Kerio Tech KERIO WINROUTE FIREWALL 6 Service manual

Kerio WinRoute Firewall 6
Administrator’s Guide
Kerio Technologies s.r.o.

Kerio Technologies s.r.o. All rights reserved.
This guide provides detailed description on configuration and administration of Kerio
WinRoute Firewall, version 6.7.1. All additional modifications and updates reserved. User
interfaces Kerio StaR and Kerio Clientless SSL-VPN are focused in a standalone document,
Kerio WinRoute Firewall — User’s Guide. The Kerio VPN Client application is described in
a stand-alone document Kerio VPN Client — User’s Guide.
For current version of the product, go to http://www.kerio.com/firewall/download. For
other documents addressing the product, see http://www.kerio.com/firewall/manual.
Information regarding registered trademarks and trademarks are provided in appendix A.
Products Kerio WinRoute Firewall and Kerio VPN Client include open source software. To
view the list of open source items included, refer to attachment B.

3
Contents
1 Quick Checklist ................................................................ 7
2 Introduction ................................................................... 9
2.1 What’s new in 6.7.1 ....................................................... 9
2.2 Conflicting software ..................................................... 10
2.3 System requirements .................................................... 11
2.4 Installation - Windows ................................................... 12
2.5 Initial configuration wizard (Windows) .................................... 17
2.6 Upgrade and Uninstallation - Windows .................................... 19
2.7 Installation - Software Appliance and VMware Virtual Appliance ........... 20
2.8 Upgrade - Software Appliance / VMware Virtual Appliance ................ 23
2.9 WinRoute Components ................................................... 23
2.10 WinRoute Engine Monitor (Windows) ..................................... 24
2.11 The firewall’s console (Software Appliance / VMware Virtual Appliance) . . . . 25
3 WinRoute Administration ..................................................... 27
3.1 Administration Console - the main window ............................... 28
3.2 Administration Console - view preferences ................................ 31
4 Product Registration and Licensing ............................................ 32
4.1 License types and number of users ....................................... 32
4.2 License information ...................................................... 33
4.3 Registration of the product in the Administration Console ................ 35
4.4 Product registration at the website ....................................... 43
4.5 Subscription / Update Expiration ......................................... 43
4.6 User counter ............................................................ 45
5 Network interfaces ............................................................ 47
6 Internet Connection ........................................................... 53
6.1 Persistent connection with a single link ................................... 54
6.2 Connection with a single leased link - dial on demand ..................... 57
6.3 Connection Failover ...................................................... 62
6.4 Network Load Balancing ................................................. 66
7 Traffic Policy .................................................................. 71
7.1 Network Rules Wizard ................................................... 71
7.2 How traffic rules work ................................................... 78
7.3 Definition of Custom Traffic Rules ........................................ 78
7.4 Basic Traffic Rule Types .................................................. 90

4
7.5 Policy routing ........................................................... 95
7.6 User accounts and groups in traffic rules ................................. 98
7.7 Partial Retirement of Protocol Inspector .................................. 99
7.8 Use of Full cone NAT .................................................. 101
7.9 Media hairpinning ..................................................... 102
8 Configuration of network services ........................................... 104
8.1 DNS module ........................................................... 104
8.2 DHCP server ........................................................... 110
8.3 Dynamic DNS for public IP address of the firewall ....................... 119
8.4 Proxy server ........................................................... 121
8.5 HTTP cache ............................................................ 124
9 Bandwidth Limiter ........................................................... 130
9.1 How the bandwidth limiter works and how to use it ..................... 130
9.2 Bandwidth Limiter configuration ....................................... 130
9.3 Detection of connections with large data volume transferred ............ 135
10 User Authentication .......................................................... 137
10.1 Firewall User Authentication ........................................... 137
11 Web Interface ................................................................ 141
11.1 Web interface preferences .............................................. 141
11.2 User authentication at the web interface ................................ 146
12 HTTP and FTP filtering ....................................................... 147
12.1 Conditions for HTTP and FTP filtering .................................. 147
12.2 URL Rules ............................................................. 148
12.3 Content Rating System (Kerio Web Filter) ............................... 154
12.4 Web content filtering by word occurrence ............................... 158
12.5 FTP Policy ............................................................. 162
13 Antivirus control ............................................................ 167
13.1 Conditions and limitations of antivirus scan ............................ 167
13.2 How to choose and setup antiviruses ................................... 168
13.3 HTTP and FTP scanning ................................................ 172
13.4 Email scanning ........................................................ 176
13.5 Scanning of files transferred via Clientless SSL-VPN (Windows) ........... 178
14 Definitions ................................................................... 180
14.1 IP Address Groups ..................................................... 180
14.2 Time Ranges .......................................................... 181
14.3 Services ............................................................... 183
14.4 URL Groups ........................................................... 187

