Welcome to WinGate

WinGate

The comprehensive Internet management solution for Windows

Welcome and thank you for choosing WinGate for your Internet management needs.

WinGate includes many features designed to make your Internet experience safer and easier to manage, saving you time, headaches, and money.

WinGate has a flexible feature set designed to help you address the issues facing more Internet users every day, without getting in the way of your operations, or requiring specialist networking know how.

Click here to read more about WinGate features

©2009 Qbik New Zealand Limited

WinGate is a registered Trade Mark of Qbik IP Management Limited. All other trademarks and copyrights are owned by their respective owners.


Introducing WinGate 6.5

Introducing WinGate

Welcome and thank you for choosing WinGate for your Internet management needs.

WinGate has a flexible feature set designed to help you address the issues facing more Internet users every day, without getting in the way of your operations, or requiring specialist networking know how.

What can I use WinGate for?

  • Sharing your Internet connection

    When it was first released in October 1995, WinGate was the world's first Internet connection sharing proxy solution for Windows, allowing users simultaneous access to the Internet over a single connection. Since then WinGate has evolved into a sophisticated yet easy to use Internet connectivity management suite.

  • Firewall protection

    WinGate acts as a packet-level firewall, protecting you and your network from attacks from the Internet, and alerting you to potential issues. As well as the firewall, WinGate also provides higher protocol-level controls to allow you greater flexibility in controlling the activities you wish to permit through your Internet connection.

  • Virus protection and content filtering for Email, Web, and File Transfers (FTP)

    WinGate 6 supports several third party data scanning plugins, such as PureSight for WinGate (a web content filtering product using technology from PureSight Inc.), and Kaspersky AntiVirus for WinGate (the respected antivirus solution from Kaspersky Labs). WinGate supports scanning of email retrieval, reception and delivery, web browsing (including uploads), and FTP.

    WinGate will even scan your email as you retrieve it via WinGate from a remote mail server. Keep an eye on the WinGate website for more plugins as they become available.

  • Comprehensive secure email system with advanced spam rejection measures

    WinGate includes a fully featured mail server (POP3 and SMTP receiving/delivery) designed specifically for ease of configuration and use. It provides security with comprehensive support for secure connections and authentication methods. It also provides enhanced protection against spam.

    Many email servers are complex and difficult to administer. WinGate however is simple to use, yet powerful, flexible, quick, and reliable. A new feature in WinGate's mail server is its rejection of spoofed sender addresses, which comprises over 90% of all SPAM.

  • Remote and home office network connection with WinGate Virtual Private Networking

    WinGate 6 offers a fully integrated VPN solution (additional license required).

    This allows you to connect remote offices or mobile users into your corporate network for file sharing, printing, or other business specific applications. If you purchase the necessary WinGate VPN licenses, your home and mobile users, and remote offices will be able to use the resources of your network as if they were plugged into it directly (performance may vary depending on the speed of your Internet connection). Special considerations were paid to network browsing and system configuration, to make this an extremely easy VPN to get up and running and use, without sacrificing security, flexibility, or functionality.

  • Whatever else your imagination comes up with

    Since WinGate has such a flexible structure, there are countless other applications you can use WinGate to perform, from protection of vulnerable Internet services (such as extranet web servers or special purpose Internet accessible servers), to automated network administration with WinGate's smart DHCP server, to whatever else your imagination can come up with.

    If you can't figure out how to do it, or you find something that WinGate wont do, just let us know, and we will do our best to put it in the next version.

    WinGate's many features are unlocked with the GateKeeper remote management interface, which is used to configure WinGate and gives you a real time live view of the Internet activity on your network.

©2009 Qbik New Zealand Limited


Features of WinGate 6

The following features were added with the release of WinGate 6.0. For a list of bug fixes and other improvements that have been made specifically for this release of WinGate, please refer to the Release notes found in the WinGateInfo.html or readme.txt under the Startmenu\Programs entry for WinGate.

Mail Server enhancements

Several improvements to the WinGate Mail Server. These include:

  • The way domains are handled is now different. Configuration can now be made on a per domain basis, rather than one overall global level.
  • Added support to WinGate Mail for TLS connections (to send mail over an encrypted connection) and for authentication to mail servers. This can be configured on a server by server basis, so you can now set up trusted email networks between servers that support NTLM, CRAM-MD5 or SASL PLAIN Authentication.
  • POP3 collection has been added. You can now retrieve email from a number of POP3 accounts and deliver these to a defined email address.
  • Better handling of timeouts, retries and failure conditions in the Mail Server, as well as much improved sending performance – delivery is now much faster.
  • Sender based trust policies.

Combatting Spam

Several new enhancements have been added to WinGate Mail – specifically designed to combat spam. These include:

  • IP vs email domain verification, based on MX and PTR to A record lookups.
  • Optional blocking of numeric sender domains for untrusted senders.
  • Optional blocking of blank return-path for untrusted senders.
  • Attachment blocking.

WWW Proxy enhancements

A major overhaul has been undertaken on the WWW Proxy. New features include:

  • HTTP authentication by NTLM or HTTP Basic methods for proxy connections, TR intercepted connections, and server requests.
  • Support for HTTP/1.1 including keep-alives and chunking for proxy and server – this results in a great improvement in performance.
  • Improved Support for server-parsed CGI (e.g. PHP) in readiness for our Web mail product.
  • Server (Non-proxy) request handling based on Host tag matching.

WGIC improvements

Vast improvements to the WinGate Client application (known as WGIC). The main benefit of the WGIC is now the ability to centrally control whether applications that use networking are allowed to run or access the network. New features include:

  • Support for complete network-lockdown or even termination of an unauthorised application.
  • Support for centralised configuration management so administrators no longer need to configure settings on individual machines
  • Support for authentication and application control only (no redirection).
  • Separate installer (an MSI so it can be deployed remotely).

Integration with Windows user database

A number of enhancements to WinGate's user database integration with the NT OS users database. These include:

  • Greatly improved enumeration of large (12,000 plus) user databases on remote AD servers or domain controllers.
  • Improved control over when to synchronise with the OS user database.
  • GUI for specifying remote AD server or domain controller for synchronisation.
  • Support for plain-text authentication to a remote user database.

Terminal Services support

Added support for Terminal Services. Changes have been made to the engine to allow multiple user contexts per single IP address. This means WinGate users can now specify user-level access control and policies for their Terminal Services clients.

VPN connection authentication

The ability to authenticate incoming WinGate VPN connections against an NT / Active Directory database is now available.

System activity in GateKeeper

A new sub panel to the Activity window in GateKeeper, which shows system activity such as mail collection, mail delivery, etc.

IMAP4 Server

WinGate includes a full IMAP4 Server as an alternative to POP3 collection for clients.

Since all client email and client mail settings (such as folder layouts etc) are stored in on the IMAP4 server, it allows remote users to access their email through an IMAP4 mail client and see the same synchronised view, regardless of where they are connecting from.


What is WinGate ?

WinGate is an Internet connectivity server and firewall package that allows you to share available Internet connections on the WinGate server with an entire computer network. The Internet connection shared by WinGate can be of nearly any type, including dial-up modems, ISDN, xDSL, cable modems, satellite connections, or even dedicated T1 circuits.

WinGate allows multiple computers to share a single Internet connection simultaneously. This eliminates the need to add additional phone lines, Internet access accounts, modems, or expensive hardware. A home or business user can provide Internet access to an entire network with immediate cost savings.

WinGate also protects your internal network with its firewall. The WinGate firewall prevents intruders from accessing your internal network from the Internet by allowing only the traffic you specify to enter your LAN. WinGate can also be used on Intranets or company WAN's that have no Internet connection as security boundaries for each network.

Throughout the help file, it is assumed that the WinGate server will always have some form of Internet connection. This could be any Internet connection as mentioned above, or access to the Internet via a LAN gateway (such as through a DSL router).

Once installed WinGate's core is the WinGate Engine, which runs as a service and controls all of WinGate's functions. This engine provides the actual connectivity but is not visible to the user. Administrators have easy access and control of the WinGate Engine through the user friendly interface called GateKeeper.

WinGate sharing the Internet connection


Common terms

This help file uses certain terms frequently.

We recommended that you understand all the following terms. For further advanced explanations, see the Glossary section.

Term

Description

Windows service

Windows services are programs that run when a Windows computer is started. Since they run in the background, you cannot see services as a visible running program. Services are not closed when a user logs out, only when the computer is shut down. A common example is the program that allows your mouse to operate, the ‘mouse driver’.

WinGate Engine

This refers to the executable component of WinGate, which provides the actual server functionality (All of WinGate's service and functions that let you access the Internet).

You cannot see the engine running as it runs silently as a service. The WinGate Engine is configured via GateKeeper.

WinGate server

This is the computer where you installed the WinGate software. Your network accesses the Internet via this computer, so it needs a connection to the Internet.

Client computer

This is a computer on your network that is not connected to the Internet but gets its access via the WinGate server. Client computers are often referred to as workstations or WinGate clients.

GateKeeper

GateKeeper is the user interface that is used to configure the WinGate Engine which performs all WinGate functions. GateKeeper can also be used remotely for WinGate administration and authentication, but it is not required by WinGate clients to access the Internet.

License count

This is the maximum number of computers that are allowed to access the Internet via your WinGate server at any one time.

This number is 3, 6, 12, 25, 50, 100, 250,or 250+, depending on the license you purchase.

License type

This is either Standard, Professional, or Enterprise.

Client application

A client application is a program that helps you do something, such as read email or read WWW pages (e.g. Netscape, Eudora etc).

Server (application)

A computer or a program (often referred to as a Server application) running on a computer that provides a service (e.g. Email server, WWW server) often referred to as the Application server.

Proxy

A proxy is a program or service that does something for you on your behalf, an intermediary between client and server. Click here to read an overview on Proxies.

