23.5 Example of Kerio VPN configuration: company with a filial office
325
Suppose that both networks are already deployed and set according to the figure and that the
Internet connection is available.
Traffic between the network of the headquarters, the network of the branch office and VPN
clients will be restricted according to the following rules:
1.
VPN clients can connect to the
LAN 1
and to the network of the branch office.
2.
Connection to VPN clients is disabled for all networks.
3.
Only the
LAN 1
network is available from the branch office. In addition to this, only the
WWW
,
FTP
and
Microsoft SQL
services are available.
4.
No restrictions are applied for connections from the headquarters to the branch office
network.
5.
LAN 2
is not available to the branch office network nor to VPN clients.
Common method
The following actions must be taken in both local networks (i.e. in the main office and the
filial):
1.
It is necessary that
WinRoute
in version
6.0.0
or higher (older versions do not include
Kerio VPN
) is installed at the default gateway.
Note:
For
every
installation of
WinRoute
, a stand-alone license for the corresponding num-
ber of users is required! For details see chapter
2.
Configure and test connection of the local network to the Internet. Hosts in the local net-
work must use the
WinRoute
host’s IP address as the default gateway and as the primary
DNS server.
If it is a new (clean)
WinRoute
installation, it is possible to use the traffic rule wizard (refer
to chapter
).
For detailed description of basic configuration of
WinRoute
and of the local network, refer
to the
Kerio WinRoute Firewall — Step By Step
document.
3.
In configuration of
DNS Forwarder
, set DNS forwarding rules for the domain in the remote
network. This enables to access hosts in the remote network by using their DNS names
(otherwise, it is necessary to specify remote hosts by IP addresses).
To provide correct forwarding of DNS requests from a
WinRoute
host, it is necessary to
use an IP address of a network device belonging to the host as the primary DNS server. As
a secondary DNS server, a server where DNS requests addressed to other domains will be
forwarded must be specified (typically the ISP’s DNS server).
Note:
For proper functionality of DNS, the DNS database must include records for hosts
in a corresponding local network. To achieve this, save DNS names and IP addresses of
Summary of Contents for Firewall6
Page 1: ...Kerio WinRoute Firewall 6 Administrator s Guide Kerio Technologies...
Page 129: ...8 5 HTTP cache 129...
Page 404: ...404...
