Watchguard SOHO User manual

WatchGuard SOHO and SOHO | tc
WatchGuard®
SOHO User Guide
SOHO and SOHO|tc version 5.0

2

User Guide 5.0 3
Using this guide
This guide assumes that you are familiar with your computer’s
operating system. If you have questions about navigating in your
computer’s environment, please refer to your system user manual.
The following conventions are used throughout this guide.
Convention Indication
Bold type Denotes menu commands, dialog box options,
Web page options, Web page names. For
example: “On the System Information page,
select Disabled.”
CAUTION Denotes a warning or precautionary information.
NOTE Denotes important information, a helpful tip, or
additional instructions.

4
Certifications and Notices
FCC Certification
This device has been tested and found to comply with limits for a
Class A digital device, pursuant to Part 15 of the FCC Rules.
Operation is subject to the following two conditions:
• This device may not cause harmful interference.
• This device must accept any interference received, including
interference that may cause undesired operation.
CE Notice
The CE symbol on your WatchGuard Technologies equipment
indicates that it is in compliance with the Electromagnetic
Compatibility (EMC) directive and the Low Voltage Directive
(LVD) of the European Union (EU).
Industry Canada
This Class A digital apparatus meets all requirements of the
Canadian Interference-Causing Equipment Regulations.
Cet appareil numerique de la classe A respecte toutes les exigences
du Reglement sur le materiel broulleur du Canada.

User Guide 5.0 5
Taiwanese Notice
VCCI Notice Class A ITE

6
Declaration of Conformity

User Guide 5.0 7
WatchGuard
®
End-User License Agreement
IMPORTANT - READ CAREFULLY BEFORE ACCESSING WATCHGUARD SOFTWARE
This WatchGuard End-User License Agreement (“EULA”) is a legal agreement between you
(either an individual or a single entity) and WatchGuard Technologies, Inc. (“WATCHGUARD”)
for the WATCHGUARD software product you have purchased, which includes computer software
and any separately installed components, and any updates or modifications thereto, and which may
include associated media, printed materials, and on-line or electronic documentation (the
“SOFTWARE PRODUCT”). WATCHGUARD is willing to license the SOFTWARE PRODUCT to
you only on the condition that you accept all of the terms contained in this EULA. Please read this
EULA carefully. By installing or using the SOFTWARE PRODUCT, you agree to be bound by the
terms of this EULA. If you do not agree to the terms of this EULA, WATCHGUARD will not
license the SOFTWARE PRODUCT to you, and you will not have any rights in the SOFTWARE
PRODUCT. In that case, promptly return the SOFTWARE PRODUCT, along with proof of
payment, to the authorized dealer from whom you obtained the SOFTWARE PRODUCT for a full
refund of the price you paid.
1. OWNERSHIP AND LICENSE. The SOFTWARE PRODUCT is protected by copyright laws
and international copyright treaties, as well as other intellectual property laws and treaties. This
is a license agreement and NOT an agreement for sale. All title and copyrights in and to the
SOFTWARE PRODUCT (including but not limited to any images, photographs, animations, video,
audio, music, text, and applets incorporated into the SOFTWARE PRODUCT), the accompanying
printed materials, and any copies of the SOFTWARE PRODUCT are owned by WATCHGUARD or
its suppliers. Your rights to use the SOFTWARE PRODUCT are as specified in this EULA, and
WATCHGUARD retains all rights not expressly granted to you in this EULA. Nothing in this
EULA constitutes a waiver of our rights under U.S. copyright law or any other law or treaty.
2. PERMITTED USES. You are granted the following rights to the SOFTWARE PRODUCT:
(A) You may install and use the SOFTWARE PRODUCT on any computer with an associated
connection to the hardware product (the “Hardware”); (B) You may install and use the
SOFTWARE PRODUCT on more than one computer at once without licensing an additional copy
of the SOFTWARE PRODUCT for each additional computer on which you want to use it, provided
each computer on which you install the SOFTWARE PRODUCT has an associated connection to
the Hardware; and (C) You may make a single copy of the SOFTWARE PRODUCT for backup or
archival purposes only.
3. PROHIBITED USES. You may not, without express written permission from
WATCHGUARD: (A) Reverse engineer, disassemble or decompile the SOFTWARE PRODUCT; (B)
Use, copy, modify, merge or transfer copies of the SOFTWARE PRODUCT or printed materials
except as provided in this EULA; (C) Use any backup or archival copy of the SOFTWARE
PRODUCT (or allow someone else to use such a copy) for any purpose other than to replace the
original copy in the event it is destroyed or becomes defective; (D) Sublicense, lend, lease or rent
the SOFTWARE PRODUCT; or (E) Transfer this license to another party unless (i) the transfer is
permanent, (ii) the third party recipient agrees to the terms of this EULA, and (iii) you do not
retain any copies of the SOFTWARE PRODUCT.