WinGate client

The term WinGate client refers to any workstation on the LAN behind the WinGate server that accesses the Internet via WinGate. WinGate clients can use one of three different methods to access the Internet through WinGate:

  1. NAT (Network Address Translation)
  2. The WinGate Internet Client (WGIC) software,
  3. Application Proxy (by configuring each application on the client machine to use WinGate as a proxy server (often referred to as the Application proxies method).

WGIC

WGIC stands for the WinGate Internet Client (WGIC) . It is a small application that can be installed on the client machine which communicates all Internet access requests to the Winsock Redirector Service using WRP (Winsock Redirection Protocol) in WinGate. This allows client applications to use the Internet as if they are directly connected, while their requests are handled by the Winsock Redirector Service.

NAT

Network Address Translation is light weight client connection method used by WinGate to provide Internet access for LAN clients. Click here to read about NAT

ENS

Extended Network Services provide NAT, routing and firewall features for WinGate using the Extended Network driver installed by WinGate.

TCP/IP

TCP/IP is a network protocol. Computers use this protocol to communicate with each other on a network. The main protocol in use on the Internet is TCP/IP.

DNS

Domain Name Service. This is a service that lets you look up a computer’s address on the Internet.

IP address

Internet Protocol address. Usually referred to as an IP. This is a computer’s address on a network. All your client computers need an IP address. The WinGate DHCP server will do this for you.

User

User accounts allow individual access restriction and monitoring. Any number of users can be added.

Groups

Groups are collections of users. WinGate allows nesting of groups.

Access rights

Rights can be assigned to individual users or groups.

Localhost

Localhost is a TCP/IP name used to refer to the computer you are using. Localhost is a computer’s way of referring to itself.

If you wish to use a service that is on the computer that you are using (e.g. logging on to WinGate for the first time) you use the name localhost. The address localhost is not included in the license count. The localhost IP address is always 127.0.0.1

Interface

An interface is a network connection, i.e. a way to connect to another computer e.g. a network card, a dialer profile, or your local loop back: localhost.

Binding

Binding a WinGate service to an interface causes that service to listen on that interface for client connection requests. The WinGate services default to ‘Bind to all internal interfaces’, which means they will automatically use any private IP addressed network interfaces it finds on the server.

ISP

Internet Service Provider. This is the company from who you obtain your Internet access.

WRP

Winsock Redirection Protocol. WRP is the protocol used by the WGIC and Winsock Redirector service to provide Winsock redirection services.

WRS

Winsock Redirector Service. This is the service in WinGate that provides Internet access control for WinGate clients running the WinGate Internet Client. (WGIC)


WinGate features

Feature

Description

ENS - Extended Network Support

Extended Network Support provides powerful Internet capabilities to users on your network with WinGate through the installation of the Extended Network driver.

The WinGate ENS enables the following:

  1. General purpose Internet sharing (NAT-based)
  2. Firewall and port security
  3. Multi-subnet bridging (Routing).

Transparent redirection

Transparent redirection allows all ENS and WGIC traffic to be sent to the appropriate proxy service allowing clients to receive the advantages of the proxy, such as caching and advanced access control, but still have the simple configuration and set up that comes with ENS and WGIC. This feature must be enabled on the Sessions configuration of the particular proxy service that you wish to have intercept client traffic. Transparent redirection is not available for all proxy services.

DNS server

The DNS server is a fully-functioning proxy, capable of dealing with any request from clients. It includes complete caching functionality, which greatly improves performance, and can read system configuration files, hosts and LM hosts. The WinGate DNS server integrates with the DHCP server to allow DNS resolution for computer names on your network.

Remote GateKeeper administration

WinGate can be configured and monitored from almost anywhere with GateKeeper (even from the Internet if you choose). GateKeeper communicates with WinGate over an encrypted TCP/IP connection. This is provided by the Remote Control Service that is available with a Pro or Enterprise license.

DHCP

DHCP automates the client network configuration for your entire LAN. With fully automatic or manual modes, the WinGate DHCP will configure IP numbers and DNS as well as large array of options for all your client computers.

GDP

Generic Discovery Protocol is a proprietary protocol for ‘discovering’ Internet connectivity servers such as WinGate. It is used in the WinGate Internet Client (WGIC) and GateKeeper for finding the WinGate server.

WinGate dialer

The WinGate dialer takes the chore out of maintaining the dialup Internet connection. Different ISP accounts can be configured, and access can be restricted by users, groups and other parameters.

Logging and History

All WinGate services will store key information in Log files named ‘ServiceName.log’ that can be found in the Program File\WinGate\Logs folder (these can be viewed with any text-editor).

WinGate Engine Monitor

The WinGate Engine Monitor runs in the system tray and tells you whether or not the WinGate engine is starting, started, stopping, or stopped.

Game playing through WinGate

WinGate supports most Internet games.

Security policies

Rights can be assigned to users for each service or on a global basis. Rights can be defined according to user/group, location, time of day, or advanced parameters of each particular request.

System messages/Logs

The WinGate System messages and the System log are features designed to assist the Administrator in diagnosing and fixing specific WinGate or general network problems.

Winsock Redirector Service

The Winsock Redirector Service provides control and Internet access services for clients that have the WinGate Internet Client installed, using WRP (Winsock Redirector Protocol). This allows these clients to make Internet requests as if they are directly connected to the Internet with no configuration of their applications required (Except for the simple installation of the WinGate Internet Client software).

All client Internet requests are sent to the Winsock Redirector Service for handling allowing for a central control for Administrators over client activity.

WWW Proxy

The WinGate WWW proxy is a HTTP/1.0 compliant caching HTTP proxy server. It supports HTTP requests, FTP requests, and SSL tunnelling. The WinGate WWW proxy is also a web server. Features include the ability to handle normal server requests in a variety of ways, which makes it a good front end to your existing WWW server or company Intranet, as it now has support for a variety of CGI executables, such as .php. The HTTP proxy also supports cascading through another proxy or SOCKS4 server.

Server requests capability

The server requests capability of many WinGate proxies allows other Internet servers to integrate seamlessly with WinGate, without conflicts or the need to use different port numbers. Any server request to a WinGate proxy can be piped to another server. This also allows WinGate to control access to other servers, which may not have the flexibility for access control that WinGate has.

SOCKS Server

The WinGate SOCKS server is SOCKS 4 and SOCKS 5 (RFC 1928) compliant. It supports RFC1929 authentication using the user accounts in the WinGate user database. The WinGate SOCKS server is HTTP aware. It can intercept HTTP requests and handle them with the built-in WinGate WWW proxy. This means that even your SOCKS users will enjoy the benefits of the WWW proxy (e.g. caching), and can be subject to the same security policies.

FTP Proxy

The FTP Proxy provides access to FTP servers. It uses the username@hostname method of firewall traversal. The FTP Proxy supports server requests. This allows the proxy to act as a front end to an FTP server, or to cascade through other proxies. All FTP traffic can be scanned using data-scanning plugins.

Telnet Proxy

The WinGate Telnet proxy provides access to telnet servers. The Telnet proxy in WinGate will support many telnet clients including Unix. Telnet also supports cascading. The Telnet proxy supports user login for further security.

RTSP Proxy

RTSP (Real Time Streaming Protocol) is used to transfer data with real time properties, like audio and video data. RealPlayer and Quicktime can be configured to use the RTSP proxy. The RTSP proxy manages the data transfer across the UDP sockets better than the NAT. The NAT tends to use a TCP connection to stream all data. In the case of real time data this means that more data than necessary is being transmitted. The proxy manages the UDP connections better simply because it has a better understanding of the RTSP protocol and therefore provides better performance.

Mapping proxies/Mapped links

TCP and UDP mapped links in WinGate provide generic connectivity for both TCP and UDP applications that do not support proxy protocols. Enhanced mapping allows mapped links based on user location or dialer profile. Mapping proxies for TCP support end-to-end encryption. This allows secure WinGate-to-WinGate connections over the Internet or LAN.

User database

The user database allows logging and auditing per individual user. Groups of users can be defined, and access rights can be assigned on a user or group basis. You can create nested groups (groups within groups) for even greater ease of user set up.

User management and authentication with NT/2000/XP/2003

WinGate integrates with NT user databases. This simplifies user management on an NT/2000/XP/2003(.Net) network and provides stronger NT-based authentication.

Ability to import users / export WinGate users

WinGate can import users and groups from other sources. The user database wizard enables the administrator to import or export users and groups information to and from text files. Users can also be imported and totally integrated with an existing Windows NT/2000/XP/.Net user database.

Secure WinGate authentication

WinGate provides multiple methods of secure user authentication.

Support for multiple interfaces

WinGate can make use of multiple Internet connections to give you wider bandwidth and faster access. Combinations of modems, ISDN and direct connections are configurable on a ‘per service’ level to give you full control and increased throughput.

VDOLive Proxy

This proxy enables all users on the LAN to enjoy live video using the streaming video player from VDONet Corporation. You need to ensure you have the proxy-capable version of the VDOLive player for this. Server request handling also allows you to run your own VDO server, for which WinGate can act as the front end.

Xing Streamworks Proxy

The XDMA proxy allows Xing Streamworks clients to operate on your network.

PPPoE Support for ENS

Extending upon the support of PPPoE within WinGate's existing proxy settings, WinGate (version 6.0 and above) supports these connections through NAT (Network Address Translation) while utilizing ENS (Extended Network Support). PPPoE connection types are used particularly by ISPs in Canada, Australia and Korea.

POP3 Proxy

The WinGate POP3 proxy allows access to POP3 servers on the Internet for retrieving email. As with the WWW and FTP proxies, the POP3 Proxy can act as a front end to your POP3 server, giving you a seamlessly integrated mail system. It can also be cascaded through other proxies. All POP traffic can be scanned using data-scanning plugins.

