Http log, 291 | Kerio Tech Firewall6 instruction

20.10 Http log

Example of a traﬃc rule log message:

[16/Apr/2003 10:51:00] PERMIT ’Local traffic’ packet to LAN, proto:TCP, len:47, ip/port:195.39.55.4:41272 -> 192.168.1.11:3663, flags: ACK PSH , seq:1099972190 ack:3795090926, win:64036, tcplen:7

•[16/Apr/2003 10:51:00] — date and time when the event was logged

•PERMIT — action that was executed with the packet (PERMIT, DENY or DROP)

•Local traffic —the name of the traﬃc rule that was applied

•packet to — packet direction (either to or from a particular interface)

•LAN — interface name (see chapter 5.1 for details)

•proto: — transport protocol (TCP, UDP, etc.)

•len: — packet size in bytes (including the headers) in bytes

•ip/port: — source IP address, source port, destination IP address and destination port

•flags: — TCP ﬂags

•seq: — sequence number of the packet (TCP only)

•ack: — acknowledgement sequence number (TCP only)

•win: — size of the receive window in bytes (it is used for data ﬂow control — TCP only)

•tcplen: — TCP payload size (i.e. size of the data part of the packet) in bytes (TCP only)

20.10 Http log

This log contains all HTTP requests that were processed by the HTTP inspection mod- ule (see section 12.3) or by the built-in proxy server (see section 5.5). The log has the standard format of either the Apache WWW server (see http://www.apache.org/) or of the Squid proxy server (see http://www.squid-cache.org/). The enable or disable the Http log, or to choose its format, go toConﬁguration → Content Filtering → HTTP Policy (refer to section 10.2 for details).