8
4. LIMITED WARRANTY. WATCHGUARD makes the following limited warranties
for a period of ninety (90) days from the date you obtained the SOFTWARE PRODUCT from
WATCHGUARD or an authorized dealer; (A) Media. The disks and documentation will be free
from defects in materials and workmanship under normal use. If the disks or documentation fail
to conform to this warranty, you may, as your sole and exclusive remedy, obtain a replacement
free of charge if you return the defective disk or documentation to WATCHGUARD or the
authorized dealer from whom you obtained the SOFTWARE PRODUCT with a dated proof of
purchase; and (B) SOFTWARE PRODUCT. The SOFTWARE PRODUCT will materially conform
to the documentation that accompanies it. If the SOFTWARE PRODUCT fails to operate in
accordance with this warranty, you may, as your sole and exclusive remedy, return all of the
SOFTWARE PRODUCT and the documentation to the authorized dealer from whom you obtained
it, along with a dated proof of purchase, specifying the problems, and your authorized dealer will
provide you with a new version of the SOFTWARE PRODUCT or a full refund at its election.
DISCLAIMER AND RELEASE. THE WARRANTIES, OBLIGATIONS AND LIABILITIES OF
WATCHGUARD, AND YOUR REMEDIES, SET FORTH IN PARAGRAPHS 4, 4(A) AND 4(B)
ABOVE ARE EXCLUSIVE AND IN SUBSTITUTION FOR, AND YOU HEREBY WAIVE,
DISCLAIM AND RELEASE ANY AND ALL OTHER WARRANTIES, OBLIGATIONS AND
LIABILITIES OF WATCHGUARD AND ITS LICENSORS AND ALL OTHER RIGHTS, CLAIMS
AND REMEDIES YOU MAY HAVE AGAINST WATCHGUARD OR ITS LICENSORS,
EXPRESS OR IMPLIED, ARISING BY LAW OR OTHERWISE, WITH RESPECT TO ANY
NONCONFORMANCE OR DEFECT IN THE SOFTWARE PRODUCT (INCLUDING, BUT NOT
LIMITED TO, ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A
PARTICULAR PURPOSE, ANY IMPLIED WARRANTY ARISING FROM COURSE OF
PERFORMANCE, COURSE OF DEALING, OR USAGE OF TRADE, ANY WARRANTY OF
NONINFRINGEMENT, ANY WARRANTY THAT THIS SOFTWARE PRODUCT WILL MEET
YOUR REQUIREMENTS, ANY WARRANTY OF UNINTERRUPTED OR ERROR-FREE
OPERATION, ANY OBLIGATION, LIABILITY, RIGHT, CLAIM OR REMEDY IN TORT,
WHETHER OR NOT ARISING FROM THE NEGLIGENCE (WHETHER ACTIVE, PASSIVE OR
IMPUTED) OR FAULT OF WATCHGUARD OR ITS LICENSORS AND ANY OBLIGATION,
LIABILITY, RIGHT, CLAIM OR REMEDY FOR LOSS OR DAMAGE TO, OR CAUSED BY OR
CONTRIBUTED TO BY, THE SOFTWARE PRODUCT).
LIMITATION OF LIABILITY. WATCHGUARD’S liability AND THE LIABILITY OF ITS
LICENSORS (whether in contract, tort, or otherwise; and notwithstanding any fault, negligence,
strict liability or product liability) with regard to THE SOFTWARE Product will in no event
exceed the purchase price paid by you for such Product. THIS SHALL BE TRUE EVEN IN THE
EVENT OF THE FAILURE OF AN AGREED REMEDY. IN NO EVENT WILL WATCHGUARD
OR ITS LICENSORS BE LIABLE TO YOU OR ANY THIRD PARTY, WHETHER ARISING IN
CONTRACT (INCLUDING WARRANTY), TORT (INCLUDING ACTIVE, PASSIVE OR
IMPUTED NEGLIGENCE AND STRICT LIABILITY AND FAULT), FOR ANY INDIRECT,
SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT
LIMITATION LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, OR LOSS OF
BUSINESS INFORMATION) ARISING OUT OF OR IN CONNECTION WITH THIS
WARRANTY OR THE USE OF OR INABILITY TO USE THE SOFTWARE PRODUCT, EVEN IF
WATCHGUARD AND ITS LICENSORS HAVE BEEN ADVISED OF THE POSSIBILITY OF

