Kerio Tech Firewall6 Example of Kerio VPN configuration company with a filial office, Specification

21.5Example of Kerio VPN configuration: company with a filial office

21.5Example of Kerio VPN configuration: company with a filial office

This chapter provides a detailed exemplary description on how to create an encrypted tunnel connecting two private networks using the Kerio VPN .

This example can be easily customized. The method described can be used in cases where no redundant routes arise by creating VPN tunnels (i.e. multiple routes between individual private networks). Configuration of VPN with redundant routes (typically in case of a company with two or more filials) is described in chapter 21.6.

Note: This example describes a more complicated pattern of VPN with access restrictions for individual local networks and VPN clients. An example of basic VPN configuration is provided in the Kerio WinRoute Firewall — Step By Step Configuration document.

Specification

Supposing a company has its headquarters in New York and a branch office in London. We intend to interconnect local networks of the headquarters by a VPN tunnel using the Kerio VPN . VPN clients will be allowed to connect to the headquarters network.

The server (default gateway) of the headquarters uses the public IP address 63.55.21.12 (DNS name is newyork.company.com), the server of the branch office uses a dynamic IP address assigned by DHCP.

The local network of the headquarters consists of two subnets, LAN 1 and LAN 2. The headquarters uses the company.com DNS domain.

The network of the branch office consists of one subnet only (LAN). The branch office filial.company.com.

Figure 21.12 provides a scheme of the entire system, including IP addresses and the VPN tunnels that will be built.

Suppose that both networks are already deployed and set according to the figure and that the Internet connection is available.

Traffic between the network of the headquarters, the network of the branch office and VPN clients will be restricted according to the following rules:

1.VPN clients can connect to the LAN 1 and to the network of the branch office.

2.Connection to VPN clients is disabled for all networks.

3.Only the LAN 1 network is available from the branch office. In addition to this, only the WWW , FTP and Microsoft SQL services are available.

313