5
15 User Accounts and Groups ................................................... 190
15.1 Viewing and definitions of user accounts ............................... 191
15.2 Local user accounts .................................................... 193
15.3 Local user database: external authentication and import of accounts . . . . . 203
15.4 User accounts in Active Directory — domain mapping ................... 204
15.5 User groups ........................................................... 210
16 Administrative settings ...................................................... 214
16.1 System configuration (Software Appliance / VMware Virtual Appliance) . . 214
16.2 Setting Remote Administration ......................................... 215
16.3 Update Checking ...................................................... 216
17 Advanced security features .................................................. 218
17.1 P2P Eliminator ......................................................... 218
17.2 Special Security Settings ............................................... 221
18 Other settings ................................................................ 224
18.1 Routing table .......................................................... 224
18.2 Universal Plug-and-Play (UPnP) ......................................... 227
18.3 Relay SMTP server ..................................................... 229
19 Status Information ........................................................... 231
19.1 Active hosts and connected users ...................................... 231
19.2 Network connections overview ......................................... 238
19.3 List of connected VPN clients ........................................... 242
19.4 Alerts ................................................................. 243
20 Basic statistics ............................................................... 248
20.1 Volume of transferred data and quota usage ............................ 248
20.2 Interface statistics ..................................................... 250
21 Kerio StaR - statistics and reporting .......................................... 254
21.1 Monitoring and storage of statistic data ................................ 254
21.2 Settings for statistics and quota ........................................ 256
21.3 Connection to StaR and viewing statistics ............................... 259
22 Logs ......................................................................... 262
22.1 Log settings ........................................................... 262
22.2 Logs Context Menu .................................................... 265
22.3 Alert Log .............................................................. 269
22.4 Config Log ............................................................. 269
22.5 Connection Log ........................................................ 270
22.6 Debug Log ............................................................. 271
22.7 Dial Log ............................................................... 273
22.8 Error Log .............................................................. 275

6
22.9 Filter Log .............................................................. 276
22.10 Http log ............................................................... 277
22.11 Security Log ........................................................... 278
22.12 Sslvpn Log ............................................................ 280
22.13 Warning Log ........................................................... 280
22.14 Web Log ............................................................... 281
23 Kerio VPN .................................................................... 283
23.1 VPN Server Configuration .............................................. 284
23.2 Configuration of VPN clients ........................................... 289
23.3 Interconnection of two private networks via the Internet (VPN tunnel) . . . 291
23.4 Exchange of routing information ....................................... 296
23.5 Example of Kerio VPN configuration: company with a filial office ......... 297
23.6 Example of a more complex Kerio VPN configuration .................... 310
24 Kerio Clientless SSL-VPN (Windows) .......................................... 335
24.1 Configuration of WinRoute’s SSL-VPN ................................... 335
24.2 Usage of the SSL-VPN interface ......................................... 337
25 Specific settings and troubleshooting ......................................... 338
25.1 Configuration Backup and Transfer ..................................... 338
25.2 Configuration files ..................................................... 339
25.3 Automatic user authentication using NTLM ............................. 340
25.4 FTP on WinRoute’s proxy server ........................................ 343
25.5 Internet links dialed on demand ........................................ 346
26 Technical support ............................................................ 351
26.1 Essential Information .................................................. 351
26.2 Tested in Beta version ................................................. 352
A Legal Notices ................................................................. 353
B Used open source items ...................................................... 354
Glossary of terms ............................................................ 357
Index ........................................................................ 364