User Guide 5.0 9
SUCH DAMAGES. THIS SHALL BE TRUE EVEN IN THE EVENT OF THE FAILURE OF AN
AGREED REMEDY.
5. UNITED STATES GOVERNMENT RESTRICTED RIGHTS. The enclosed SOFTWARE
PRODUCT and documentation are provided with Restricted Rights. Use, duplication or disclosure
by the U.S Government or any agency or instrumentality thereof is subject to restrictions as set
forth in DFARS 227.7202-3 (Commercial Computer Software) and DFARS 252.227-7015(b)
(Technical Data-Commercial Items) -- Restricted Rights Clause at FAR 52.227-19, as applicable.
Manufacturer is WatchGuard Technologies, Incorporated, 505 Fifth Avenue, South, Suite 500,
Seattle, WA 98104.
6. EXPORT CONTROLS. You agree not to directly or indirectly transfer the SOFTWARE
PRODUCT or documentation to any country to which such transfer would be prohibited by the U.S.
Export Administration Act and the regulations issued thereunder.
7. TERMINATION. This license and your right to use the SOFTWAR PRODUCT will
automatically terminate if you fail to comply with any provisions of this EULA, destroy all copies
of the SOFTWARE PRODUCT in your possession, or voluntarily return the SOFTWARE
PRODUCT to WATCHGUARD. Upon termination you will destroy all copies of the SOFTWARE
PRODUCT and documentation remaining in your control or possession.
8. MISCELLANEOUS PROVISIONS. This EULA will be governed by and construed in
accordance with the substantive laws of Washington excluding the 1980 United National
Convention on Contracts for the International Sale of Goods, as amended. This is the entire EULA
between us relating to the contents of this package, and supersedes any prior purchase order,
communications, advertising or representations concerning the contents of this package AND BY
USING THE SOFTWARE PRODUCT YOU AGREE TO THESE TERMS. No change or
modification of this EULA will be valid unless it is in writing, and is signed by WATCHGUARD.
9. CANADIAN TRANSACTIONS. If you obtained this SOFTWARE PRODUCT in Canada,
you agree to the following: The parties hereto have expressly required that the present EULA be
drawn up in the English language. / Les parties aux presentes ont expressement exige que la
presente conventions et ses Annexes soient redigees en la langue anglaise.

