Kerio Tech Firewall6 - Manual (Page 326)

Chapter 23 Kerio VPN
326
local hosts into the hosts file (if they use IP addresses) or enable cooperation of the DNS
Forwarder with the DHCP server (in case that IP addresses are assigned dynamically to
these hosts). For details, see chapter 8.1 .
4. In the Interfaces section, allow the VPN server and set its SSL certificate if necessary. Note
the fingerprint of the server’s certificate for later use (it will be required for configuration
of the remote endpoint of the VPN tunnel).
Check whether the automatically selected VPN subnet does not collide with any local sub-
net either in the headquarters or in the filial and select another free subnet if necessary.
5. Define the VPN tunnel to the remote network. The passive endpoint of the tunnel must
be created at a server with fixed public IP address (i.e. at the headquarter’s server). Only
active endpoints of VPN tunnels can be created at servers with dynamic IP address.
If the remote endpoint of the tunnel has already been defined, check whether the tunnel
was created. If not, refer to the Error log, check fingerprints of the certificates and also
availability of the remote server.
6. In traffic rules, allow traffic between the local network, remote network and VPN clients
and set desirable access restrictions. In this network configuration, all desirable restric-
tions can be set at the headquarter’s server. Therefore, only traffic between the local
network and the VPN tunnel will be enabled at the filial’s server.
7. Test reachability of remote hosts from each local network. To perform the test, use the
ping and tracert system commands. Test availability of remote hosts both through IP
addresses and DNS names.
If a remote host is tested through IP address and it does not respond, check configuration
of the traffic rules or/and find out whether the subnets do not collide (i.e. whether the
same subnet is not used at both ends of the tunnel).
If an IP address is tested successfully and an error is reported (Unknown host) when a cor-
responding DNS name is tested, then check configuration of the DNS.
The following sections provide detailed description of the Kerio VPN configuration both for
the headquarter and the filial offices.
Headquarters configuration
1. Install WinRoute (version 6.0.0 or later) at the headquarter’s default gateway (“server”).
2. Use Network Rules Wizard (see chapter 7.1 ) to configure the basic traffic policy in WinRoute.
To keep the example as simple as possible, it is supposed that the access from the local
network to the Internet is not restricted, i.e. that access to all services is allowed in step 4.