Data scanning plugins

  • PureSight for WinGate

    PureSight for WinGate is a content recognition filter that allows you to control the content of web pages that are accessed by your WinGate users. As an easy to configure plugin, PureSight for WinGate can intelligently classify the content of each web page requested through WinGate and allow or block it from being viewed depending on your requirements

  • Kaspersky AntiVirus for WinGate

    Kaspersky AntiVirus for WinGate has been designed as a plugin to provide seamless antivirus protection for WinGate services. With easy install and configuration, Kaspersky AntiVirus for WinGate can be set to scan all incoming web and mail traffic before it reaches the network providing a safe environment for all users on your LAN.

Proxy Auto-Configuration

WinGate supports automatic proxy configuration.

The feature is enabled on Internet Explorer by clicking:

Tools\Internet Options\ Connections tab, and then ticking Automatically Detect Settings checkbox.


What is a proxy server ?

The normal meaning of the word proxy is someone who does something on behalf of someone else, e.g. voting by proxy. The Internet use of the word has the same meaning but refers to a software program. WinGate does things on behalf of other software programs. Specifically, WinGate makes Internet requests to Internet servers on behalf of Internet clients.

The typical proxy server scenario :

A web browser accessing the Internet through a proxy server.

In this case, the web browser has been configured to work through a proxy server. In normal cases, this appears transparent to the user, as though the browser were communicating directly with a web server (which it is not).

  1. A web client connects to the WWW proxy server in WinGate.
  2. The client sends a proxy request to WinGate (e.g. ‘get me this URL’).
  3. WinGate interprets the request, and if it is allowed, connects to the server specified in the request.
  4. WinGate makes a modified request to the Web server, as if WinGate were the web browser itself.
  5. The server sends the file to WinGate .
  6. WinGate passes the file to the clients Web browser.

WinGate provides a range of proxy servers to provide proxy support for client applications. These are provided coverage for most client application requests such as HTTP, FTP, SOCKS etc.

The other proxies in WinGate work in much the same way; the client application submits a request to the service port of the proxy service (such as WWW on port 80), WinGate's WWW proxy service interprets and evaluates the request and performs it on behalf of the client, passing back any data to the client as necessary.

It is important to note that, when using the Internet through WinGate, at no time are you directly connected to any computer beyond your LAN. You may seem to have a connection to the Internet, but this is because WinGate is connecting out for you and passing data back to you. This means that in ALL circumstances, the computer wanting access to the Internet connects to the computer running WinGate (the WinGate server).

Some software can detect a proxy server automatically if instructed to do so. However, most other software require that you specify your proxy server IP address and port number. When you are using WinGate proxy server, you must specify the IP address and the port number of the WinGate server.

Note:

The WinGate Internet Client (WRP-based) and NAT (Network Address Translation) have decreased the importance of application proxies. You may still choose to use proxies to exert per-service control over policies, however the advent of transparent redirection means that there is nothing you can do with proxies that you now cannot do with the other two client connection methods.


What is Network Address Translation (NAT)?

When two computers are on a local area network (the same subnet), they have a direct connection to one another. This means that they can send data directly to one another. If the two computers are on different subnets then they no longer have a direct connection.

Something must forward the data between these subnets, and this is called a router (it can be hardware or software). This is the case whenever your computer is attempting to connect to another computer on the Internet (e.g. to view a web page).

NAT is a low-level approach to sharing an Internet connection. NAT stands for Network Address Translation. This works in a very similar fashion to a software router, whose job it is to forward packets between different subnets in a larger network (you can think of the Internet as a single very large multi-sub-netted network).

Routers know enough about the other subnets around them to enable them to forward packets to the right one, so that they will eventually reach their destinations. A NAT does this forwarding but with an important difference.

NAT is used to share a single public IP between multiple client computers, each with their own unique private IP addresses. When a client attempts to connect or send data to a machine on the Internet it forwards the data to the NAT.

The NAT then substitutes the original private IP in the packet sent from the client with its own. The remote computer sends packets back to the NAT computer (running WinGate), because they think that the WinGate server was the source of the data sent. NAT keeps a record of which computers sent packets on which ports, it is able to pass the incoming packets back to the correct computer.

NAT activity in GateKeeper

Client NAT activity in GateKeeper

Close

NAT performs the following tasks:

  • It changes the source IP address to be its own IP address. This means that data received by the remote PC looks like it originated from the computer running NAT.
  • It sends the data to the remote PC and remembers what port it used.
  • When data is received from the remote computer on this port, the data is forwarded to the client.

Client requirements

The requirements are minimal for client computers. Since default gateway support is part of TCP/IP. NAT simply acts as this gateway, and forwards data if it knows that it is destined for the Internet. Clients need only to have their default gateway configuration set to the IP address of the WinGate server.

Their DNS setting to allow for DNS lookups may be set to alternative DNS server on their network, or they can set it also to the WinGate server (This is done automatically if you use WinGate's DHCP server).

Does this mean that NAT will work for any application protocol?

NAT with transparent redirection can solve almost any Internet connectivity requirement. However from time to time applications are written is a way that prevents WinGate from providing Internet access. Updates about current application issues are available at http://forums.qbik.com

Can NAT support server applications?

In most circumstances NAT will support listening servers.

There are some requirements:

  • The running the server must have a static IP.
  • You must set up a port redirect on the Port Security configuration of ENS.

This will forward incoming connections to the server. This approach may not always work if multiple data connections are set up between server and client. Mapped links are a superior method.

Why is NAT faster than other connectivity approaches?

NAT is fast because NAT does so little. It rewrites a few fields in each packet of data, and remembers a table of port mappings. Other methods have to do much more work.

What transport protocols does NAT work with?

The NAT is designed to read the information in IP packets only. This means that it supports the IP related protocols such as TCP, UDP and ICMP.


WinGate Engine

The WinGate Engine runs as a Windows service and operates all of the functionality that WinGate provides.

Since it runs as a service, it will start when the computer is started (unless configured not to).

The WinGate Engine itself is not configurable, but you can configure all of its functions using GateKeeper.

The WinGate Engine monitor, which runs in the systray, provides a real time indication of the WinGate Engine's current status.

You can also configure the stop and start settings of the WinGate Engine service from the services section of Computer Management mmc in the Windows operating system.

It is listed as the Qbik WinGate Engine service.

Note:

The only time you will need to adjust how the WinGate engine service runs is when using Remote user database option in an Active Directory.

Click here for details on configuring WinGate Engine in an Active Directory.


WinGate Engine Monitor

The WinGate Engine Monitor is an application that runs in the Windows system tray.

It will be configured to load automatically when Windows starts up.

The purpose of the WinGate Engine Monitor is to tell you whether the WinGate Engine is currently in stopped or started mode. When the engine is stopped WinGate will not be working (and you will not be able to share an Internet connection with client computers).

WinGate Engine running The WinGate Engine is started and running.

WinGate Engine stopped The WinGate Engine is stopped.

WinGate Engine starting/stopping The WinGate Engine is in the process of starting or stopping.

WinGate Engine system message waiting There is a system message waiting.

Right clicking the WinGate Engine Monitor icon will open a menu, which allows you to:


GateKeeper overview

GateKeeper is the graphic user interface that is used to control and configure the WinGate Engine.

It communicates with the WinGate engine over an encrypted TCP/IP link, for all configuration, monitoring, and control. As a result GateKeeper is not required to be open for the WinGate engine to serve requests for clients on the network.

Close

Although GateKeeper is used for configuration, it is not essential for Internet access, as clients do not have to use GateKeeper itself to access the Internet.

GateKeeper can be used for administration and authentication of users on any computer with a TCP/IP connection to the WinGate server. This can be the WinGate server, or with a copied GateKeeper.exe used remotely from another machine on your network, or the Internet if configured to.

GateKeeper consists of a menu bar and two main sections:

  1. GateKeeper Control Panel
  2. Activity panels

These panels allow GateKeeper to be reasonably flexible in its layout configuration allowing for resizing and repositioning of the two panels depending on your viewing requirements.


GateKeeper logon

When you open GateKeeper you will be presented with the Online Options dialog.

GateKeeper - Online Options dialog

Close | Close all images

Account details

Username

This should be a valid user in use by WinGate that is allowed to logon.

Password

Enter a valid password for the user. You will need to make sure this blank in order to log in for the first time.

checkbox Use current Windows login

This option is only available if you are using the Operating System (Windows) Database option on the server. Enabling this option allows you to logon automatically, as WinGate will use your current Windows/NT username and password login details.

WinGate location

Server

This allows you to enter the IP address of the WinGate server you are attempting to log on to.

Port

This is the port used by the Remote Control Service (RCS) in WinGate which controls access to GateKeeper (by default RCP uses port 808).

checkbox Log on to Local machine

If this option is enabled, logon will be to localhost. (i.e. Logging on at the actual WinGate server GateKeeper).

checkbox Use these details next time to login directly

If you select this option, you will not be prompted for login details next time you log in.

Logging in to GateKeeper for the first time:

  1. Open GateKeeper.
  2. In the Online Options dialog, make sure Administrator is entered in the Username box.
  3. Leave the password blank and click OK.

  4. You will be warned that no password has been set for the administrator, and will prompted to change your password.

    Assign password dialog

    Close | Close all images

  5. Click OK to bring up the Set Administrator Password dialog.

    Set Administrator Password dialog

    Close | Close all images

  6. Enter your password and click OK.
  7. You should now be logged into GateKeeper as Administrator.

Note:

If the Use Operating system (Windows) database option is selected in the installation, then you will not be asked to change your password.

In this case logging on with the user Administrator for the first time should be with the relevant NT/Operating system password for Administrator.

Please Note:

Remote GateKeeper access is available only if you are running a WinGate Pro or Enterprise key (regardless of version).

©2009 Qbik New Zealand Limited


GateKeeper Control Panel

The GateKeeper Control Panel is made up of three tabs:

GateKeeper Control Panel

Close

Tab | Description
System tab | This is where you can find and configure WinGate's system services such as DHCP, DNS, Mail etc.
Services tab | All WinGate users services (proxy servers) are found and configured from this tab.
Users tab | All User, Group, Database, and System Policy options are configured on this tab.