10
WatchGuard
®
Limited Hardware Warranty
This WatchGuard Limited Hardware Warranty (the "Warranty") applies to the enclosed
WatchGuard hardware product (the "Hardware Product"). By using the HARDWARE Product,
you agree to the terms hereof. If you do not agree to these terms, please return this package,
along with proof of purchase, to the authorized dealer from whom you purchased the Hardware
Product for a full refund. THIS WARRANTY DOES NOT APPLY TO THE WATCHGUARD
SOFTWARE REQUIRED FOR OPERATION AND USE OF THE HARDWARE PRODUCT.
PLEASE REFER TO THE ENCLOSED WATCHGUARD END-USER LICENSE AGREEMENT
(THE “EULA”) FOR THE SOFTWARE WARRANTY AND OTHER TERMS AND CONDITIONS
ASSOCIATED WITH USE OF THE SOFTWARE. IF YOU DO NOT AGREE TO THE TERMS OF
THE EULA, PLEASE RETURN THIS PACKAGE IN ACCORDANCE WITH THIS
PARAGRAPH.
NOW, THEREFORE, WatchGuard Technologies and you agree as follows:
1. Limited Warranty. WatchGuard Technologies warrants that upon delivery and for one (1)
year thereafter (as the same may be extended pursuant to Section 2 below, the "Warranty Period"):
(a) the Hardware Product will be free from material defects in materials and workmanship, and
(b) the Hardware Product, when properly installed and used for its intended purpose and in its
intended operating environment, will perform substantially in accordance with WatchGuard
Technologies applicable specifications. This warranty does not apply to any Hardware Product
that has been: (i) altered, repaired or modified by any party other than WatchGuard Technologies;
or (ii) damaged or destroyed by accidents, power spikes or similar events or by any intentional,
reckless or negligent acts or omissions of any party. You may have additional warranties with
respect to the Hardware Product from the manufacturers of Hardware Product components.
However, you agree not to look to WatchGuard Technologies for, and hereby release WatchGuard
Technologies from any liability for, performance of, enforcement of, or damages or other relief on
account of, any such warranties or any breach thereof.
2. Remedies. If any Hardware Product does not comply with WatchGuard Technologies
warranties set forth in Section 1 above, WatchGuard Technologies will, at its option, either
(a) repair the Hardware Product, or (b) replace the Hardware Product; provided, that you will be
responsible for returning the Hardware Product to the place of purchase and for all costs of
shipping and handling. As to any Hardware Product repaired or replaced by WatchGuard
Technologies, the Warranty Period will end one (1) year after delivery of the repaired or
replacement Hardware Product. Any Hardware Product, component, part or other item replaced
by WatchGuard Technologies becomes the property of WatchGuard Technologies. WatchGuard
Technologies shall not be responsible for return of or damage to any software, firmware,
information or data contained in, stored on, or integrated with any returned Hardware Products.
3. Disclaimer and Release. THE WARRANTIES, OBLIGATIONS AND LIABILITIES OF
WATCHGUARD TECHNOLOGIES, AND YOUR REMEDIES, SET FORTH IN PARAGRAPHS 1
AND 2 ABOVE ARE EXCLUSIVE AND IN SUBSTITUTION FOR, AND YOU HEREBY
WAIVE, DISCLAIM AND RELEASE ANY AND ALL OTHER WARRANTIES, OBLIGATIONS
AND LIABILITIES OF WATCHGUARD TECHNOLOGIES AND ALL OTHER RIGHTS, CLAIMS
AND REMEDIES YOU MAY HAVE AGAINST WATCHGUARD TECHNOLOGIES, EXPRESS

