dialog options255 256 Reset user statisticsRemove user statistics View hostKerio StaR statistics and reporting Monitoring and storage of statistic data257 258 Settings for statistics and quotaKerio StaR statistics and reporting Requirements of the statistics259 Settings for statistics and quotaEnable/disable gathering of statistic data Advanced settings for statistics260 Statistics and quota restrictionsStatistics and quota accounting periods Accessing the statistics from the WinRoute hostRemote access to the statistics Connection to StaR and viewing statistics262 StaR page in the web interface263 Accounting periodCustom accounting period 264Overall View Overall View265 Top Requested Web Categories Top 5 users266 267 Used Protocol268 User statistics User statistics269 13 The Users by Traﬃc table Users by TraﬃcTop Visited Websites Top Visited Websites272 Top Requested Web Categories16 Top visited websites sorted by categories 273274 275 Log settingsLogs Filename.log276 File LoggingLog settings Syslog Logging277 Logs Context Menu Select font Logs Context MenuFind HighlightingLog highlighting Logs EncodingLog debug Clear logLog highlighting settings 282 Debug log advanced settingsAlert Log Alert Log20.4 Conﬁg Log Logs284 Connection Log Connection Log285 Debug Log Dial Log286 Page 288 15/Mar/2004 155912 Line Connection disconnectedError Log Error Log289 ’McAfee update’ rule name Filter Log290 Http log Http log291 292 1058444114.733 0 192.168.64.64 TCPMISS/304Security Log Security Log293 294 Authentication service Client IP address reason17/Dec/2004 122243 Engine Shutdown Sslvpn LogSslvpn Log 17/Dec/2004 121133 Engine Startup24/Apr/2003 102951 192.168.44.128 james Web LogWeb Log 297 298 Kerio VPN299 VPN Server ConﬁgurationIP address assignment Enable VPN serverKerio VPN General301 SSL certiﬁcateAdvanced Listen on port302 303 Custom Routes21.2 Conﬁguration of VPN clients Basic conﬁguration of traﬃc rules for VPN clients304 305 Setting up VPN serversDeﬁnition of a tunnel to a remote server Name of the tunnel306 Conﬁguration307 Conﬁguration of a remote end of the tunnelDNS Settings Routing settings308 309 Connection establishment310 Traﬃc Policy Settings for VPN311 Exchange of routing informationExchange of routing information Routing conﬁguration optionsUpdate of routing tables Routes provided automatically312 Example of Kerio VPN conﬁguration company with a ﬁlial oﬃce Speciﬁcation313 314 Common method315 316 Headquarters conﬁguration317 14 Headquarter creating default traﬃc rules for Kerio VPN16 Headquarter DNS forwarder conﬁguration 318319 19 Headquarters VPN server conﬁguration 320321 LAN322 Conﬁguration of a ﬁlial oﬃce323 24 Filial oﬃce default traﬃc rules for Kerio VPN25 Filial oﬃce DNS forwarder conﬁguration 324325 28 Filial oﬃce VPN server conﬁguration 32629 Filial oﬃce deﬁnition of VPN tunnel for the headquarters 327Example of a more complex Kerio VPN conﬁguration VPN test328 329 Common method330 331 332 33 Headquarter creating default traﬃc rules for Kerio VPN35 Headquarter DNS forwarder conﬁguration 333Kerio VPN 38 Headquarters VPN server conﬁguration 33539 Headquarter deﬁnition of VPN tunnel for the London ﬁlial 336337 338 43 Headquarter ﬁnal traﬃc rules 339340 Conﬁguration of the London ﬁlial341 46 The London ﬁlial oﬃce default traﬃc rules for Kerio VPN342 48 The London ﬁlial oﬃce DNS forwarding settings343 344 345 54 The London ﬁlial oﬃce ﬁnal traﬃc rules 346347 Conﬁguration of the Paris ﬁlial57 The Paris ﬁlial oﬃce DNS forwarder conﬁguration 34859 The Paris ﬁlial oﬃce VPN server conﬁguration 349350 351 352 64 The Paris ﬁlial oﬃce ﬁnal traﬃc rules 353354 355 Kerio Clientless SSL-VPN22.1 Conﬁguration of WinRoute’s SSL-VPN SSL-VPN conﬁgurationAllowing access from the Internet Kerio Clientless SSL-VPN356 Https//server12345 Usage of the SSL-VPN interfaceUsage of the SSL-VPN interface Https//serverSidneywashington@usoffice.company.com Handling ﬁles and folders358 359 \\server\folder\subfolderAntivirus control BookmarksTroubleshooting Detection of incorrect conﬁguration of the default gateway360 23.2 Conﬁguration Backup and Transfer Dnscache.cfg SslcertLicense Cache.CFSHandling conﬁguration ﬁles Conﬁguration backup recovery Star363 List name=Interfaces Automatic user authentication using Ntlm General conditions365 366 WinRoute ConﬁgurationMicrosoft Internet Explorer Automatic user authentication using NtlmNtlm authentication process Web browsersFirefox/Netscape/Mozilla/SeaMonkey Firefox/Netscape/Mozilla/SeaMonkey conﬁguration368 Partial Retirement of Protocol Inspector Partial Retirement of Protocol Inspector369 How to enable certain users to access the Internet User accounts and groups in traﬃc rules370 371 Enabling automatic authenticationFTP on WinRoute’s proxy server Example of a client conﬁguration web browser372 Example of a client conﬁguration Total Commander FTP on WinRoute’s proxy server373 374 12 Setting proxy server for FTP in Total Commander375 Network Load BalancingBasic Information and System Requirements Network Conﬁguration376 Network Load Balancing24.3 Conﬁguration of the servers in the cluster NLB conﬁguration for Server1377 Server 1 cluster parameters 378379 NLB conﬁguration for Server2380 Technical supportEssential Information DescriptionLicense type and license number Error Log FilesTested in Beta version Informational FileContacts United KingdomCzech Republic Legal Presumption 384 Used open-source librariesLibiconv OpenSSL385 PrototypeCopyright 2005 Sam Stephenson ZlibCluster Default gatewayGlossary of terms ActiveXFirewall Greylisting387 388 Glossary of terms IP addressIPSec KerberosPort Network adapterP2P network PacketScript Glossary of termsProxy server Routing table391 Spooﬁng392 TCP/IP393 Index394 Index395 Ntlm396 VPN397 133