The GateKeeper Control Panel is removable.

To detach the GateKeeper Control Panel from the main GateKeeper:

  1. Left-click (and hold) with the mouse pointer on the edge of the GateKeeper Control Panel.
  2. Drag to a space on the desktop.
  3. It can be returned to the rest of the GateKeeper config by double clicking anywhere along the edge of the GateKeeper Control Panel.


GateKeeper activity icons

There are a variety of different icons/symbols used by WinGate to indicate various actions taking place on the Activity tab in GateKeeper.

All icons in the Activity screen indicate client sessions of various natures. These appear while sessions are active, and will disappear when a session is finished.

Data sessions

A data session is an instance of any proxy or service use. A data session will always show as being from a computer (NetBIOS name or IP) and if authenticated the user name of the person on the client machine (or Guest).

  • Proxy request (or NAT/WGIC Request with the transparent proxy turned on)

    When a client is accessing the Internet using the Application proxies method, or when a clients NAT or WGIC request is being intercepted by the transparent proxy, the activity will show up on the Activity screen like this:

    Client proxy (or transparent proxy) activity

  • NAT

    When a client is accessing the Internet using NAT their activity will show up in the Activity screen like this:

    Client NAT activity

  • Winsock Redirector Service(WinGate Internet Client (WGIC) connection)

    When a client running WGIC is accessing the Internet, the session is controlled by the Winsock Redirector Service in WinGate and will show up on the Activity screen like this:

    Client WGIC activity

User status/authentication

When a user attempts to access the Internet through WinGate they will appear in the Activity screen in WinGate with various different icons and details, depending on what type of authentication they are using to validate their credentials through WinGate.

  • WinGate user database

    When a user is authenticated against the WinGate user database they will appear in the Activity screen like this:

    Authenticated against the WinGate user database

  • Operating System/Remote user database

    When a user is authenticated against the Operating System /Remote user database using NTLM they will appear in the Activity screen like this:

    Authenticated against the Operating System / Remote user database (NTLM)

  • GateKeeper

    When a user logs on or is authenticated in WinGate using GateKeeper.exe they will appear in the Activity screen like this:

    User logged into GateKeeper

  • Java client session

    When a user has used Java authentication their activity will show up in GateKeeper like this:

    User authenticated via Java logon

  • Assumed user

    When a user who has had a location assumption configured in WinGate, accesses the Internet they will appear in the Activity screen like this:

Miscellaneous

  • Computer

    A computer using WinGate

    The computer icon indicates any computer that is using WinGate. Beside the icon is the computer name (NetBIOS) the user is connecting from (if known), or the IP address of the connecting machine.

  • Session complete

    Session complete (User assumed)

    Once a user has ended their Internet connection session, their connection will remain as a grey icon for thirty seconds in the Activity screen after they have disconnected. The word Assumed will be displayed beside their name.


GateKeeper menus

The menus at the top of GateKeeper provide a range of shortcuts to GateKeeper screens:

  • File

    Close | Close all images

    Go Online/Offline mode, Save Changes, Shutdown WinGate Engine.

  • View

    Close | Close all images

    Shortcuts for displaying each different activity panel in GateKeeper. At the bottom are various options for preferences in GateKeepers appearance.

  • Options

    Close | Close all images

    Online config, Advanced settings, History Settings, Quarantine options, Plugins, Change Password dialog, Auto Save Changes (on/off).

  • Help

    Close | Close all images

    Access to WinGate help, License Management, AutoUpdate, and Check Version.

Menu bar

On the Menu bar are icons that allows easy access to common functions:

GateKeeper menu bar

Close | Close all images

  • Go Online

    Used to bring up GateKeeper interface. This option is only active when GateKeeper is Offline.

  • Go Offline

    Used to take the GateKeeper off line.(In Offline mode the WinGate Engine still runs providing services/Internet access to clients, but GateKeeper does not provide a interface to allow configuration).

    Close | Close all images

  • Save

    Saves the current WinGate settings.

  • Control

    Re-opens the GateKeeper Control Panel in its last position if closed.

  • Plugins

    Access to the Plugin configuration menu.

  • Help

    Access to the WinGate help file.


Administering WinGate

All aspects of WinGate operations can be administered through GateKeeper when a user logs into GateKeeper as the Administrator, or as user who is a member of the Administrators group.

All configuration and alteration to services, and system functions can only be carried out by using GateKeeper, as the WinGate Engine is not configurable directly.

Note:

Some features of WinGate will require the WinGate Engine to be restarted, so Administrators should be aware of the effect that these changes will have on network operations.

  • Real time administration

    Since the data sessions are shown dynamically on the Activity tab in GateKeeper, administrators can right click on sessions/logged in users etc to perform a variety of actions.

    Click here for details on the available Action Menu.

  • Remote administration

    Administrators can also perform most administrational tasks remotely via a remote connection with GateKeeper. This can be done by mapping a drive to the WinGate directory on the WinGate server and running the GateKeeper exe.

    See the section Remote administration with GateKeeper for instructions on how to do this.


Administration in the Activity tab

Administration on the Activity tab

Right clicking on the active sessions in the Activity tab opens a context-sensitive menu, which allows a variety of administrative actions to be performed.

Close

Action

Description

Pause activity updates

This option allows administrators to freeze the display of activities in the activity screen.

View by Service

This default option displays all the activities grouped by service name. It only appears as a selection item when the View by Machine option is currently selected.

View by Machine

This option displays all the activities grouped by computer. It is the default selection and only appears as a selection item when the View by Service option is currently selected.

Stop (Service)

This option allows the administrator to stop the particular WinGate service that the client is trying to use

Note:

Stopping the Remote Control Service makes GateKeeper inaccessible from any user who is accessing via a remote GateKeeper Login.

Service properties

Another way to view the properties for this service.

Send Message to USER:

Selecting this will allow you to send a message to any user logged on with GateKeeper. The user can reply with the reply button.

Disable user:

Denies the user from authenticating, or accessing the Internet through WinGate.

Properties for user:

Allows configuration of the User's properties.

Copy URL to clipboard

This option allows the Administrator to copy the selected URL from the activity screen into the clipboard. Pasting this URL into a browser will show the Administrator that page or resource.

Terminate all sessions on...

This option will terminate the current activity of a user/machine as it is displayed on the Activity tab. It will not however, stop or block the client from attempting to reconnect to the Internet after their current session has been terminated.

Ban Server...

Selecting this option will place the specified site into the Ban List in the WinGate System policies.

Blackhole IP...

This option allows for an administrator to add the specified IP address to the WinGate IP Blackhole list found in the ENS configuration on the System tab in GateKeeper.

Properties

This option displays several properties and connection details of the computer selected.


Remote administration with GateKeeper

It is possible in WinGate to access GateKeeper remotely for administrational purposes.

To use GateKeeper remotely:

  1. Login to GateKeeper on the actual WinGate server.
  2. Open the Remote Control Service on the System tab of the GateKeeper Control Panel.

  3. Open the Bindings configuration.

    Remote Control Service - Bindings configuration

    Close | Close all images

  4. Check to see that the localhost (127.0.0.1) and the LAN network interface (that clients will be connecting to the Remote Control Service on) are enabled in the Binding Policy pane.
  5. Copy GateKeeper.exe from the WinGate server \WinGate installation directory to a location on the remote machine.
  6. On the remote machine open the newly copied GateKeeper.exe

  7. Enter the following information when logging on:

    Close | Close all images

    • Username

      A WinGate Administrator account (not Windows unless using Operating System (Windows) user database).

    • Password

      The password for the Administrator account entered.

    • Server

      The network name or IP address of the computer that WinGate is running on.

    • Port

      This will always be Port 808 (unless you explicitly change the port that the Remote Control Service runs on).

Note:

In order for the Administrator to view the History tab via a remote GateKeeper session:

On the remote machine they are connecting from they will need to:

  1. Map a network drive to the \WinGate directory on the WinGate server.
  2. Double click on the GateKeeper.exe inside the Mapped network drive (WinGate).
  3. Enter the login details as you would accessing GateKeeper via remote control session, entering the appropriate IP address of the WinGate server etc.


Activity panels

The Activity panels in GateKeeper provide an instant real time window into WinGate's most important activities.

Close

The Activity panels consist of:

Panel | Description
Activity | The Activity tab provides a real time activity view of user/machine sessions with details and a system process activity window. An administrator can use this screen to monitor and delete any current session.
Network | The Network tab provides navigation of local network and WinGate VPN connections. The lower Network Connections pane shows all network connections (interfaces) discovered by WinGate.
Mail Queue | The Mail Queue tab provides graphical reporting of the status of Domain mail queues complete with built in email previewer.
History | The History tab gives real time history reporting of activities/events in WinGate.
System Messages | The System Messages tab provides system message viewer to alert administrators of various system events.
Firewall | The Firewall tab shows real time activity in the WinGate firewall allowing you to see intruder attempts and incoming connections.
Quarantine | The Quarantine tab reports items captured and quarantined by WinGate's optional data scanning plugins.
Remote Command Shell | The Remote command shell allows users to run multiple copies of the windows NT/2000/XP command interpreter (cmd.exe) in any defined user context on the WinGate server machine.


Activity tab

The Activity tab in GateKeeper shows all current user activity occurring in WinGate. It allows administrators to get real time insight into current user activities.

Close

Client connections

Each user that connects to WinGate to access the Internet, or to log into GateKeeper for administration purposes will appear in the Activity tab.

The Computer name or IP of the machine they are connecting from will be listed. Next to this will be listed the username and (in brackets) their security status. Their security status will show if they have been authenticated (if required to by policies set in WinGate), and show what type of authentication has been used (WinGate or NTLM).

Once a client has logged out of their session, WinGate will display the status of their connection in grey as assumed for thirty seconds before it will disappear completely from the Activity tab.

