The Kerio WinRoute Firewall (KWF) provides gateway security for small to medium sized corporate networks. The software product runs on Windows-based servers (and, for VPN connectivity, Windows clients, as well) and provides multiple integrated functions, including virus scanning, content filtering, stateful inspection, and an integrated SSL VPN Server that can operate in both client-server (for remote workers) or server-server mode for connectivity to branch offices. Some functions provided are integral to the base product offering (such as firewall inspection, SSL VPN connectivity, and basic content filtering), while others (such as extended Web filtering and anti-virus scanning) are provided as separately priced extensions.

Primary capabilities and functions of the product include:

- Firewall: KWF operates at the TDI/NDIS layers of the OS, with stateful packet inspection applied to both incoming and outgoing network traffic. Policies are created and managed via an included rules wizard, and packet filters, NAT, port mapping and access control can all be configured. Individual users can be forced to login to the firewall before accessing the Internet (the firewall itself allows for the direct definition/storage of user names and passwords; and can additionally support the access of user information from external Active Directory servers), and traffic policies can be defined and applied by users or groups (in addition to IP address/computer name or the network as a whole).

New in the latest release of the product is the vendor's Bandwidth Limiter, a basic bandwidth management mechanism for administrators that allows them to slow down Internet connections for heavy traffic users and/or configure daily or monthly quotas for bandwidth usage.

- VPN Server and Client: KWF includes an SSL VPN Server and clients that allow for both client-server and server-server encrypted connectivity; SSL for the control channel (TCP) and Blowfish for the data transport (UDP). In client-server mode, users connect via provided Windows-based KWF VPN clients. Additionally, a clientless SSL VPN connectivity feature allows remote clients to access shared files on LAN servers. Clientless access to the files is facilitated through standard Web browsers, without requiring special client software; with it, users can browse the file directory, upload and download files and create directories.

For customers with existing VPN infrastructures, the vendor notes that the firewall includes support for IPSec and PPTP VPN protocols.

- Anti-virus: Through integrated (and optional) McAfee technologies. Other 3rd party A/V vendors can be supported via plug-ins, including CA eTrust and Symantec; and in the latest release users can opt to simultaneously scan traffic with both the McAfee scanner and their selected third party engine (note that the third party scanning engines are provided separately; Kerio's plug-in architecture just facilitates their usage as part of the firewall functions). Inbound and outbound E-mail (SMTP, POP3), Web (HTTP), and file transfer (FTP) traffic is examined.

- Internet filtering: Another optional offering, providing for the ability to control user access to Web sites individually or in groups based on the ISS Orange Web Filter database. The database contains a list of sites separated into 60 Web content categories (shopping, news, pornography, etc.) and if a user attempts to access a site that has been listed in a category they do not have access to, KWF denies access to the page. Additional filtering options are supplied directly within KWF itself (without requiring the ISS Orange Web Filter DB), and include P2P blocking, custom (administrator defined) site blocking, and HTTP (ActiveX and JavaScript) and FTP content filtering.

Other KWF features include H.323, SIP, and UPnP support, fail-over support for servers with multiple Internet connections, content caching, and administrator alerting via E-mail.

KWF is available now. Pricing begins at $399 for 10 users ($499 w/McAfee anti-virus), with the optional ISS Orange Web Filter blocking component requiring an additional $249 for 10 users. These base prices include subscriptions for the first year.

Contact Kerio for further information.

product submission by DPW Staff

E-Mail this page to a colleague
send info about Kerio WinRoute Firewall

Suggest a link
for the Kerio WinRoute Firewall fact sheet