291

Image 291

Kerio Tech Firewall6 manual Http log, 291

Contents

Kerio Technologies Administrator’s GuidePage Contents 113 Remote Administration and Update Checks 209 Kerio Clientless SSL-VPN 355 393 Quick Checklist Page Basic Features IntroductionKerio WinRoute Firewall Kerio WinRoute Firewall Additional Features User quotas Antivirus controlTransparent support for Active Directory Email alerts Port collision Conﬂicting softwareClientless SSL-VPN Collision of low-level drivers Antivirus applications System requirements InstallationInstallation Steps to be taken before the installation Installation and Basic Conﬁguration Guide Custom installation selecting optional components Protection of the installed product Conﬂicting Applications and System Services WinRoute Components WinRoute Firewall EngineWinRoute Engine Monitor Kerio Administration Console WinRoute Engine MonitorWinRoute Engine Monitor Upgrade and Uninstallation Upgrade and Uninstallation UninstallationTypically the path C\Program Files\Kerio\WinRoute Firewall Conﬁguration Wizard Upgrade from WinRoute ProUpdate Checker Setting of administration username and password Remote Access Enable remote accessRemote IP address Initial conﬁguration Allowing remote administration Administration Window WinRoute Administration Help menu WinRoute AdministrationAdministration Window Main menu File Administration Window Status barDetection of WinRoute Firewall Engine connection drop-out Column customization in Interfaces View Settings View Settings Product Registration and Licensing License types and number of usersLicense types optional components Deciding on a number of users licenses License types and number of users Homepage License informationProduct Copyright Number of users License IDSubscription expiration date Product expiration date Registration of the trial version Registration of the product in the Administration Console Trial version registration security code Registration of the product in the Administration Console Trial version registration other information Trial version registration Trial ID Registration of the purchased product Product Registration and Licensing Registration of the product in the Administration Console 10 Product registration user information 12 Product registration summary Update of registration information Product registration at the website Subscription / Update Expiration Bubble alerts Subscription / Update Expiration 15 The notice that the subscription has already expired User counter User counter Start WinRouteLicense counter License release IP Address and Mask Settings for Interfaces and Network ServicesNetwork interfaces Interface Modify Dial or Hang Up /Enebale, DisableAdapter info Add VPN server RefreshSpecial interfaces Dial-In Interface type selection Bind this interface RAS Entry Use login data from the RAS entryUse the following login data Interface name Dial-up demand dial Connection Advanced Hangup if idle Edit Interface parameters Connection Failover Current connection Connection Failover SetupEnable automatic connection failover Connection Failover Conﬁguration of primary and secondary Internet connection Primary connection Secondary connectionDial-up Use DNS Forwarder conﬁguration DNS Forwarder Enable DNS forwarding DNS ForwarderDNS forwarding Use custom forwarding Enable cache for faster response of repeated queriesEnable DNS forwarding Clear cache 10 Speciﬁc settings of DNS forwarding 11 DNS forwarding a new rule Simple DNS resolution Combine the name ... with DNS domain Before forwarding a query Dhcp server Dhcp server Dhcp Server ConﬁgurationDeﬁnition of Scopes and Reservations Domain Lease timeDNS server Wins server 15 Dhcp server IP scopes deﬁnition Description First address, Last address Subnet maskExclusions Parameters 00bca5f21e50 Lease Reservations Leases Bc-a5-f2-1e-50 20 Dhcp server list of leased and reserved IP addresses Windows RAS Dhcp server advanced options Declined options Proxy server Enable non-transparent proxy server Proxy serverProxy Server Conﬁguration 22 Http proxy server settings Enable connection to any TCP port Http//192.168.1.13128/pac/proxy.pac Forward to parent proxy server Http protocol TTL Enable cache on transparent proxyEnable cache on proxy server Http cache Cache size Http cache Memory cache size Max Http object sizeCache Options URL URL Speciﬁc Settings TTL Cache status and administration 26 Http cache administration dialog Network Rules Wizard Traﬃc Policy Network Rules Wizard InformationSelection of Internet connection type Network Policy Wizard selection of a connected adapter Network adapter or