Sessions

Client sessions in the Activity tab are displayed dynamically as they occur. As each session completes, they will disappear from the screen.

Current sessions are shown in real time either by machine, or by service being used (selected by right clicking in the Activity tab and selecting the View by machine/service option from the Action menu).

Clicking on the History Tab will display all WinGate sessions that have occurred during the current logon. Viewing the log files of a particular service will provide more details on the sessions that have terminated. Anyone with activity delete rights (e.g. Administrators) can delete any session on the activity screen.

Data sessions

Any data session can be terminated by selecting the Terminate Session option from the action administration menu. This will not affect any other activity for that user. This is useful if a session has hung, or you do not like what the user is doing.

Remote control login

If this is terminated, the user will lose their authenticated state, and revert to an assumed user (if they still have any other sessions open or there is a location mapping for them), or Guest.

User entries

Deleting a user entry will cause all the sessions of the associated IP address to be terminated, and they will disappear from the activity screen. If their computer keeps requesting access, they will reappear as a guest or an assumed user.

Click here for information on the various icons in the GateKeeper Activity screen

Action menu

An easy access administration menu is available by right clicking on a user or computer name on the Activity tab.

Click here to read about the Action menu in the Activity screen


Network tab

The Network tab in GateKeeper, divides the screen between the machine’s Local Network (LAN) , and the Remote Networks which are made available by the WinGate VPN.

Close

Even without WinGate VPN installed, the Network tab will display the topology of the Local Network on which the WinGate server is situated. The Local Network window will become populated under the Microsoft Network section with any machine names discovered around the LAN. As is common with NetBIOS enumeration this may take some time for these machines to appear.

Right clicking on any particular machine (once they appear), in either the Local or Remote Networks window gives you up to four options:

  1. Open

    This opens the specific machine.

  2. Explore

    This opens the specific machine and connected network.

  3. Retest

    This retests the connectivity to a specific computer.(This option is used to test connectivity behind the WinGate VPN).

  4. Properties

    This allows you to view the simple network properties of the particular machine.

The Network Connections pane located at the bottom of the Network tab shows the network connections that WinGate has discovered operating on the machine.

Click here to read more on Network Connections pane


Mail Queue tab

The Mail Queue tab shows a real time display of the current mail queued to be processed by the WinGate Mail server.

Mail Queue tab

Close

Note:

Only mail queued to be sent by WinGate Mail server will be displayed. Mail that is actually in the process of being sent will be displayed in the Activity tab.

The Mail Queue tab consists of three panes:

  1. Current domain jobs

    This pane displays the lists the status of all mail currently in the queued for delivery for each domain managed by the WinGate Mail server.

    • Abort

      Highlighting a particular mail job and clicking this button will make WinGate Mail server abort sending this mail.

    • Send Now

      Highlighting a particular mail job and clicking this button will force the mail queued for the selected Domain to be sent immediately.

    • Retry all

      This will attempt to resend all mail in each Domain queue regardless of its current status.

  2. Queued messages

    When a Domain mail list is clicked in the Current domain jobs pane, all individual mail messages queued for that domain will be listed.

    • Delete

      This will delete the selected mail message.

    • Bounce

      This will bounce the selected mail message(s) sending them back to the original sender (if no sender is found, or set, then this message will be trashed).

  3. Preview message

    This pane allows administrators to view the contents of the selected mail.

Please Note:

The Mail Queue is only available to WinGate version 6 or later.

©2009 Qbik New Zealand Limited


History tab

The History tab displays selected information from the real time history database.

Close

Right clicking on the History tab opens a context-sensitive menu with the following options:

Menu Item

Description

Edit Columns

To select which columns you want to display in the History tab.

Clear History

To permanently delete all History records.

Blackhole IP

To ban a particular IP from accessing WinGate. (Click here to learn more)

Properties

Opens the settings configuration for WinGate history.

Save History

Open a Save As window to save the history in a text file.

Notes:

  • Previous session history is available in GateKeeper if you are logged in to localhost.
  • Sessions are displayed in the order in which they terminated, oldest at the bottom of the screen. DNS requests are very fast due to DNS caching and usually display duration of 0 seconds.
  • If your system crashes, the database may have become corrupted. If GateKeeper does not seem to be able to log in even though the engine is running, this may be the problem. If you think this is the case, then stop WinGate, back up the two database files and remove them from the WinGate directory. Restart WinGate. If GateKeeper then works, database corruption was the problem. If not, put the files back in the directory.
  • In order to view the History database through a remote control session of GateKeeper, you need to map a network drive to the \WinGate directory on the WinGate server. The GateKeeper.exe should be activated from here (the Mapped drive) for administrators to log into the WinGate server and view the History.

Click here to read about history settings


System Messages tab

The System Messages tab found in GateKeeper, is designed to assist WinGate administrators with diagnosing and fixing network related problems. It is also used to notify administrators of any key events that occur such as new plug-ins found, a license change, a system event etc.

System Messages tab

Close

Messages are assigned an icon, which denotes the type of message they are:

Any problem that may prevent a WinGate service from starting up or operating properly.

A notification of an event.

A notification of an attempted security violation.

Authentication failure.

How to enable System messages

System messages are always enabled and will be shown to anyone who is a member of the Administrators group.

The System Messages tab can be accessed from the View menu at the top of GateKeeper and selecting the System Messages tab option).

When a system log event is generated it will be queued and sent to either:

  • ALL online administrators (i.e. All administrators currently logged into GateKeeper)
  • If none are online, the next administrator to logon to WinGate.

Note : Message limits

Some events may cause large numbers of system messages to be generated (e.g. security violations notice caused by a SPM attack). The WinGate Engine will queue a maximum of 200 messages (with old messages being discarded).

GateKeeper will display a maximum of 1000 system messages (with old messages being discarded).

Click here for a detailed list of WinGate System messages


Firewall tab

The Firewall tab allows Administrators to see in real time, intrusion attempts to their network through the Internet connection.

Close

Due to the architecture of WinGate, all computers on the network are protected from direct Internet contact or attack because the WinGate firewall acts as a shield.

The WinGate firewall controls all packets that are allowed through or denied by the server, securing the entire network from the main entry point.

Information displayed on the Firewall tab will include:

Information

Description

Time

The time the data was detected on the network.

Source IP

The IP of the machine requesting/directing the data.

Port

The number of the port the data entered the network on.

Dest IP

The IP of the machine the data is destined for.

Protocol

Whether the data is travelling the network using the TCP or UDP protocol.

Info

More information about the nature of the data.

Click here to read more about the WinGate firewall


Quarantine tab

When WinGate’s data scanning plugins detect inappropriate data (e.g. a virus), it needs to be either thrown away or stored in a safe place. Quarantining is the safe storage option.

When a file is quarantined, the Quarantine tab will display as much information about the file as possible.

Close

This information will include:

Information

Description

Time

The exact time the data was detected by the plugin.

Computer

The name of the computer on the network the data was detected on.

WG User

The name of the user logged in on the computer the data was detected on.

IP Address

The IP address the user was using at the time.

ID

This is the number WinGate assigns to the detected data.

State

Either ‘Retain’ (i.e. keep the data quarantined), or ‘Release’ (i.e. allow the data to proceed across the network – only to be selected if you find out the data is benign)

Size

File size in KBs

Source

Where the data entered the network e.g. FTP Proxy, WWW Proxy, etc.

Context

Summary description of the virus scanning event.

Reason

Why the file was placed in quarantine (this may include the name of a virus found).

The files are stored in the WinGate\Quarantine directory.

If an Administrator releases a file through the GateKeeper interface, the file is flagged as 'released '. This means that a user is allowed a file again.

The file is copied to the WinGate\Quarantine\Release\"Source"\"Context" directory.

e.g.

If a file called virus.exe is downloaded from ftp://bad.server.com/nasty/virus.exe through the FTP proxy, it will be released to WinGate\Quarantine\Release\FTPProxy\nasty\virus.exe

The administrator is responsible for returning the file to the user. The exception to this is email. If an email is quarantined from SMTP, after being released by the administrator, the email will be automatically reinserted into the email system and delivered to the intended recipient.

Click here to read about the quarantine properties


Remote command shell

Accessed through GateKeeper the Remote command shell allows users to run multiple copies of the windows NT/2000/XP command interpreter (cmd.exe) in any defined user context on the WinGate server machine.

Remote command shell tab

Close | Close all images

Similar to a telnet server, yet more secure, since all communications are made via the encrypted channel used by GateKeeper when it communicates with the WinGate Engine. This remote command shell allows users to execute console applications on the WinGate server.

This is useful for tasks such as:

  • Using ping and tracert to check basic connectivity from the WinGate machine.
  • Running route.exe to view or modify the system route table.
  • Running ipconfig.exe to renew or release adapter addresses, and get TCP/IP configuration information.
  • Running ps.exe (part of the posix resource kit for Windows) to view and terminate running processes.
  • Using net.exe to browse networks, map drives etc.
  • Running shutdown.exe to reboot the WinGate server, or remote machines.

In short, almost anything you can do by running the cmd.exe on the WinGate server, but accessible remotely.

To use the Remote command shell:

  1. Choose Command Shell from the View menu at the top of GateKeeper.

  2. This will bring up a Login dialog. Use this to specify the Windows user account on the WinGate machine (regardless of whether WinGate itself is using the Windows user database or the WinGate one) that will be used to launch cmd.exe by WinGate.

    Command Shell login

    Close | Close all images

Limitations :

  • This feature is only available to WinGate (version 6.0 and above) when using a Professional or Enterprise license, or to users of WinGate VPN.
  • Some console applications which launch their own console window do not currently work with this feature, notably telnet.exe, and ftp.exe.


Network interfaces

When using WinGate the term network interface is used to refer network connections that exist on the WinGate server.

These can be:

  • Hardware based network interfaces in the Operating System such as Ethernet cards, wireless adapters, ISDN, T1 etc.
  • Software based network connections that have been configured in Windows such as dialup profiles, Microsoft VPN connections etc.

