Administrator's Guide - Kerio Software Archive

Administrative settings
firewall’s system time. The time zone also includes information about daylight saving
time settings.
Kerio Technologies offers the following free NTP servers for this purpose:
0.kerio.pool.ntp.org, 1.kerio.pool.ntp.org, 2.kerio.pool.ntp.org and
3.kerio.pool.ntp.org.
17.2 Setting Remote Administration
Remote administration is connection to the firewall, its monitoring and configuration changes
with the Administration Console or with the Administration web interface from another host
that the one on which Kerio Control is installed.
If Kerio Control includes only traffic rules created automatically by the wizard (see chapter 7.1),
access to the remote administration is allowed via all trustworthy network interfaces (see
chapter 5). This means that remote administration is available from all local hosts.
To allow or deny remote administration via the Internet (non-trusted networks), define
a corresponding traffic rule. Traffic between Kerio Control and Administration Console is
performed by TCP and UDP protocols over port 44333. The definition can be done with
the predefined service Kerio Control Admin. The secured version of the Administration web
interface uses TCP protocol, on port 4081 — predefined Kerio Control WebAdmin service.
How to allow remote administration from the Internet
In the following example we will demonstrate how to allow Kerio Control remote
administration from some Internet IP addresses.
• Source — group of IP addresses from which remote administration will be allowed (see
chapter 15.1).
For security reasons it is not recommended to allow remote administration from an
arbitrary host within the Internet (this means: do not set Source as Any or as Internet)!
• Destination — Firewall (host where Kerio Control is installed).
• Service — Kerio Control Admin (connection with the Administration Console) and Kerio
Control WebAdmin (secured version of the Administration web interface).
Please feel strongly discouraged from allowing access to the unsecured version of
the Administration web interface! Unsecured traffic might be tapped and misused for
assaulting the firewall and local hosts behind it.
• Action — Permit (otherwise remote administration would be blocked)
• Translation — Because the engine is running on the firewall there is no need for
translation.
240