dial-up selection Allow access to all services Internet access limitations Enabling Kerio VPN traﬃc Allow access to the following services only Service Service is running on Generating the rules NAT Icmp traﬃc Rules Created by the Wizard Local Traﬃc Firewall Traﬃc How traﬃc rules work Deﬁnition of Custom Traﬃc RulesName 12 Traﬃc rule name, color and rule description Source, Destination IP range e.g Deﬁnition of Custom Traﬃc Rules 100 Service 101 Action 102 Log 103 Translation 20 Traﬃc rule destination address translation 104 Valid on Protocol inspector105 Destination Basic Traﬃc Rule TypesIP Translation NAT Source 107 TranslationPlacing the rule Port mapping 108 Limiting Internet Access Multihoming109 110 111 Exclusions 112 Speed limits for users with their quota exceeded How the bandwidth limiter works and how to use itSpeed limits for big data volumes transmissions Bandwidth Limiter 114 Setting limit valuesBandwidth Limiter conﬁguration Bandwidth Limiter Services Advanced Options115 116 IP Addresses and Time Interval 117 Bandwidth Limiter selection of network services 118 Detection of connections with large data volume transferred Detection of connections with large data volume transferred Examples119 120 User Authentication Firewall User Authentication121 User Authentication User authentication advanced options122 Automatic authentication Ntlm Firewall User AuthenticationRedirection to the authentication Enable non-transparent proxy server authentication 124 Automatically logout users when they are inactive Web Interface Parameters Conﬁguration Enable Kerio SSL-VPN serverEnable Web Interface Http Web Interface WinRoute server name Enable secured Web Interface HttpsAllow access only from these IP addresses Web Interface 127 Conﬁguration of ports of the Web Interface SSL Certiﬁcate for the Web Interface Generate or Import Certiﬁcate128 SSL certiﬁcate of WinRoute’s Web interface 129 130 Login/logoutWeb Interface Language Preferences Users logged Login/logout Drdolittle@usoffice.company.com131 User password authentication Log out132 Status information and user statistics Status information and user statistics133 134 User preferences Save settings User preferences135 136 10 Editing user password Http protocol FTP protocol137 Conditions for Http and FTP ﬁltering URL Rules138 139 URL Rules 140 URL Rules Deﬁnition If user accessing the URL is URL matches criteria141 142 Allow access to the Web site Denial options Valid at time intervalValid for IP address group Valid if Mime type is 144 WWW content scanning optionsScan content for viruses according to scanning rules Deny Web pages containing 145 Http Inspection Advanced Options 146 Global rules for Web elementsAllow Html ActiveX objects Allow Script Html tags Allow cross-domain referrer Content Rating System ISS OrangeWeb FilterAllow Html JavaScript pop-up windows Allow applet Html tags 148 ISS OrangeWeb Filter conﬁguration ISS OrangeWeb Filter Deployment Enable ISS OrangeWeb FilterCategorize each page regardless of Http rules Server ISS OrangeWeb Filter rule 150 151 Web content ﬁltering by word occurrence 152 Deﬁnition of rules ﬁltering by word occurrence 153 Word groups 154 Deﬁnition of forbidden words Keyword WeightFTP Policy Group 156 If user accessing the FTP server isFTP Rules Deﬁnition FTP server is 15 FTP Rule basic parameters 158 Content 159 Antivirus control Conditions and limitations of antivirus scan160 161 Conditions and limitations of antivirus scan 162 How to choose and setup antivirusesAntivirus control Integrated McAfee Current virus database is Check for update every ... hoursLast update check performed ... ago Update now Antivirus settings External antivirus164 An example of a traﬃc rule for outgoing Smtp traﬃc check 165 Http and FTP scanning 167 Http and FTP scanning Http and FTP scanning rules Condition168 169 Mime type 170 Email scanning 171 Email scanning 172 IP Address Groups Creating and Editing IP Address Groups173 Type Time IntervalsDeﬁnitions Name Daily Time range typesAbsolute Weekly 176 Time Interval TypeFrom, To Valid at days Services Services177 Protocol Protocol inspector178 Source Port and Destination Port Protocol Inspectors179 180 URL Groups 181 URL Groups 182 Deﬁnitions Group 183 User Accounts and GroupsInternal user database Import of user accounts from Active Directory Viewing and deﬁnitions of user accounts User Accounts and Groups184 Local user accounts 186 Local user accountsAccounts mapped from the Active Directory domain Edit User Full Name Local user accountsCreating a local user account Basic information Domain template AuthenticationAccount is disabled