7
Chapter 1
Quick Checklist
In this chapter you can find a brief guide for a quick setup of Kerio WinRoute Firewall (referred
to as “WinRoute” within this document). After this setup the firewall should be immediately
available and able to share your Internet connection and protect your local network. For
a detailed guide refer to the separate WinRoute — Step-by-Step Configuration guide.
If you are not sure how to set any of the Kerio WinRoute Firewall functions or features, look up
the appropriate chapter in this manual. For information about your Internet connection (such
as your IP address, default gateway, DNS server, etc.) contact your ISP.
Note: In this guide, the expression firewall represents the host where WinRoute is (or will be)
installed.
1. The firewall must include at least two interfaces — one must be connected to the local
network (e.g. Ethernet or WiFi network adapter), another must be connected to the Internet
(e.g. Ethernet or WiFi network adapter, USB ADSL modem, analog modem or an ISDN
adapter).
On Windows, test functionality of the Internet connection and of traffic among hosts within
the local network before you run the WinRoute installation. This test will reduce possible
problems with debugging and error detections.
2. Run WinRoute installation and in the wizard provide required basic parameters (for details,
see chapter 2.4 or 2.7).
3. Set interface groups and basic traffic rules using the Network Rules Wizard (see chap-
ter 7.1).
4. Run the DHCP server and set required IP ranges including their parameters (subnet mask,
default gateway, DNS server address/domain name). For details, see chapter 8.2.
5. Check DNS module settings. Define the local DNS domain if you intend to scan the hosts
file and/or the DHCP server table. For details, see chapter 8.1.
6. Set user mapping from the Active Directory domain or create/import local user accounts
and groups. Set user access rights. For details see chapter 15.
7. Define IP groups (chapter 14.1), time ranges (chapter 14.2) and URL groups (chapter 14.4),
that will be used during rules definition (refer to chapter 14.2).
8. Create URL rules (chapter 12.2) and set the Kerio Web Filter module (chapter 12.3). Set
HTTP cache and automatic configuration of browsers (chapter 8.5). Define FTP rules (chap-
ter 12.5).

Chapter 1 Quick Checklist
8
9. Select an antivirus and define types of objects that will be scanned.
If you choose the integrated McAfee antivirus application, check automatic update settings
and edit them if necessary.
External antivirus must be installed before it is set in WinRoute, otherwise it is not available
in the combo box.
10. Using one of the following methods set TCP/IP parameters for the network adapter of
individual LAN clients:
•Automatic configuration — activate the Obtain an IP address automatically option.
Do not set any other parameters.
•Manual configuration — define IP address, subnet mask, default gateway address,
DNS server address and local domain name.
Use one of the following methods to set the Web browser at each workstation:
•Automatic configuration — activate the Automatically detect settings option (Inter-
net Explorer) or specify URL for automatic configuration (other types of browsers).
For details, refer to chapter 8.5.
•Manual configuration — select type of connection via the local network or define
IP address and appropriate proxy server port (see chapter 8.4).

9
Chapter 2
Introduction
2.1 What’s new in 6.7.1
In version 6.7.1, WinRoute brings the following new features:
Kerio WinRoute Firewall Software Appliance / VMware Virtual Appliance
Kerio WinRoute Firewall is now available as a so called software appliance (Software Ap-
pliance / VMware Virtual Appliance). This appliance is distributed as a full installation
package with the firewall and operating system and can be installed on a physical or
virtual computer without an operating system. Software Appliance cannot be installed
on a computer with another operating system. Installation package of the standalone
product for installation on Linux is not available.
Kerio WinRoute Firewall in the Software Appliance / VMware Virtual Appliance edition
provides the same features as the Windows version, only with the Kerio Clientless SSL-
VPN interface missing.
Web administration interface (Web Administration)
The new Web Administration interface allows both remote and local administration of
the firewall without the need to install the Kerio Administration Console. This interface
allows configuration of crucial WinRoute parameters — the interface, traffic policy, HTTP
and FTP filtering rules, user accounts and groups, etc. However, the Kerio Administration
Console is still available and allow setting of all configuration options.
The Web Administration interface is available at https://server:4081/admin (server
stands for the firewall name or IP address and 4081 for the default port of its web inter-
face).
Refer to chapter 3for more information.
Exporting and Importing Configuration
WinRoute now includes also a special backup-and-recovery tool which allows to back up
and recover full configuration including local user accounts and SSL certificates. These
functions allow easy and quick recovery of the firewall for cases of hardware failure,
transfer to another computer and cloning of an identical configuration for multiple fire-
walls. To export or import configuration, go to the Web Administration interface.
More details can be found in chapter 25.1.
Kerio Web Filter, the new web page rating module
Kerio Web Filter is a special module, used for rating of web pages in accordance to their
content categories. In WinRoute, it replaces the ISS OrangeWeb Filter module. The way of
how filtering rules are created is the same as before.
More details can be found in chapter 12.3.

