Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual download pdf (Page 77)

7.1 Network Rules Wizard

NAT

This rule sets that in all packets routed from the local network to the Internet, the source

(private) IP address will be replaced by the address of the Internet interface through

which the

packet is sent from the ﬁrewall. Only speciﬁed services can be accessed by the

Internet connection (the wizard, page 4).

The Source item of this rule includes the Trusted / Local interfaces group and the Des-

tination item includes group Internet interfaces. This makes the rule applicable to any

network conﬁguration. It is not necessary to change this rule whenever a new segment of

the LAN is connected or Internet connection is changed.

By default, the Trusted / Local interfaces group includes also a Dial-In interface, i.e. all

RAS clients connecting to this server can access the Internet with the NAT technology.

Local Traﬃc

This rule allows all traﬃc between local hosts and the ﬁrewall (i.e. the computer where

WinRoute is installed). In this rule, items Source and Destination include the Trusted /

Local interfaces group (see chapter 5) and the special group Firewall.

By default, the Trusted / Local interfaces group includes also a Dial-In interface. This

means that the Local Traﬃc rule also allows traﬃc between local hosts and RAS

clients/VPN clients connected to the server.

If creating of rules for Kerio VPN was set in the wizard (the wizard, page 5), the Local

Traﬃc rule includes also special address groups All VPN tunnels and All VPN clients. This

implies that, by default, the rule allows traﬃc between the local network (ﬁrewall), remote

networks connected via VPN tunnels and VPN clients connecting to the WinRoute’s VPN

server.

Note: Access to the WinRoute host is not limited as the Wizard supposes that this host

belongs to the local network. Limitations can be done by modiﬁcation of an appropriate

rule or by creating a new one. An inconvenient rule limiting access to the WinRoute

host might block remote administration or it might cause some Internet services to be

unavailable (all traﬃc between the LAN and the Internet passes through this host).

Firewall Traﬃc

This rule enables access to certain services from the WinRoute host. It is similar to the

NAT rule except from the fact that this rule does not perform IP translation (this host

connects to the Internet directly).

Default rule

This rule drops all communication that is not allowed by other rules. The default rule is

always listed at the end of the rule list and it cannot be removed.

The default rule allows the administrator to select what action will be taken with unde-

sirable traﬃc attempts (Deny or Drop) and to decide whether packets or/and connections

will be logged.

Note: To see detailed descriptions of traﬃc rules refer to chapter

7.3.

1 2 ... 72 73 74 75 76 77 78 79 80 81 82 ... 367 368

No comments

Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual Page 77