Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual download pdf (Page 292)

Chapter 23 Kerio VPN

292

Name of the tunnel

Each VPN tunnel must have a unique name. This name will be used in the table of inter-

faces, in traﬃc rules (see chapter 7.3) and interface statistics (details in chapter 20.2).

Conﬁguration

Selection of a mode for the local end of the tunnel:

• Active — this side of the tunnel will automatically attempt to establish and main-

tain a connection to the remote VPN server.

The remote VPN server speciﬁcation is required through the Remote hostname

or IP address entry. If the remote VPN server does not use the port 4090,

a corresponding port number separated by a colon must be speciﬁed (e.g.

server.company.com:4100 or 10.10.100.20:9000).

This mode is available if the IP address or DNS name of the other side of the

tunnel is known and the remote endpoint is allowed to accept incoming connec-

tions (i.e. the communication is not blocked by a ﬁrewall at the remote end of the

tunnel).

• Passive — this end of the tunnel will only listen for an incoming connection from

the remote (active) side.

The passive mode is only useful when the local end of the tunnel has a ﬁxed IP

address and when it is allowed to accept incoming connections.

At least one end of each VPN tunnel must be switched to the active mode (passive servers

cannot initialize connection).

Conﬁguration of a remote end of the tunnel

When a VPN tunnel is being created, identity of the remote endpoint is authenticated

through the ﬁngerprint of its SSL certiﬁcate. If the ﬁngerprint does not match with the

ﬁngerprint speciﬁed in the conﬁguration of the tunnel, the connection will be rejected.

The ﬁngerprint of the local certiﬁcate and the entry for speciﬁcation of the remote ﬁn-

gerprint are provided in the Settings for remote endpoint section. Specify the ﬁngerprint

for the remote VPN server certiﬁcate and vice versa — specify the ﬁngerprint of the local

server in the conﬁguration at the remote server.

If the local endpoint is set to the active mode, the certiﬁcate of the remote endpoint and

its ﬁngerprint can be downloaded by clicking Detect remote certiﬁcate. Passive endpoint

cannot detect remote certiﬁcate.

However, this method of ﬁngerprint setting is quite insecure —a counterfeit certiﬁcate

might be used. If a ﬁngerprint of a false certiﬁcate is used for the conﬁguration of

the VPN tunnel, it is possible to create a tunnel for the false endpoint (for the attacker).

Moreover, a valid certiﬁcate would not be accepted from the other side. Therefore, for

security reasons, it is recommended to set ﬁngerprints manually.

1 2 ... 287 288 289 290 291 292 293 294 295 296 297 ... 367 368

No comments

Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual Page 292