User`s guide

Chapter 4 Interconnection of the headquarters and branch oﬃces

The headquarters uses IP addresses 192.168.1.x with the network mask 255.255.255.0 and

with DNS domain company.com. The branch oﬃce uses IP addresses 10.1.1.x with network

mask 255.255.255.0 and with the subdomain filial.company.com.

4.1 Headquarters conﬁguration

1. In WinRoute under Conﬁguration / Interfaces select a VPN server, open its settings dialog

and enable it.

Note: A free subnet which has been selected for VPN is now speciﬁed automatically in the

VPN network and Mask entries. There is no reason to change the network.

Use the Edit SSL certiﬁcate button to create an SSL certiﬁcate with the name of the corre-

sponding server (e.g. kwf.company.com). This certiﬁcate is used for identiﬁcation of the

VPN server.

Note: It is recommended to later replace this generated certiﬁcate with a certiﬁcate autho-

rized by a reliable public certiﬁcation authority.

2. Create a passive endpoint of the VPN tunnel (the oﬃce’s server uses a dynamic IP address

— therefore there must be the active endpoint of the tunnel at the oﬃce). Specify the

remote endpoint SSL certiﬁcate’s ﬁngerprint by the ﬁngerprint of the certiﬁcate of the

branch oﬃce VPN server.

3. Complete the Local Traﬃc rule (created by the Network Rules Wizard — see chapter

2.4)

with the VPN tunnel.

Name Source Destination Service Action Translation

Local Traﬃc Firewall

All VPN clients

Tunnel to the oﬃce

Trusted / local

Firewall

All VPN clients

Tunnel to the oﬃce

Trusted / local

Any Allow

Table 4.1 Headquarters — the Local Traﬃc rule

4. In the conﬁguration of the DNS Forwarder (refer to chapter 2.6), enable the Use custom

forwarding. Deﬁne rules for the filial.company.com domain. Specify the server for

DNS forwarding by the IP address of the remote ﬁrewall host’s interface (i.e. interface

connected to the local network at the other end of the tunnel).

Domain / Network DNS server(s)

10.1.1.0 / 255.255.255.0 10.1.1.1

filial.company.com 10.1.1.1

Table 4.2 Headquarters — DNS forwarding conﬁguration