Generally network interfaces will show up as network connections in the operating system and will be listed by WinGate in the Network Connections pane at the bottom of the Network tab in GateKeeper.

Network interfaces are essential to the way that WinGate operates, and as such with version 6.0 and above WinGate now has the ability to automatically discover any available network interfaces on the machine where it is installed.

Network interface usage

When it discovers an available network interface, WinGate will automatically try to determine the type of network that the interface is connected to based on the IP address details on the interface. This allows WinGate to determine the usage of the interface for the purpose of handling client Internet requests.

There are three different types of network interface usage that WinGate automatically try to set:

  1. Internal protected network

    If the network interface has a private class IP address, then WinGate will consider the interface as being safe. e.g. this adapter connects to the LAN.

  2. External untrusted network

    If the network interface has a public IP address then WinGate will see it as an Internet connection as it considers the Internet (an untrusted network).

  3. External secure network

    This classification is for interfaces that are part of a DMZ (Demilitarized Zone).

    Please Note:

    DMZ support is only available only to WinGate 6 Pro and Enterprise licenses.

You can set the usage of each network interface manually by clicking on the appropriate network interface in the Network connections pane of the Network tab in GateKeeper (This will bring up the WinGate specific properties of the network interface). But be aware that the usage classification of the network interface is important to way that WinGate handles all traffic so be careful of the usage type you assign to a network interface.

Click here to read more about the Network connections configuration in WinGate

Bindings

When the usage of an network interface has been determined, WinGate will automatically bind User services (it's proxy servers) to network interfaces listed marked as Internal in order to accept and service Internet requests from clients on the local network. Network interfaces marked as External will not be bound to these services automatically (for obvious security reasons).

Alternatively you can manually specify the desired network interface/Proxy server binding policy in the Binding configuration of each service you wish to configure.

Click here to read more on Bindings in WinGate

Firewall

The WinGate firewall uses the network interface usage classification to assist in determining how it should handle traffic received on each network interface. It plays a very important role in determining which connections can be trusted, and which are deemed insecure.

Click here to read more about the WinGate firewall


Network Connections pane

The Network Connections pane found at the bottom of the Network tab, gives WinGate the ability to automatically detect any network interface that becomes available.

Network Connections pane

Close

Network connections are central to the correct functionality of WinGate. From WinGate 6.0 onwards network interfaces are automatically detected by the WinGate Engine.

Click here to read about how WinGate uses network interfaces

Once the engine is started it examines the IP address details of any network interfaces it finds and determines from these details whether the interface is connected to a Local internal network or to a Public untrusted external network, such as the Internet. WinGate classifies this under the Usage heading of the interface in the Network connections configuration. WinGate will use these details to automatically determine what Binding policies it will implement (i.e. what Services it will bind the network interface to) and how it will implement security for the WinGate firewall.

Name

This is the name given to the network connection by the Operating system. (You can configure this name via the properties for the network interface found in the Operating system).

Type

WinGate distinguishes between whether the interface is a network interface type connection or whether it is a dialup type connection.

Status

This field indicates the current status of the network adapter, whether it is enabled or disabled. This will be updated dynamically as the changes to the network connection occur. (You can enable or disable the network connection via the network properties for the interface in the Operating system.)

Usage

As mentioned above WinGate will automatically classify the Usage (i.e. what type of network the interface is connected to) depending on what IP address details have been set on this network connection. This is used by WinGate for the purpose of Dynamic binding policies for services and the WinGate firewall. You can set what type of usage the connection has manually by selecting an option from the General tab of the network connection properties in WinGate.

Speed

Indicates the speed of the connection.

Device Name

This field contains the make and model details of the interface for easy reference.

Network Connection properties

Double clicking on a particular network connection in the Network connections window will bring up WinGate specific properties for the interface.


Network Connection properties

Double clicking on a particular network connection in the Network connections pane on the Network tab in GateKeeper, will bring up WinGate specific properties for the network connection:

Network Connections pane

Close | Close all images

  1. General tab

    The general tab provides connection speed and the opportunity for Administrators to select the purpose of the interface (Network adapter). Setting the purpose of the connection on this tab will determine the status of the Usage field in the Network connections window.

    Network connections - General tab

    Close | Close all images

    • Auto detect (based on IP address details)
    • An internal protected network
    • An external untrusted network (e.g. the Internet)
    • A secured external network (e.g. DMZ)

    Click here to read about how WinGate handles the different network interface connection types

    Please Note:

    DMZ support is only available only to WinGate 6 Pro and Enterprise licenses.

  2. Details tab

    This tab lists a variety of network information about the specific interface.

    Network connections - Details tab

    Close | Close all images

  3. Performance tab

    The Performance tab allows the system administrator to see at a glance exactly how much activity there is over the network interface at any given time.

    Network connections - Performance tab

    Close | Close all images

    • Auto

      Checking the Auto radio button scales the monitor so that the point of the most activity across the network interface (i.e. the most Kbps or kilobits per second) is the upper point of the monitor’s scale.

    • Kbps

      Checking this radio button lets you set the monitor’s scale manually by moving the slider bar up and down.

      Moving the bar up decreases the number on the Kbps indicator, allowing a ‘closer’ look at the data.

      Sliding the bar down does just the opposite, moving the indicator closer to its maximum of 1250 Kbps for a ‘long view’ at the data.

  4. Advanced tab

    Here administrators can set advanced options for the interface.

    Network connections - Advanced tab

    Close | Close all images

    checkbox Override interface MTU (Maximum Transmission Unit)

    Here you can set the Maximum Transmission Unit size that can be sent out from this interface.

    This is helpful when experiencing packet loss and issues with VPN resource access.

    checkbox Override interface metric

    Here you can set a routing metric for the interface that will override the routing metric that is set on the interface automatically by the operating system.

    The values are 0 - 50 (0 is given as a value to allow you to set the lowest possible metric, since the lowest interface metric the operating system will use is 1)

    checkbox Enable ARP responder

    When this network connection receives an ARP request for an IP address that is not its own, the interface will send its own MAC address as a response.

    This setting allows you to configure IP addresses that this interface will return its MAC address for when requested.

    Please Note:

    ARP responder support is only available with WinGate 6 Enterprise licenses.

    SSL Bindings per service is only available to WinGate 6 Enterprise licenses.


Bindings configuration

The Bindings configuration found in the properties of each System and User service is central to the security and operation of all WinGate services.

Close | Close all images

What are Bindings ?

When a client attempts to make an Internet connection through WinGate, the application that they are using will communicate with the particular service that is responsible for dealing with these requests in WinGate.

e.g.

A client wants to open a web page with their browser and so connects to the WWW proxy service in WinGate so that WinGate can serve the request.

For a WinGate service to be able to handle a request from a client computer, it must be configured to listen for these requests on the network interface that will receive the request. Generally this will be the LAN interface (although it can be configured to accept on any interface that is available).

Once the request has been received on the an internal (LAN) interface from a WinGate client on the LAN, then WinGate will automatically use any network interface that has it's usage marked as External to access the Internet to fulfil the client request.

As such Internet connections should not be bound to a service (unless you want remote Internet users to use WinGate's proxy services. Not recommended).

If a service is not bound to an interface, then the client will not be able to make a connection (as WinGate wont be listening). On most LANs, you will want your WWW proxy service in WinGate to only be accessible to the people on your network. Simply select the Bindings configuration in the WWW proxy service and ensure that your LAN card (internal adapter) and localhost (127.0.0.1) are the only items listed and enabled in the Binding Policy window.

Note:

Without a binding to 127.0.0.1(localhost), the local computer cannot use that service.

Dynamic Bindings

With WinGate 6.0 and above, WinGate will automatically identify any network interfaces as they become available on the WinGate server.

Based on what IP details the interfaces have, WinGate will automatically attempt to determine what type of interface they are:

  • Internal adapter

    Usually a LAN interface with private class address set and so is deemed to be trusted by WinGate.

  • External adapter

    Usually the Internet connection, or the adapter that has a public IP address assigned to it and so not trusted by WinGate.

You can set how WinGate will classify each network connection on the General tab of the WinGate specific properties for each network interface. The WinGate specific properties can be accessed by double clicking on a network connection in the Network Connections pane at the bottom of the Network tab in GateKeeper.

Network Connections pane

Close | Close all images

Binding a service to an interface manually

You can set the bindings policy for a service manually by:

  1. Open GateKeeper.
  2. Open the appropriate User/System service. (in this example it will be the WWW proxy service)

  3. Select the Bindings configuration.

    Close | Close all images

  4. Click the Add button. This will bring up the Dynamic Binding Policy dialog.

    Dynamic Binding Policy dialog

    Close | Close all images

  5. Select the Any Internal Adapter checkbox. Selecting this policy option will allow the WWW proxy service to bind to any internal adapter that WinGate has discovered. Alternatively you can select the checkbox of a specific interface that is listed that you wish to bind to the WWW Proxy service.
  6. Click OK to add the Dynamic binding policy to the Bindings configuration.

  7. On the Bindings configuration of the WWW Proxy service check to see that the policy is present in the Binding Policy pane and that the interface is now listed in the Adapter pane.

    Close | Close all images

  8. Click OK to exit the WWW Proxy service.

Typical binding suggestions:

  • Allow binding to only your LAN addresses for WinGate user services.
  • After installing WinGate or changing Network adapter/settings, check that WinGate has classified the correct usage status for your network adapters and services are bound correctly. The Usage for a network interface can be found and set in the Network Connections pane at the bottom of the Network tab in GateKeeper.

Security tips:

For the best security, only bind each service to your LAN card and localhost. Don’t allow any bindings to dialer profiles.

Be extremely careful when binding External interfaces to a service, as this will potentially allow external access to the WinGate service.


Dynamic Binding Policies

In order for clients on the local network to access the services offered by WinGate, the various User and System services in WinGate have to be bound to the network interface that will receive client Internet requests from (Usually the LAN adapter).