Chapter 2 Introduction
10
Support for Windows 7
Kerio WinRoute Firewall now includes full support for the new operating system Microsoft
Windows 7.
2.2 Conflicting software
WinRoute can be run with most of common applications. However, there are certain applica-
tions that should not be run at the same host as WinRoute for this could result in collisions.
The computer where WinRoute is installed (the host) can be also used as a workstation. How-
ever, it is not recommended — user interaction may affect performance of the operating sys-
tem which affects WinRoute performance badly.
Collision of low-level drivers
WinRoute collides with system services and applications the low-level drivers of whose
use a similar or an identical technology. The security log contains the following types of
services and applications:
•The Internet Connection Firewall / Internet Connection Sharing system service.
WinRoute can detect and automatically disable this service.
•The system service Routing and Remote Access Service (RRAS) in Windows Server
operating systems. This service allows also sharing of Internet connection (NAT).
WinRoute can detect if NAT is active in the RRAS service; if it is, a warning is dis-
played. In reaction to the alert message, the server administrator should disable
NAT in the RRAS configuration.
If NAT is not active, collisions should be avoided and WinRoute can be used hand
in hand with the RRAS service.
•Network firewalls — e.g. Microsoft ISA Server.
•Personal firewalls, such as Sunbelt Personal Firewall,Zone Alarm,Norton Personal
Firewall, etc.
•Software designed to create virtual private networks (VPN) — i.e. software appli-
cations developed by the following companies: CheckPoint,Cisco Systems,Nortel,
etc. There are many applications of this type and their features vary from vendor
to vendor.
Under proper circumstances, use of the VPN solution included in WinRoute is
recommended (for details see chapter 23). Otherwise, we recommend you to test
a particular VPN server or VPN client with WinRoute trial version or to contact
our technical support (see chapter 26).
Note: VPN implementation included in Windows operating system (based on the
PPTP protocol) is supported by WinRoute.
Port collision
Applications that use the same ports as the firewall cannot be run at the WinRoute host
(or the configuration of the ports must be modified).
If all services are running, WinRoute uses the following ports:

2.3 System requirements
11
•53/UDP —DNS module,
•67/UDP —DHCP server,
•1900/UDP — the SSDP Discovery service,
•2869/TCP — the UPnP Host service.
The SSDP Discovery and UPnP Host services are included in the UPnP support
(refer to chapter 18.2).
•44333/TCP+UDP — traffic between Kerio Administration Console and WinRoute
Firewall Engine. This service cannot be stopped.
The following services use corresponding ports by default. Ports for these services can
be changed.
•443/TCP — server of the SSL-VPN interface (only in WinRoute on Windows — see
chapter 24),
•3128/TCP — HTTP proxy server (see chapter 8.4),
•4080/TCP — web interface of the firewall (refer to chapter 11),
•4081/TCP — secured (SSL-encrypted) version of the firewall’s web interface (see
chapter 11) ,
•4090/TCP+UDP — proprietary VPN server (for details refer to chapter 23).
Antivirus applications
Most of the modern desktop antivirus programs (antivirus applications designed to pro-
tect desktop workstations) scans also network traffic — typically HTTP,FTP and email
protocols. WinRoute also provides with this feature which may cause collisions. Therefore
it is recommended to install a server version of your antivirus program on the WinRoute
host. The server version of the antivirus can also be used to scan WinRoute’s network
traffic or as an additional check to the integrated antivirus McAfee (for details, see chap-
ter 13).
If the antivirus program includes so called realtime file protection (automatic scan of
all read and written files), it is necessary to exclude directories cache (HTTP cache in
WinRoute see chapter 8.5) and tmp (used for antivirus check). If WinRoute uses an
antivirus to check objects downloaded via HTTP or FTP protocols (see chapter 13.3), the
cache directory can be excluded with no risk — files in this directory have already been
checked by the antivirus.
The McAfee integrated antivirus plug-in does not interact with antivirus application in-
stalled on the WinRoute host (provided that all the conditions described above are met).
2.3 System requirements
Requirements on minimal hardware parameters of the host where WinRoute will be installed:
•CPU 1 GHz,
•1 GB RAM,
•Two network interfaces (including dial-ups).
For Windows:

