Administrator's Guide - Kerio Software Archive

Chapter 8
Firewall and Intrusion Prevention System
8.1 Network intrusion prevention system (IPS)
Kerio Control integrates Snort, an intrusion detection and prevention system (IDS/IPS)
protecting the firewall and the local network from known network intrusions. In Kerio Control,
the system name is simplified for Intrusion Prevention (the name includes meaning of
both functions — no prevention measures can be taken without detection).
What the intrusion prevention system is for and how it works
Network intrusion is undesirable network traffic impacting on functionality or security of the
victim-host. Its purpose is mostly to get illegitimate access or/and to exploit fragile data.
A typical attribute of such intrusions is their apparent legitimacy and it is difficult to uncover
such traffic and filter it simply out by traffic rules. Let us use DoS intrusion (Denial of Service)
as an example. In this type of intrusion, too many connections are established on a port to use
up the system resources of the server application so that no other users can connect there.
However, the firewall considers this act only as an access to an allowed port.
Therefore, sophisticated analysis of network traffic is needed here to detect network
intrusions. Network intrusion detection systems use databases of known intrusions (this is
similar to antivirus programs using databases of known viruses). Thanks to regular update of
the database, new intrusion types are also recognized.
In the current version of Kerio Control, the intrusion prevention system works on all network
interfaces included in the Internet interfaces group (see chapter 5). This implies that it detects
and blocks network intrusions coming from the Internet, not from hosts in local networks or
VPN clients (these hosts are considered as trusted).
For correct functionality of the intrusion prevention system, use of NAT is required (for details
on NAT, see chapter 7.3). It can therefore be used for all typical configurations where Kerio
Control is used for protection of local network. If Kerio Control is implemented as so called
neutral router (without IP address translation), the intrusion prevention system will not work
correctly.
Intrusion detection is performed before application of traffic rules (see chapter 7) which avoids
intervention of traffic rules with the detection process.
112