Binding the service to an interface will make the service listen for client requests. (e.g. the WWW proxy service listens for client Internet requests on port 80.)

From version 6.0 onwards WinGate can dynamically detect any new network interfaces that become available for it to use. Based on the IP address details of each interface WinGate decides what type of network each interface connects to and as a result determines the appropriate type of Usage role that interface will perform for WinGate.

There are three main types of usage that WinGate has for network connections:

  1. Internal protected network

    If the network interface has a private class IP address, then WinGate will consider the interface as being safe. e.g. this adapter connects to the LAN.

  2. External untrusted network

    If the network interface has a public IP address then WinGate will see it as an Internet connection as it considers the Internet (an untrusted network).

  3. External secure network

    This classification is for interfaces that are part of a DMZ (Demilitarized Zone).

    Please Note:

    DMZ support is only available only to WinGate 6 Pro and Enterprise licenses

Once WinGate has determined the usage of the adapter it will dynamically bind the suitable interfaces to the appropriate services.

e.g. The WWW proxy server binds all interfaces classified as Internal to User services ( proxy services ) so that clients can make Internet requests through WinGate from the LAN.

You can use the Dynamic Binding Policy dialog to set specific binding rules for each WinGate service:

Dynamic Binding Policy dialog

Close

checkbox Override Service port

This option allows for the binding policy to allow the particular service to accept requests on different port then the service port specified in the main configuration for the service.

e.g.

If you created this dynamic binding policy in the WWW service, you could set a binding policy to override the service port (80) so that this policy will make the WWW service listen for connections on 8080 (or another desired port) also.

checkbox Use SYN Cookies

This allows WinGate to control a session of packets before they are allowed to even enter the port by keeping track of valid ACK requests from a host on the Internet, so that bogus packets (which can be used in a Network attack called a Syn Flood type of attack) will have less chance to penetrate WinGate’s defences.

This option is not ticked by default to allow for maximum application session compatibility and should only be implemented by administrators who are experienced with TCP session mechanisms.

checkbox Notify on access

With this option ticked, when the specific port is accessed there will be notification on the Firewall tab in GateKeeper.

checkbox Use SSL

When this checkbox is enabled, all sessions will be conducted using SSL (Secure Sockets Layer). The drop down box allows you to select the Server Certificate to use for SSL.

(Click here to read more on creating a Server Certificate)

©2008 Qbik New Zealand Ltd


Gateways configuration

Found under in each service, the Gateways configuration allows administrators to configure which gateway the particular service should use.

By default, WinGate will automatically use the gateway assigned in the network properties of the Internet connection that the WinGate has been configured to use.

Close | Close all images

There are however three different options available in the Gateways configuration:

  1. Use any available connection

    WinGate will automatically use the gateway address that has been set on any network interface which WinGate considers an external Internet connection (and is deemed to be available).

    Click here to read more on how WinGate determines the use of available network connections.

  2. Use all specified connections in rotation

    Administrators can select the various gateways found on the interfaces that WinGate has available. This is done by clicking the Add at the bottom of the Gateway configuration, which will bring up the Gateway Policy dialog. (See the Gateway Policy section below)

  3. Use specified connections in priority order (failover)

    This setting will prioritise the listed/selected gateways which the service will use. This setting allows for some redundancy so that if a gateway becomes unavailable the service will use the next gateway listed.

Gateway Policy

The Gateway Policy dialog allows you to determine the way that WinGate should choose which available gateway to use.

Gateway Policy dialog

Close | Close all images

In the window is listed all of the gateways that have been set on the interfaces that WinGate has available.

Depending on the option you choose in the Gateways configuration for the service you are administering, will depend on how you configure the Gateway policy.

You can select a specific gateway from a listed adapter or you can simply choose any gateway.

The source IP Address option allows you select what source IP address will be set in all packets that are sent to the chosen gateway. This can be any IP address that is used by an interface in the Operating system on the WinGate server.

Note: Monitor for dead gateways

The Monitor for dead gateways option found in the ENS plays an important role in the functionality of Gateway selection.

ENS - Monitor for dead gateways option

Close | Close all images

If the Monitor for dead gateways finds that a gateway is dead, it will show up accordingly in the Gateways configuration in each service as dead, and so wont be available for selection.

If a Gateway is found dead it will also prevent the interface from be used as an external interface for a WinGate service since it has no way of servicing the client request upstream.

When Monitor for dead gateways is not selected then all interfaces that have a gateway set in their network properties are deemed to be available to be used by WinGate.

©2008 Qbik New Zealand


Dialer - General

The Dialer General configuration is where you can configure the dial up profiles that WinGate has discovered on the Operating system, and enable them to be used for access to the Internet. All dialup profiles discovered and available will be automatically listed in the configuration.

Dialer General configuration

Close

When there is more then one connection available, use the Up and Down buttons to prioritise the order that WinGate will use the dial up connections.

Properties

Highlighting a particular connection and clicking the Properties button will bring up the WinGate specific properties for the connection profile.

checkbox Allow remote clients to disconnect

Ticking this option enables the dialer to be disconnected by clients using the WinGate Dialup Monitor.

(The WinGate dialup monitor is a small applet that appears in the system toolbar on a client machine running the WinGate Internet Client, when they have initiated an Internet connection on the WinGate server).

Uncheck this box to allow the dialer to remain connected permanently, even when WGIC users have disconnected.

(Note: You will also need to uncheck the "Disconnect after # seconds of inactivity" box in the Dialer Profile configuration to allow this).

Dial

Begins dialing cycle.

Stop

Stops the dialer cycle or hangs up if WinGate is online.

Notes:

  • You must configure each profile that you wish to use. To do this, either highlight each profile on the Dialer general configuration screen and click the Properties button to bring up the Profile configuration. The profiles will not operate correctly until you have done this.
  • If the Connect as required using the connection list check box is ticked then the dialer will automatically dial on behalf of a client. Otherwise the connection must be made manually.
  • The dialing cycle begins with the first dialer profile on the list, retrying the set number of times before proceeding to the next profile. When it reaches the end of the profile list it will repeat the cycle according to the set number of times displayed in the Retry all times box.


Dialer - Profiles

WinGate will automatically list any dialup profiles that have been created in the Operating system on the General configuration of the Dialer Properties in GateKeeper.

Dialer Properties - General configuration

Close | Close all images

If you wish to use a dialup profile from Windows with WinGate, you must configure it with the relevant account details first in the dialup profile's properties. These can be accessed by highlighting the dialup profile in the General configuration window (shown above)and clicking the Properties button.)

Dialup profile properties

Close| Close all images

Tick the Enable this connection to be used by WinGate option and fill in your details. (The dialer profile will not operate until you have done this.)

The Domain field is only for logging into an NT domain. Most ISPs will not require you to do this, so you should normally leave this blank.

NT / 2000 Users:

When accessing this menu for the first time, you will notice that the Username entry has been automatically filled with your NT username.

The Password entry will be left blank and you will have to fill this field in.

98 / ME Users:

If the Username and Password fields are left blank, then WinGate will use your default login details, provided that those exist.

The default login details are the username and password saved in your Windows Dial-up settings. If you do not already have default login details, you must fill them in this dialog.


Dialer - Local sites

The Local sites configuration contains a list of site names or IP’s for which you do not want the dialer to make a new connection.

Dialer Properties - Local sites configuration

Close

If a connection is requested to a site name that contains any of the words listed in this screen, then dialing will not occur.

Tips for Local sites:

  • It is sensible to prevent dialing for localhost, 127.0.0.1,WinGate (the NetBIOS name of your gateway PC) and the IP of the WinGate server.
  • If you add words such as micro, then you won’t get dialing for anywhere on microsoft.com or any sub-domain of microsoft.com, or microtest.com etc.
  • If you add a "." to the list, you will get no dialing for any address at all, as all names contain a ".".


Dialer - Settings

The Dialer Settings configuration allows you to configure logging and other advanced options for the WinGate dialer.

Dialer Settings configuration

Close

Logging

checkbox Dialing/hanging up:

Logs any connection status change.

checkbox Debug:

Logs any debug error messages. Only set this if you are having dialer problems.

Advanced Options

Online status check update interval..

The Dialer status is checked at this interval. If the dialer is prone to failing (e.g. if you have a poor connection) this can be set lower.

checkbox Use Synchronous Rasdial call

Use if RAS problems occur.

Abort dial if not completed within...

This is configurable in seconds. This will recover from dials that do not complete in the specified time.

Wait ... seconds between redial attempts

If your ISP is busy, it is best to have a wait before redialing takes place.


WinGate client connection methods

WinGate offers three different ways that clients on your network can connect to the Internet through WinGate. They are:

  1. NAT (Network Address Translation)
  2. WGIC (WinGate Internet Client)
  3. Proxy

The decision regarding which one you choose depends on the requirements that you have for your LAN as each has its own features and strengths.

  1. NAT

    NAT stands for Network Address Translation. It is used to share a single public IP between multiple client computers on the LAN, each using their own unique private class IP address.

    When a client attempts to connect or send data to a machine on the Internet it forwards the data to the WinGate server (running NAT). The WinGate server then substitutes the original private IP in the packet sent from the client with its own (the external public IP address it uses for the Internet) and carries out the clients original request.

    The remote Internet computer/server/site sends packets back to the WinGate server, because they think that the WinGate server was the source of the data sent. Since NAT keeps a record of which client computers sent packets on which ports, it is able to pass the incoming packets back to the correct LAN computer that initially made the request.

    Click here to find out more about how NAT works

    Click here to find out how to configure clients to use NAT

    Pros

    • NAT provides fast and seamless low-level sharing of a connection to the Internet. It is the simplest approach to sharing an Internet connection. With little overhead, it is very reliable.
    • It is also extremely flexible as it gives access to shared connection for any platform that supports TCP/IP (e.g. Windows, Mac, Unix, Linux) and virtually any client application (web browsers, mail programs, newsgroups, FTP etc.)
    • There is no software to install and no applications to configure.
    • Easy integration with proxies.