Chapter 2 Introduction
12
•50 MB free disk space for installation of Kerio WinRoute Firewall.
•Disk space for statistics (see chapter 21) and logs (in accordance with traffic flow and
logging level — see chapter 22).
•to keep the installed product (especially its configuration files) as secure as possible,
it is recommended to use the NTFS file system.
For Kerio WinRoute Firewall Software Appliance:
•Minimum 3 GB hard disk.
•No operating system is required to be installed on the computer. Any existing operat-
ing system will be removed from the computer.
For Kerio WinRoute Firewall VMware Virtual Appliance:
•VMware Player,VMware Workstation or VMware Server.
•3 GB free disk space.
The following browsers can be used to access the WinRoute (Kerio StaR — see chapter 21 and
Kerio SSL-VPN — see chapter 24) web services:
•Internet Explorer 7 or higher,
•Firefox 2 or higher,
•Safari 3 or higher.
2.4 Installation - Windows
Installation packages
Kerio WinRoute Firewall is distributed in two editions: one is for 32-bit sys-
tems and the other for 64-bit systems (see the product’s download page:
http://www.kerio.com/firewall/download).
The 32-bit edition (the “win32” installation package) supports the following operating systems:
•Windows 2000,
•Windows XP (32 bit),
•Windows Server 2003 (32 bit),
•Windows Vista (32 bit),
•Windows Server 2008 (32 bit).
The 64-bit edition (the “win64” installation package) supports the following operating systems:
•Windows XP (64 bit),
•Windows Server 2003 (64 bit),
•Windows Vista (64 bit),
•Windows Server 2008 (64 bit).
Older versions of Windows operating systems are not supported.

2.4 Installation - Windows
13
Note:
1. WinRoute installation packages include the Kerio Administration Console. The separate
Kerio Administration Console installation package (file kerio-kwf-admin*.exe) is de-
signed for full remote administration from another host. This package is identical both for
32-bit and 64-bit Windows systems. For details on WinRoute administration, see chapter 3.
2. For correct functionality of the Kerio StaR interface (see chapter 21), it is necessary that
the WinRoute host’s operating system supports all languages that would be used in the
Kerio StaR interface. Some languages (Chinese, Japanese, etc.) may require installation of
supportive files. For details, refer to documents regarding the corresponding operating
system.
Steps to be taken before the installation
Install WinRoute on a computer which is used as a gateway connecting the local network and
the Internet. This computer must include at least one interface connected to the local network
(Ethernet, WiFi, etc.) and at least one interface connected to the Internet. You can use either
a network adapter (Ethernet, WiFi, etc.) or a modem (analog, ISDN, etc.) as an Internet interface.
We recommend you to check through the following items before you run WinRoute installation:
•Time of the operating system should be set correctly (for timely operating system and
antivirus upgrades, etc.),
•The latest service packs and any security updates should be applied,
•TCP/IP parameters should be set for all available network adapters,
•All network connections (both to the local network and to the Internet) should function
properly. You can use for example the ping command to detect time that is needed
for connections.
These checks and pre-installation tests may protect you from later problems and complica-
tions.
Note: Basic installation of all supported operating systems include all components required
for smooth functionality of WinRoute.
Installation and Basic Configuration Guide
Once the installation program is launched (i.e. by kerio-kwf-6.6.0-5700-win32.exe), it is
possible to select a language for the installation wizard. Language selection affects only the
installation, language of the user interface can then be set separately for individual WinRoute
components.
In the installation wizard, you can choose either Full or Custom installation. Custom mode will
let you select optional components of the program:

