User`s guide

4.2 Conﬁguration of a ﬁlial oﬃce

1. In WinRoute under Conﬁguration / Interfaces select a VPN server, open its settings dialog

and enable it.

Note: A free subnet which has been selected for VPN is now speciﬁed automatically in the

VPN network and Mask entries. There is no reason to change the network.

Use the Edit SSL certiﬁcate button to create an SSL certiﬁcate with the name of the corre-

sponding server (e.g. server.officebrazil.company.com). This certiﬁcate is used for

identiﬁcation of the VPN server. The ﬁngerprint of the created SSL certiﬁcate will be re-

quired for deﬁnition of the VPN tunnel on the headquarters server (see chapter

4.1). Select

it, copy it to the clipboard and paste it to an email message, text ﬁle, etc.

Note: It is recommended to later replace this generated certiﬁcate with a certiﬁcate autho-

rized by a reliable public certiﬁcation authority.

2. Create an active endpoint of the VPN tunnel which connects to the company’s headquar-

ters server (kwf.company.com). The ﬁngerprint of the VPN server certiﬁcate can be set

simply by clicking on Detect remote certiﬁcate.

3. Complete the Local Traﬃc rule (created by the Network Rules Wizard — see chapter 2.4)

with the VPN tunnel.

Name Source Destination Service Action Translation

Local Traﬃc Firewall

Tunnel to oﬃce

Trusted / local

Firewall

Tunnel to oﬃce

Trusted / local

Any Allow

Table 4.3 Oﬃce (Filial) — the Local Traﬃc rule

4. In the conﬁguration of the DNS Forwarder (refer to chapter 2.6), enable the Use cus-

tom forwarding. Deﬁne rules for the company.com domain. Set the IP address of the

headquarter’s domain server (192.168.1.2) which is used as the primary server for the

company.com domain as the DNS server used for forwarding.

Domain / Network DNS server(s)

192.168.1.0 / 255.255.255.0 192.168.1.2

company.com 192.168.1.2

Table 4.4 Filial — DNS forwarding conﬁguration

4.3 VPN test

Conﬁguration of the VPN tunnel has been completed by now. At this point, it is recommended

to test availability of the remote hosts from each end of the tunnel (from both local networks).

For example, the ping or/and tracert operating system commands can be used for this

testing. It is recommended to test availability of remote hosts both through IP addresses and

DNS names.