Email Address NT domain / Kerberos Groups189 190 Access rights User can override WWW content rules No access to administrationRead only access to administration Full access to administration Data transmission quota Transfer quota192 Content rules Quota exceed action193 194 User’s IP addresses 195 Editing User Account Active Directory NT domain196 197 Automatic import of user accounts from Active Directory 198 Manual import of user accounts 199 Active Directory domains mappingActive Directory domains mapping Domain mapping requirements 200 Domain AccessSingle domain mapping Active Directory mapping 13 Active Directory domain mapping 201 NT authentication support Multiple domains mapping202 16 Conversion of user accounts 203 User groups User groups Deﬁnitions204 205 User groupsCreating a new local user group Name and description of the group 206 Group access rightsRead only access Group members Users can override WWW content rules Users can connect using VPN207 Users are allowed to use P2P networks Users are allowed to view statistics208 209 Remote Administration and Update ChecksSetting Remote Administration How to allow remote administration from the Internet Update Checking Remote Administration and Update Checks210 Check now Update CheckingCheck for new versions Check also for beta versions 212 213 Advanced security features15.1 P2P Eliminator P2P Eliminator Conﬁguration 214 Advanced security features 15.1 P2P Eliminator Parameters for detection of P2P networks215 216 Special Security Settings 217 Special Security SettingsAnti-Spooﬁng Connections Count Limit IPSec preferences VPN using IPSec ProtocolEnable Enable pass-through only for hosts 219 VPN using IPSec ProtocolWinRoute’s IPSec conﬁguration IPSec client in local network Traﬃc rule for one IPSec client in the local network 220 221 IPSec server in local network Routing table Other settings 223 Routing tableRoute Types Static routes Metric Deﬁnitions of Dynamic and Static RulesNetwork, Network Mask Gateway How demand dial works Demand DialDemand Dial Removing routes from the Routing Table 226 227 Technical Peculiarities and Limitations 228 Setting Rules for Demand Dial 229 Dial of local DNS names Conﬁguration of the UPnP support Enable UPnPPort mapping timeout Universal Plug-and-Play UPnP Log connections Relay Smtp serverRelay Smtp server Log packets 232 Smtp requires authenticationSpecify sender email address in From header Test 233 Status Information Active hosts and connected users234 User Login timeLogin duration Hostname Active Hosts dialog options Detailed information on a selected host and user 238 Traﬃc information Activity Description Connections239 240 Source, Destination 241 Histogram 242 Show connections related to the selected process 243 Show connections related to the selected process Options of the Connections Dialog Kill connection244 245 Color SettingsFont Color Background Color Alerts Settings Alerts246 Alerts Alert247 248 Alert Templates \Program Files\Kerio\WinRoute Firewall\templates by default Alerts overview in Administration Console249 13 Details of a selected event 250 Basic statistics Interface statistics251 252 Reset interface statisticsBasic statistics Interface Statistics menu 253 Interface statisticsRemove interface statistics Graphical view of interface load 254 User Statistics data volumes and quotas User Statistics data volumes and quotas User Statistics dialog options255 256 Reset user statisticsRemove user statistics View host Kerio StaR statistics and reporting Monitoring and storage of statistic data257 258 Settings for statistics and quotaKerio StaR statistics and reporting Requirements of the statistics 259 Settings for statistics and quotaEnable/disable gathering of statistic data Advanced settings for statistics 260 Statistics and quota restrictions Statistics and quota accounting periods Accessing the statistics from the WinRoute hostRemote access to the statistics Connection to StaR and viewing statistics 262 StaR page in the web interface 263 Accounting period Custom accounting period 264 Overall View Overall View265 Top Requested Web Categories Top 5 users266 267 Used Protocol 268 User statistics User statistics269 13 The Users by Traﬃc table Users by Traﬃc Top Visited Websites Top Visited Websites 272 Top Requested Web Categories 16 Top visited websites sorted by categories 273 274 275 Log settingsLogs Filename.log 276 File Logging Log settings Syslog Logging277 Logs Context Menu Select font Logs Context MenuFind Highlighting Log highlighting Logs EncodingLog debug Clear log Log highlighting settings 282 Debug log advanced settings Alert Log Alert Log 20.4 Conﬁg Log Logs284 Connection Log Connection Log285 Debug Log Dial Log286 Page 288 15/Mar/2004 155912 Line Connection disconnected Error Log Error Log289 ’McAfee update’ rule name Filter Log290 Http log Http log291 292 1058444114.733 0 192.168.64.64 TCPMISS/304 Security Log Security Log293 294 Authentication service Client IP address reason 17/Dec/2004 122243 Engine Shutdown Sslvpn LogSslvpn Log 17/Dec/2004 121133 Engine Startup 24/Apr/2003 102951 192.168.44.128 james Web Log Web Log 297 298 Kerio VPN 299 VPN Server Conﬁguration IP address assignment Enable VPN serverKerio VPN General 301 SSL certiﬁcate Advanced Listen on port302 303 Custom Routes 21.2 Conﬁguration of VPN clients Basic conﬁguration of traﬃc rules for VPN clients304 305 Setting up VPN serversDeﬁnition of a tunnel to a remote server Name of the tunnel 306 Conﬁguration 307 Conﬁguration of a remote end of the tunnel DNS Settings Routing settings308 309 Connection establishment 310 Traﬃc Policy Settings for VPN 311 Exchange of routing informationExchange of routing information Routing conﬁguration options Update of routing tables Routes provided automatically312 Example of Kerio VPN conﬁguration company with a ﬁlial oﬃce Speciﬁcation313 314 Common method 315 316 Headquarters conﬁguration 317 14 Headquarter creating default traﬃc rules for Kerio VPN 16 Headquarter DNS forwarder conﬁguration 318 319 19 Headquarters VPN server conﬁguration 320 321 LAN 322 Conﬁguration of a ﬁlial oﬃce 323 24 Filial oﬃce default traﬃc rules for Kerio VPN 25 Filial oﬃce DNS forwarder conﬁguration 324 325 28 Filial oﬃce VPN server conﬁguration 326 29 Filial oﬃce deﬁnition of VPN tunnel for the headquarters 327 Example of a more complex Kerio VPN conﬁguration VPN test328 329 Common method 330 331 332 33 Headquarter creating default traﬃc rules for Kerio VPN 35 Headquarter DNS forwarder conﬁguration 333 Kerio VPN 38 Headquarters VPN server conﬁguration 335 39 Headquarter deﬁnition of VPN tunnel for the London ﬁlial 336 337 338 43 Headquarter ﬁnal traﬃc rules 339 340 Conﬁguration of the London ﬁlial 341 46 The London ﬁlial oﬃce default traﬃc rules for Kerio VPN 342 48 The London ﬁlial oﬃce DNS forwarding settings 343 344 345 54 The London ﬁlial oﬃce ﬁnal traﬃc rules 346 347 Conﬁguration of the Paris ﬁlial 57 The Paris ﬁlial oﬃce DNS forwarder conﬁguration 348 59 The Paris ﬁlial oﬃce VPN server conﬁguration 349 350 351 352 64 The Paris ﬁlial oﬃce ﬁnal traﬃc rules 353 354 355 Kerio Clientless SSL-VPN22.1 Conﬁguration of WinRoute’s SSL-VPN SSL-VPN conﬁguration Allowing access from the Internet Kerio Clientless SSL-VPN356 Https//server12345 Usage of the SSL-VPN interfaceUsage of the SSL-VPN interface Https//server Sidneywashington@usoffice.company.com Handling ﬁles and folders358 359 \\server\folder\subfolderAntivirus control Bookmarks Troubleshooting Detection of incorrect conﬁguration of the default gateway360 23.2 Conﬁguration Backup and Transfer Dnscache.cfg SslcertLicense Cache.CFS Handling conﬁguration ﬁles Conﬁguration backup recovery Star363 List name=Interfaces Automatic user authentication using Ntlm General conditions365 366 WinRoute Conﬁguration Microsoft Internet Explorer Automatic user authentication using NtlmNtlm authentication process Web browsers Firefox/Netscape/Mozilla/SeaMonkey Firefox/Netscape/Mozilla/SeaMonkey conﬁguration368 Partial Retirement of Protocol Inspector Partial Retirement of Protocol Inspector369 How to enable certain users to access the Internet User accounts and groups in traﬃc rules370 371 Enabling automatic authentication FTP on WinRoute’s proxy server Example of a client conﬁguration web browser372 Example of a client conﬁguration Total Commander FTP on WinRoute’s proxy server373 374 12 Setting proxy server for FTP in Total Commander 375 Network Load BalancingBasic Information and System Requirements Network Conﬁguration 376 Network Load Balancing 24.3 Conﬁguration of the servers in the cluster NLB conﬁguration for Server1377 Server 1 cluster parameters 378 379 NLB conﬁguration for Server2 380 Technical supportEssential Information Description License type and license number Error Log FilesTested in Beta version Informational File Contacts United KingdomCzech Republic Legal Presumption 384 Used open-source librariesLibiconv OpenSSL 385 PrototypeCopyright 2005 Sam Stephenson Zlib Cluster Default gatewayGlossary of terms ActiveX Firewall Greylisting387 388 Glossary of terms IP addressIPSec Kerberos Port Network adapterP2P network Packet Script Glossary of termsProxy server Routing table 391 Spooﬁng 392 TCP/IP 393 Index 394 Index 395 Ntlm 396 VPN 397 133