Chapter 2 Introduction
14
Figure 2.1 Installation — customization by selecting optional components
•Kerio WinRoute Firewall Engine — core of the application.
•VPN Support — proprietary VPN solution developed by Kerio Technologies (Kerio VPN).
•Administration Console — the Kerio Administration Console application (universal con-
sole for all server applications of Kerio Technologies) including WinRoute administra-
tion tools.
•Help files — this manual in the HTML Help format. For help
files details, see Kerio Administration Console — Help (available at
http://www.kerio.com/firewall/manual).
Go to chapter 2.9 for a detailed description of all WinRoute components. For detailed descrip-
tion on the proprietary VPN solution, refer to chapter 23.
Having completed this step, you can start the installation process. All files will be copied to
the hard disk and all the necessary system settings will be performed. The initial Wizard will
be run automatically after your first login (see chapter 2.5).
Under usual circumstances, a reboot of the computer is not required after the installation (a
restart may be required if the installation program rewrites shared files which are currently in
use). This will install the WinRoute low-level driver into the system kernel. WinRoute Engine
will be automatically launched when the installation is complete. The engine runs as a service.
Note:
1. If you selected the Custom installation mode, the behavior of the installation program will
be as follows:

2.4 Installation - Windows
15
•all checked components will be installed or updated,
•all checked components will not be installed or will be removed
During an update, all components that are intended to remain must be ticked.
2. The installation program does not allow to install the Administration Console separately.
Installation of the Administration Console for the full remote administration requires
a separate installation package (file kerio-kwf-admin*.exe).
Protection of the installed product
To provide the firewall with the highest security possible, it is necessary to ensure that unde-
sirable (unauthorized) persons has no access to the critical files of the application, especially
to configuration files. If the NTFS system is used, WinRoute refreshes settings related to access
rights to the directory (including all subdirectories) where the firewall is installed upon each
startup. Only members of the Administrators group and local system account (SYSTEM) are
assigned the full access (read/write rights), other users are not allowed access the directory.
Warning
If the FAT32 file system is used, it is not possible to protect WinRoute in the way suggested
above. For this reason, it is recommended to install WinRoute only on computers which use
the NTFS file system.
Conflicting Applications and System Services
The WinRoute installation program detects applications and system services that might con-
flict with the WinRoute Firewall Engine.
1. Windows Firewall’s system components1and Internet Connection Sharing.
These components provide the same low-level functions as WinRoute. If they are run-
ning concurrently with WinRoute, the network communication would not be functioning
correctly and WinRoute might be unstable. Both components are run by the Windows
Firewall / Internet Connection Sharing system service.2.
Warning
To provide proper functionality of WinRoute, it is necessary that the Internet Connection
Firewall / Internet Connection Sharing detection is stopped and forbidden!
In Windows XP Service Pack 1 and older versions, the integrated firewall is called Internet Connection Firewall.
1
In the older Windows versions listed above, the service is called Internet Connection Firewall / Internet Connection
2
Sharing.

Chapter 2 Introduction
16
2. Universal Plug and Play Device Host and SSDP Discovery Service
The services support UPnP (Universal Plug and Play) in the Windows XP,Windows
Server 2003,Windows Vista and Windows Server 2008 operating systems. However, these
services collide with the UPnP support in WinRoute (refer to chapter 18.2).
The WinRoute installation includes a dialog where it is possible to disable colliding system
services.
Figure 2.2 Disabling colliding system services during installation
By default, the WinRoute installation disables all the colliding services listed. Under usual
circumstances, it is not necessary to change these settings. Generally, the following rules are
applied:
•The Windows Firewall / Internet Connection Sharing (ICS) service should be disabled.
Otherwise, WinRoute will not work correctly. The option is a certain kind of warning
which informs users that the service is running and that it should be disabled.
•To enable support for the UPnP protocol in WinRoute (see chapter 18.2), it is neces-
sary to disable also services Universal Plug and Play Device Host and SSDP Discovery
Service.
•If you do not plan to use support for UPnP in WinRoute, it is not necessary to disable
the Universal Plug and Play Device Host and SSDP Discovery Serviceservices.
Note:
1. Upon each startup, WinRoute detects automatically whether the Windows Firewall / Inter-
net Connection Sharing is running. If it is, WinRoute stops it and makes a record in the

