User`s guide

Chapter 2 Headquarters conﬁguration

Set the following parameters using the Wizard:

• Internet connection types (page 2) — select persistent connection with a single Internet

line.

• Internet interface (page 3) — select an interface connected to the Internet.

• Rules used for outgoing traﬃc (page 4) — these rules enable access to Internet ser-

vices.

• Rules for VPN (page 5) — leave both options enabled: Create rules for Kerio VPN (this

creates key traﬃc rules for interconnection of headquarters and ﬁlial networks and

for connection of remote clients — see chapter

4) and Create rules for Kerio Clientless

SSL-VPN (remote access to shared folders and ﬁles in the network via browser).

Note: It is meaningless to create rules for Kerio VPN at the ﬁlial’s ﬁrewall and for

incoming traﬃc (the server uses a dynamic IP address and clients cannot connect to

it). For this reason it is now necessary to disable creating of rules for Clientless SSL-

VPN.

• Rules for incoming traﬃc (Step 6) — add mapping of SMTP service on the ﬁrewall.

Note: In this step you can also deﬁne mapping for other hosted services such as an

FTP server. This will be better understood through the second method — custom rule

deﬁnition. For details, see chapter 2.13.

2.5 DHCP Server Conﬁguration

Go to the Conﬁguration → DHCP server section in Kerio Administration Console. Open the

Scopes tab to create an IP scope for hosts to which addresses will be assigned dynamically (the

Add → Scope option). The following parameters must be speciﬁed to deﬁne address scopes:

• Address rsnge — select 192.168.1.10 to 192.168.1.254 (addresses from

192.168.1.1 to 192.168.1.9 will be reserved for servers and printing machines),

• Network mask — 255.255.255.0

• Default gateway — IP address of the ﬁrewall interface that is connected to the local

network (192.168.1.1).

• DNS server — IP address of the ﬁrewall interface that is connected to the local network

(192.168.1.1 — the same as the default gateway). The WinRoute’s DNS forwarder will

be used as the primary DNS server. The forwarder will procure correct forwarding of

requests between the company’s oﬃces and to the Internet.

Now add a reservation for the network printer. The address you reserve need not necessarily

belong to the scope described above, however, it must belong to the speciﬁed network (in