Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual download pdf (Page 215)

16.2 Setting Remote Administration

215

ﬁrewall’s system time. The time zone also includes information about daylight saving

time settings.

Kerio Technologies oﬀers the following free NTP servers for this purpose:

0.kerio.pool.ntp.org, 1.kerio.pool.ntp.org, 2.kerio.pool.ntp.org and

3.kerio.pool.ntp.org.

16.2 Setting Remote Administration

Remote administration is connection to the ﬁrewall, its monitoring and conﬁguration changes

with the Administration Console or with the Web Administration interface from another host

that the one on which WinRoute is installed.

If WinRoute includes only traﬃc rules created automatically by the wizard (see chapter 7.1),

access to the remote administration is allowed via all trustworthy network interfaces (see

chapter 5). This means that remote administration is available from all local hosts.

To allow or deny remote administration via the Internet (non-trusted networks), deﬁne a cor-

responding traﬃc rule. Traﬃc between WinRoute and Administration Console is performed

by TCP and UDP protocols over port 44333. The deﬁnition can be done with the predeﬁned

service KWF Admin. the secured version of the Web Administration interface use TCP protocol,

on port 4081 by default — predeﬁned KWF WebAdmin-SSL service.

How to allow remote administration from the Internet

In the following example we will demonstrate how to allow WinRoute remote administration

from some Internet IP addresses.

• Source — group of IP addresses from which remote administration will be allowed (see

chapter 14.1).

For security reasons it is not recommended to allow remote administration from an

arbitrary host within the Internet (this means: do not set Source as Any or as Internet)!

• Destination — Firewall (host where WinRoute is installed).

• Service — KWF Admin (connection with the Administration Console) and KWF

WebAdmin-SSL (secured version of the Web Administration interface).

It is not recommended to allow access via the unsecured version of the Web Adminis-

tration interface (theKWF WebAdmin service)! Unsecured traﬃc might be tapped and

misused for assaulting the ﬁrewall and local hosts behind it.

• Action — Permit (otherwise remote administration would be blocked)

• Translation — Because the engine is running on the ﬁrewall there is no need for trans-

lation.

Figure 16.2 Traﬃc rule that allows remote administration

1 2 ... 210 211 212 213 214 215 216 217 218 219 220 ... 367 368

No comments

Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual Page 215