2.5 Initial configuration wizard (Windows)
17
warning log. This helps assure that the service will be enabled/started immediately after
the WinRoute installation.
2. On Windows XP Service Pack 2,Windows Server 2003,Windows Vista and Windows
Server 2008,WinRoute registers in the Security Center automatically. This implies that
the Security Center always indicates firewall status correctly and it does not display warn-
ings informing that the system is not protected.
2.5 Initial configuration wizard (Windows)
Using this wizard you can define all basic WinRoute parameters. It is started automatically by
the installation program for Windows.
Setting of administration username and password
Definition of the administration password is essential for the security of the firewall. Do not
use the standard (blank) password, otherwise unauthorized users may be able to access the
WinRoute configuration.
Figure 2.3 Initial configuration — Setting of administration username and password

Chapter 2 Introduction
18
Password and its confirmation must be entered in the dialog for account settings. Name Admin
can be changed in the Username edit box.
Note: If the installation is running as an upgrade, this step is skipped since the administrator
account already exists.
Remote Access
Immediately after the first WinRoute Firewall Engine startup all network traffic will be blocked
(desirable traffic must be permitted by traffic rules — see chapter 7). If WinRoute is installed
remotely (i.e. using terminal access), communication with the remote client will be also inter-
rupted immediately (WinRoute must be configured locally).
Within Step 2 of the configuration wizard specify the IP address of the host from which the
firewall will be controlled remotely to enable remote installation and administration. Thus
WinRoute will enable all traffic between the firewall and the remote host.
Note: Skip this step if you install WinRoute locally. Allowing full access from a point might
endanger security.
Figure 2.4 Initial configuration — Allowing remote administration

2.6 Upgrade and Uninstallation - Windows
19
Enable remote access
This option enables full access to the WinRoute computer from a selected IP address
Remote IP address
IP address of the computer from where you will be connecting (e.g. terminal services
client). This field must contain an IP address. A domain name is not allowed.
Warning
The remote access rule is disabled automatically when WinRoute is configured using the net-
work policy wizard (see chapter 7.1).
2.6 Upgrade and Uninstallation - Windows
Upgrade
Simply run the installation of a new version to upgrade WinRoute (i.e. to get a new release
from the Kerio Web pages — http://www.kerio.com/).
All windows of the Kerio Administration Console must be closed before the (un)installation is
started. All of the three WinRoute components will be stopped and closed automatically.
The installation program detects the directory with the former version and updates it by re-
placing appropriate files with the new ones automatically. License, all logs and user defined
settings are kept safely.
Note: This procedure applies to upgrades between versions of the same series (e.g. from
6.6.0 to 6.6.1) or from a version of the previous series to a version of the subsequent series
(e.g. from 6.5.2 to 6.6.0). For case of upgrades from an older series version (e.g. 6.3.1), full
compatibility of the configuration cannot be guaranteed and it is recommended to upgrade
“step by step” (e.g. 6.3.1 →6.4.0 →6.5.0 →6.6.0) or to uninstall the old version along with all
files and then install the new version “from scratch”.
Update Checker
WinRoute enables automatic checks for new versions of the product at the Kerio Technologies
website. Whenever a new version is detected, its download and installation will be offered
automatically.
For details, refer to chapter 16.3.
Uninstallation
To uninstall WinRoute, stop all three WinRoute components. The Add/Remove Programs
option in the Control Panel launches the uninstallation process. All files under the WinRoute
directory can be optionally deleted.
(the typical path is C:\Program Files\Kerio\WinRoute Firewall)
— configuration files, SSL certificates, license key, logs, etc.

Chapter 2 Introduction
20
Figure 2.5 Uninstallation — asking user whether files created in WinRoute should be deleted
Keeping these files may be helpful for copying of the configuration to another host or if it is
not sure whether the SSL certificates were issued by a trustworthy certification authority.
During uninstallation, the WinRoute installation program automatically refreshes the original
status of the Windows Firewall / Internet Connection Sharing,Universal Plug and Play Device
Host) and SSDP Discovery Service system services.
2.7 Installation - Software Appliance and VMware Virtual Appliance
WinRoute in the software appliance edition is distributed:
•as an ISO of the installation CD which is used to install the system and then install the
firewall either on a physical or virtual computer (Software Appliance),
•as a virtual appliance for VMware (VMware Virtual Appliance).
Standalone WinRoute installation package for installation on previously installed Linux is not
available.
Software Appliance / VMware Virtual Appliance installation process consists of the following
simple steps: