Kerio makes a nice firewall that includes VPN capabilities - server to server or client to server. These are usually very easy to set up and very trouble free.
Ahh, there's always the exception, isn't there? Yesterday I had a customer with three sites and the KWF firewall at each. I set up the VPN between two of the sites quickly, and then jumped in my car to set up the third.
Actually, the VPN was established and working soon after I got there and powered up the machine. That wan't a problem at all, but none of the client machines on the network worked.
The odd thing that should have clued me to the problem instantly was the observation of how the machines worked with Internet Explorer. If, for example, I typed in "https://aplawrence.com", IE would tell me that it was trying to contact 18.104.22.168 - but that was the end of it, and nothing would be in the Kerio logs bocking my access, no record at all, in fact. That should have told me what the problem was, but I missed it, and went off on a wild goose chase looking at switches and relacing the nic card, and redoing traffic rules.. no help.
Eventually I gave up and called in Kerio Support. They were equally puzzled for a long enough period to make me feel a little better for my struggles, but eventually they did spot the problem: the gateway in the DHCP server config (within KWF) was mistyped in the second octet: what should have been "243" was "143".
That explains the odd behavior: the DNS was correct, so the client could resolve names to ip's, but then it went to the wrong gateway to get the data. Stupid, stupid, stupid because I should have realized that. If you think about the symptoms logically, that's the only reasonable possibility: vpn works, access from the firewall machine itself works, clients get their DHCP address and DNS correctly but can't get out - gateway problem HAS to be the issue!
Now: I wasn't the one who mistyped the gateway. The customer had done that. I was the one who didn't CHECK that it was done correctly, so I took responsibility and did not charge for the excess time. That upset my wife ("it wasn't your fault") but I felt I should have found it more quickly, so that's the way it is. Some times you just have to eat the time, and I felt this was one of those circumstances.
Got something to add? Send me email.
More Articles by Anthony Lawrence © 2012-07-12 Anthony Lawrence