How traffic rules work

The traffic policy consists of rules ordered by their priority. The rules are processed from the top downwards and the first matched rule is applied. The order of the rules can be changed with the two arrow buttons on the right side of the window, or by dragging the rules within the list.

An implicit rule denying all traffic is shown at the end of the list. This rule cannot be removed. If there is no rule to allow particular network traffic, then the implicit rule will discard the packet.

Configuring traffic rules

If you do not have any traffic rules created in Kerio Control, use the configuration wizard (go to Traffic Rules and click More Actions → Configure in Wizard).

To create your own rules, look at the following examples:

Generic rule

In the default state, Kerio Control denies communication for all services. To create an allowing rule for a service, for example, to allow a user group to use SSH for access to servers in the Internet:

1. Go to Traffic Rules in the administration interface.
2. Click Add.
3. In the Add New Rule dialog box, type a name for the rule (for example, Allow SSH to a group).
4. As a rule type, select Generic.
5. Click Next.
6. Click Users and Groups.
7. In the Select Items dialog box, double-click a group (SSH allowed in our case).
8. Click Next.
9. Select Interfaces.
10. In the Select Items dialog box, select Internet Interfaces.
11. Click Next.
12. Click Services.
13. In the Select Items dialog box, double-click SSH.

The rule allows your users to use SSH to access servers in the Internet.

Port mapping

To enable all services for Kerio Connect placed in your local network protected by Kerio Control, follow these step:

1. In the administration interface, go to Traffic Rules.
2. Click Add.
3. In the Add New Rule wizard, type a name of the rule.
4. Select Port mapping.
5. In the Host field, type the hostname or IP address of the SMTP server placed in your local network.
6. Next to the Service field, click Select.
7. In the Select Items dialog, check the Kerio Connect services group (see figure Adding a service group).
8. Click Finish.
9. Move the rule to the top of the table of traffic rules.

Other examples

• Network address translation
• Multihoming
• Limiting Internet Access

User accounts and groups in traffic rules

In traffic rules, source/destination can be specified also by user accounts and/or user groups. In the traffic policy, each user account represents the IP address of the host from which a user is connected. This means that the rule is applied to users authenticated at the firewall only (when the user logs out, the rule is not effective any longer):

Enabling certain users to access the Internet

In a private network and with the Internet connection performed through NAT, you can specify which users can access the Internet in the Source item in the NAT rule.

Such rules enable the specified users to connect to the Internet if they authenticate. They need to open the Kerio Control interface’s login page manually and authenticate.

Enabling automatic authentication

The automatic user authentication issue can be solved as follows:

1. Add a rule allowing an unlimited access to the HTTP service and place it before the NAT rule.
2. In Content Rules, allow specific users to access any web site and deny any access to other users.

Users who are not yet authenticated and attempt to open a web site are automatically redirected to the authentication page (or authenticated by NTLM, or logged in from the corresponding host). After a successful authentication, users specified in the NAT rule (see figure These traffic rules enable automatic redirection to the login page) will be allowed to access other Internet services. Users not specified in the rules will be disallowed to access any web site or/and other Internet services.

Demilitarized zone (DMZ)

This topic is covered in a special article: Configuring demilitarized zone (DMZ).

Policy routing

This topic is covered in a special article: Configuring policy routing.

Source : http://kb.kerio.com/product/kerio-control/security/configuring-traffic-rules-1312.html