User Guide 5.0 11
OR IMPLIED, ARISING BY LAW OR OTHERWISE, WITH RESPECT TO ANY
NONCONFORMANCE OR DEFECT IN THE HARDWARE PRODUCT (INCLUDING, BUT NOT
LIMITED TO, ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A
PARTICULAR PURPOSE, ANY IMPLIED WARRANTY ARISING FROM COURSE OF
PERFORMANCE, COURSE OF DEALING, OR USAGE OF TRADE, ANY WARRANTY OF
NONINFRINGEMENT, ANY WARRANTY OF UNINTERRUPTED OR ERROR-FREE
OPERATION, ANY OBLIGATION, LIABILITY, RIGHT, CLAIM OR REMEDY IN TORT,
WHETHER OR NOT ARISING FROM THE NEGLIGENCE (WHETHER ACTIVE, PASSIVE OR
IMPUTED) OR FAULT OF WATCHGUARD TECHNOLOGIES AND ANY OBLIGATION,
LIABILITY, RIGHT, CLAIM OR REMEDY FOR LOSS OR DAMAGE TO, OR CAUSED BY OR
CONTRIBUTED TO BY, THE HARDWARE PRODUCT).
4. Limitation of Liability. WATCHGUARD TECHNOLOGIES’ liability (WHETHER
ARISING IN CONTRACT (INCLUDING WARRANTY), TORT (INCLUDING ACTIVE, PASSIVE
OR IMPUTED NEGLIGENCE AND STRICT LIABILITY AND FAULT) OR OTHER THEORY)
with regard to any HARDWARE Product will in no event exceed the purchase price paid by you for
such HARDWARE Product. THIS SHALL BE TRUE EVEN IN THE EVENT OF THE FAILURE
OF AN AGREED REMEDY. IN NO EVENT WILL WATCHGUARD TECHNOLOGIES BE
LIABLE TO YOU OR ANY THIRD PARTY, WHETHER ARISING IN CONTRACT (INCLUDING
WARRANTY), TORT (INCLUDING ACTIVE, PASSIVE OR IMPUTED NEGLIGENCE AND
STRICT LIABILITY AND FAULT) OR OTHER THEORY, FOR COST OF COVER OR FOR ANY
INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES (INCLUDING
WITHOUT LIMITATION LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, OR
LOSS OF BUSINESS INFORMATION OR DATA) ARISING OUT OF OR IN CONNECTION
WITH THIS WARRANTY OR THE USE OF OR INABILITY TO USE THE HARDWDARE
PRODUCT, EVEN IF WATCHGUARD TECHNOLOGIES HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. THIS SHALL BE TRUE EVEN IN THE EVENT OF THE
FAILURE OF AN AGREED REMEDY.
5. Miscellaneous Provisions. This Warranty will be governed by the laws of the state of
Washington, without reference to its choice of law rules. The provisions of the 1980 United
Nations Convention on Contracts for the International Sale of Goods, as amended, shall not apply.
If any provision of this Warranty is found to be invalid or unenforceable, then the remainder shall
have full force and effect and the invalid provision shall be modified or partially enforced to the
maximum extent permitted by law to effectuate the purpose of this Warranty. This is the entire
agreement between WatchGuard Technologies and you relating to the contents of this package,
and supersedes any prior purchase order, communications, advertising or representations
concerning the contents of this package AND BY USING THE HARDWARE PRODUCT YOU
AGREE TO THESE TERMS. No change or modification of this Agreement will be valid unless it
is in writing, and is signed by WatchGuard Technologies.

12
Copyright and Patent Information
Copyright © 1999-2001 WatchGuard Technologies, Inc. All rights reserved.
WatchGuard and LiveSecurity are either registered trademarks or trademarks of WatchGuard
Technologies, Inc. in the United States and other countries. Firebox is a trademark of
WatchGuard Technologies, Inc.
CyberPatrol is a registered trademark of SurfControl, Inc.
DocVer: B-2.4-User-2
All other trademarks and trade names are the property of their respective owners.

User Guide 2.4 13
Table of Contents
CHAPTER 1 Introduction ................................................17
Registration and Identification Information ............18
How does a firewall work? ......................................18
How does information travel on the internet? ........20
How does the SOHO process this information? .....21
The SOHO Home Page—System Status .................22
The Default Factory Settings ...................................22
Rebooting a WatchGuard SOHO ............................24
CHAPTER 2 Getting Started ..........................................27
Before you begin ....................................................27
The Installation Process ..........................................28
CHAPTER 3 Setting Up Your SOHO Network .............37
Configuring Your External Network ........................37

14
Configuring Your Trusted Network .........................47
Configuring Static Routes .......................................49
View the Network Statistics .....................................50
CHAPTER 4 Your Administrative Options ....................53
The System Security Page .......................................53
Setting up VPN Manager Access ............................56
Update Your Configuration from a Non-Windows
Platform ..............................................................58
Redeeming your SOHO upgrade certificates .........58
View the Configuration File ....................................61
CHAPTER 5 Configuring Your Firewall Settings ..........63
Firewall settings ......................................................63
Configuring Incoming and Outgoing Services .......63
Blocking External Sites ............................................67
Firewall Options ......................................................69
Creating a virtual DMZ ............................................74
CHAPTER 6 What is Logging? .......................................77
Viewing SOHO log messages .................................77
Setting a WatchGuard Security Event Processor log
host .....................................................................78
Setting a Syslog Host ..............................................80
Setting the System Time .........................................81
CHAPTER 7 WatchGuard SOHO WebBlocker ............85
How WebBlocker works ..........................................85
Purchasing and enabling SOHO WebBlocker ........87

