Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual download pdf (Page 312)

Chapter 23 Kerio VPN

312

To provide correct forwarding of DNS requests from a WinRoute host, it is necessary to

use an IP address of a network device belonging to the host as the primary DNS server. As

a secondary DNS server, a server where DNS requests addressed to other domains will be

forwarded must be speciﬁed (typically the ISP’s DNS server).

Note: For proper functionality of DNS, the DNS database must include records for hosts

in a corresponding local network. To achieve this, save DNS names and IP addresses of

local hosts into the hosts ﬁle (if they use IP addresses) or enable cooperation of the DNS

module with the DHCP server (in case that IP addresses are assigned dynamically to these

hosts). For details, see chapter 8.1.

4. In the Interfaces section, allow the VPN server and set its SSL certiﬁcate if necessary. Note

the ﬁngerprint of the server’s certiﬁcate for later use (it will be required for conﬁguration

of the VPN tunnels in the other ﬁlials).

Check whether the automatically selected VPN subnet does not collide with any local sub-

net in any ﬁlial and select another free subnet if necessary.

Note: With respect to the complexity of this VPN conﬁguration, it is recommended to

reserve three free subnets in advance that can later be assigned to individual VPN servers.

5. Deﬁne the VPN tunnel to one of the remote networks. The passive endpoint of the tunnel

must be created at a server with ﬁxed public IP address. Only active endpoints of VPN

tunnels can be created at servers with dynamic IP address.

Set routing (deﬁne custom routes) for the tunnel. Select the Use custom routes only option

and specify all subnets of the remote network in the custom routes list.

If the remote endpoint of the tunnel has already been deﬁned, check whether the tunnel

was created. If not, refer to the Error log, check ﬁngerprints of the certiﬁcates and also

availability of the remote server.

6. Follow the same method to deﬁne a tunnel and set routing to the other remote network.

7. Allow traﬃc between the local and the remote networks. To allow any traﬃc, just add the

created VPN tunnels to the Source and Destination items in the Local traﬃc rule. Access

restrictions options within VPN are described by the example in chapter 23.5.

8. Test reachability of remote hosts in both remote networks. To perform the test, use the

ping and tracert system commands. Test availability of remote hosts both through IP

addresses and DNS names.

If a remote host is tested through IP address and it does not respond, check conﬁguration

of the traﬃc rules or/and ﬁnd out whether the subnets do not collide (i.e. whether the

same subnet is not used at both ends of the tunnel).

If an IP address is tested successfully and an error is reported (Unknown host) when a cor-

responding DNS name is tested, then check conﬁguration of the DNS.

1 2 ... 307 308 309 310 311 312 313 314 315 316 317 ... 367 368

Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual Page 312