User Guide 5.0 15
Configuring the SOHO WebBlocker .......................88
WebBlocker categories ...........................................93
Searching for blocked sites .....................................96
CHAPTER 8 Configuring Virtual Private Networking ..97
What you will need .................................................98
Step-by-step instructions for configuring a SOHO VPN
tunnel ................................................................100
Frequently asked questions ..................................101
MUVPN Clients .....................................................103
View the VPN Statistics .........................................103
CHAPTER 9 Resources .................................................105
Troubleshooting ....................................................105
Contacting Technical support ...............................114
Online Documenting and In-Depth FAQs ............114
Special Notices .....................................................114

16

User Guide 5.0 17
CHAPTER 1 Introduction
Welcome
Congratulations on purchasing the ideal solution for providing
secure access to the Internet–the WatchGuard SOHO or
WatchGuard SOHO|tc. Your new security device will give you
peace of mind when connecting to the Internet using a high-speed
cable or DSL modem, a leased line, or ISDN.
This User Guide applies to both the SOHO and the SOHO|tc–the
name SOHO is used to refer to both these devices throughout the
guide. The only difference between them is the ability to create and
use a Virtual Private Network (VPN). This VPN option can be
added to the SOHO, while the SOHO|tc comes with the VPN
option already installed.
The most current installation and user information is available on
the Internet at:
http://www.watchguard.com/support/sohoresources.asp

Registration and Identification Information
18
Registration and Identification Information
Once you have installed and configured your SOHO following the
instructions you will find in the upcoming chapters, you will need
to register the unit at our Web site. When the registration is
complete you can take advantage of our LiveSecurity service as
well as any upgrade options you may have purchase.
Please use this area, provided for your convenience, to enter your
SOHO information.
The SOHO serial number is located on the bottom of the SOHO
unit. You create a LiveSecurity user ID and password when you
register your WatchGuard SOHO or SOHO|tc.
Please keep this information in a secure place.
How does a firewall work?
Fundamentally, a firewall is a way of differentiating between, as
well as protecting, “us” from “them”. On the external side of your
SOHO firewall is the entire Internet. The Internet has many
resources that you want to be able to reach, such as the Web,
Email, and video/audio conferencing. It also presents dangers to
the privacy and security of your computers. On the trusted side of
your SOHO firewall are all the devices you want to protect from
SOHO Serial Number:
LiveSecurity User ID:
Password:

User Guide 5.0 19
How does a firewall work?
these dangers. As is illustrated in the image below, the SOHO
physically seperates your trusted network from the Internet.
Using rules we will discuss in Chapter 3: “Configuring Incoming
and Outgoing Services” on page 63, the WatchGuard SOHO
evaluates all traffic between the external network (the Internet)
and the trusted network (your computers) and blocks any
suspicious activity. In order for this to work as described, you
must configure both the external and trusted networks to work
together and to talk to one another as well as the rest of the world.

How does information travel on the internet?
20
How does information travel on the internet?
Each packet of information transported over the Internet must be
packaged in a special way to ensure that it is able to travel from
one computer to the next. A system called Internet Protocol (IP)
takes chunks of information and wraps them up with a header
identifying both where the information is going and how it should
be handled enroute.
IP Addresses
An IP address defines the specific computer on the Internet that
should send or receive a packet. Every computer on the Internet
has a unique address, including your SOHO device. When
defining a service behind your firewall, you need to include the
trusted network address for the machine hosting the application.
On the Internet, IP addresses can be identified using either a string
of numbers or a user-friendly domain name. For example, the IP
address of the WatchGuard site is 209.191.160.60 while the domain
name is www.watchguard.com.
Protocol
A protocol defines how a packet is bundled up and packaged for
shipment across a network. The most commonly used protocols
are Transmission Control Protocol (TCP) and User Datagram
Protocol (UDP). In addition, there are a variety of IP protocols
which are used less frequently.
Port number
The port number alerts the computers at both the sending and
receiving end how to handle the packet.