    Cons

    • Because NAT is implemented as a low-level driver, there may occasionally be some compatibility problems with some hardware.
    • Due to its light weight nature NAT alone does not allow the access or policy control available to WGIC and proxies provide, however this can now be alleviated by transparent redirection.

    Conclusion

    For many, NAT is an excellent choice. It's particularly well suited to large LANs where you don't want to install software and/or configure applications on many different machines.

  2. WinGate Internet Client (WGIC)

    The WinGate Internet Client is small application that can be installed to client machines in order to communicate with the WinGate server. It uses the GDP (Generic Discovery Protocol) to discover the existence of WinGate servers on the local network, and once discovered it communicates directly with the WinGate server via the Winsock Redirector Protocol service found in WinGate.

    With the WGIC is installed, all WinSock applications that make outbound requests on the client computer will be intercepted and serviced by the Winsock Redirector Protocol service on the WinGate server. This allows administrators to have strong control over what applications clients use to access the Internet, and how they will access the Internet.

    Click here to find out about installing and using the WinGate Internet Client

    Pros

    • Provides tight control over users Internet usage and allows the efficient running of server applications.
    • Provides an elegant way for users to authenticate for Internet usage. It can be configured so the user has to enter username and password the first time they access the Internet; ideal for tracking and recording purposes.
    • Allows policy control from just one place in WinGate (Winsock Redirector Service) rather then configuring policies per service.
    • With WinGate Enterprise licence, WGIC user Internet access and operations can be controlled from a central configuration menu in GateKeeper.

    Cons

    • You have to install client software.
    • Support for Windows operating systems only.

    Conclusion

    If you have a small to medium sized LAN of Windows clients, where control of user Internet applications is required, we recommend using the WGIC.

  3. Proxy

    Like the normal meaning of the word "proxy", WinGate has been designed to fulfil Internet requests on behalf of clients. As such WinGate does things on behalf of other software programs running on the client machines.

    Specifically, WinGate makes Internet requests to Internet servers on behalf of Internet clients. It basically acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control and a caching ability.

    Configured on an application by application basis, clients need to specify the IP address of the WinGate proxy server in each application they wish to use to access the Internet. WinGate's specific proxy services (such as HTTP, FTP, Telnet) etc have been specifically designed to handle these types of connections and as such handle the entire connection between the Proxy client and the remote server/site on the Internet.

    The WinGate Internet Client (WRP-based) and General Purpose Internet Sharing (NAT-based) have decreased the importance of proxies. You may still choose to use proxies to exert per-service control over policies, however the advent of transparent redirection means that there is nothing you can do with proxies that you now cannot do with the other two connection methods.

    Click here to find out how to configure clients to use Proxy Connections

    Pros

    • Allows you the greatest control over data passing through your network. Although, with transparent direction, these benefits are now available through NAT and WGIC.

    Cons

    • Works only for existing protocols that each Proxy service is designed for.
    • If a new protocol is devised, it wont be able to be used.

    Conclusion

    Because transparent redirection provides the NAT and WGIC with all the benefits of proxies there will be very few occasions when you will need to use a proxy directly.

    Note:

    It is possible to integrate the three connection methods. Click here for details of how to do this


Comparing client connection methods

The table below outlines the three methods of Internet connectivity used in WinGate.

You can use this table as a guide to matching the WinGate methods to your requirements. When you are familiar with the benefits and drawbacks of each method, you can learn about making NAT work together with the WGIC and WinGate Proxies.

The table shows that NAT is the easiest to use, most compatible with your software and the fastest.

The biggest advantages of the WGIC are the ability to accept incoming connections, solid control over your connection with configurability, and high security.

Proxies are best for configuration and security.

To provide maximum connectivity and functionality you need to be able to use NAT, WGIC and the Proxies.

Property

NAT

WGIC

Proxies

Easy to configure client PC

***

**

*

Speed

***

**

**

Security

**

***

***

Configurability

*

**

***

Os compatibility

***

*

**

Software compatibility

***

***

**

Accept incoming connections from other computers

*

***

**

©2009 Qbik New Zealand Limited


WinGate Internet Client

WinGate Internet Client (WGIC)

Requirements for the WGIC

You should check that any client computer satisfies the following requirements before installing the WinGate Internet Client. In all cases, you should set up the WinGate server and make sure that the Winsock Redirection Service is enabled and running before you begin installing the WGIC.

The requirements for installing the WGIC are as follows:

  • Running Windows 95, 98, NT4, 2000 or XP
  • The computer is NOT running the WinGate server
  • If running Windows 95 then WinSock 2 must be installed
  • TCP/IP protocol installed and working properly.

WGIC installation

  1. Run the installer program on your client computer

    • WinGate.exe

      (This is the same installer you used for the WinGate server)

      or

    • WGIC.msi (Client installer found in the WinGate\Client directory on the WinGate server machine)
  2. The installer should detect the WinGate server on the network and default to the client install. If it does not you can select to install the WinGate Internet Client manually.

Like the WinGate engine, the WinGate Internet Client runs as a Windows Layered Service provider. This means that it will always run in the background, whether you are logged in or not. You can run the WGIC applet for further configuration from the Windows Control Panel .

WGIC applet in the Windows Control Panel

Close

Configuring applications to use the WGIC

Once the installer has finished, your applications will connect to the Internet with no further configuration (the Winsock Redirection Service must be running on the WinGate server). The WGIC will seamlessly provide all outgoing and incoming access to and from the Internet.

If you were using proxies before you installed the WGIC then you should remove any old proxy settings because your applications should be configured to connect directly to the Internet (rather than through proxies). If you do not remove these settings, your applications will still work but they will be using the WinGate proxies, not the WGIC.

If you want to use WinGate NAT from the same computer then additional configuration of the client will be required. This is a minimal set up.

Click here to find out how to integrate the NAT with the WGIC


Configuring Clients to use NAT

Configuring clients to use Network Address Translation (NAT)

Configuring WinGate clients to use NAT is relatively simple:

The default gateway entry found in the network properties of the client's machine must be set to the private IP address of the WinGate server.

This setting is part of TCP/IP properties and can be configured in several ways:

  1. Automatically with the WinGate DHCP server (recommended approach)
  2. Using another DHCP server running on your network, and setting the Gateway(Router) option , to issue the private IP address of the WinGate server.
  3. Manually configure the network properties of the client machine.

Once the client has their Gateway address set to point at the WinGate server, then the clients will be able to utilize NAT.

Note:

NAT clients are still required to have a DNS server specified in their network properties for DNS resolution, but this does not have to be the IP address of the WinGate server.


Configuring clients to use proxies

This connection method is also referred to as the Application Proxies method. Configuring clients to use the proxies method for their connections to the Internet is relatively simple.

Configure the Proxy Server setting for each particular application on the client machine with the internal LAN IP address used by the WinGate server, and port number that the proxy service is running (listening) on.

You will need to check with specific application documentation on how this is done for your particular program.

Note:

Since the introduction of using NAT and transparent redirection abilities in WinGate, there are now very few occasions where you should need to use a proxy directly.

To learn how to integrate proxies with the NAT click here.


Integrating client connection methods

It may be required in certain scenarios for several client connection methods to be integrated on the one machine. By integrating these methods, you can satisfy virtually any requirement for Internet connectivity.

NAT and the WGIC

This combination is the most effective for client computers running their applications on a Windows platform.

It allows users to maximize their ability to share an Internet connection (both outgoing with NAT and incoming with WGIC), while giving you a high level of control over any applications you choose to administer more carefully with the WGIC.

If the WGIC is installed it will provide the default connectivity for every client application trying to connect to the Internet from that computer. To use NAT you must tell the client to ignore a particular application.

Follow these steps to use NAT and WGIC on the same client computer:

  1. Make sure your Default gateway points to the WinGate server (this is done automatically if DHCP is enabled and the client machine is receiving its IP details from WinGate DHCP)
  2. Make sure that your Windows applications are configured to connect directly to the Internet.
  3. Install the WGIC on the client computer (it will handle all access to the Internet unless you to explicitly tell it to ignore a particular application)
  4. Go to the control panel or the start menu and open the applet named WinGate Internet Client
  5. Select the Application tab and click the Add button.
  6. Select an application that you want to use NAT e.g. Netscape.exe (if you do not know the name of an application .exe, click on the Browse button and look for that application on the local drive)
  7. Select Local Network Access and the selected application will be ignored by the WGIC
  8. Repeat this process for each Internet application that you want the WGIC to ignore (and therefore use NAT)
  9. Click on the Apply button, and then click OK.

NAT and proxies

Although in most cases NAT and the WGIC will satisfy all requirements for Internet sharing, sometimes the WinGate Proxies are necessary.

If you decide to use a proxy you must separately configure each application individually.

This will require specifying the WinGate server IP address and the port that the proxy service is running on (this is displayed next to the service in GateKeeper).

NAT can efficiently use proxies through transparent redirection for common services such as WWW and FTP.

Note:

If you configure an application to use a proxy, it will not use NAT.


WinGate security model

WinGate has been designed to provide a very high level of security, and to allow great flexibility of accounting for use of the Internet.

There are a number of major concepts in the way that the security features of WinGate govern its actions.

These center on the following security objects in WinGate:

Users

A user is someone or something that is obtaining service from WinGate. You can create users and groups from within WinGate (or import them from a Windows NT/2000/XPPro/.Net operating system or a text file), or choose to integrate WinGate with an existing NT/2000/XPPro/.Net user database.

WinGate can store audit and accounting data for each user as well as manage their rights and privileges when accessing WinGate services (whether you are using the WinGate or NT databases).

The links below provide information on managing the WinGate user database. However, if you are running WinGate on Windows NT/2000/XPPro/.Net, we recommend using the Operating System/Remotes user database integration (this provides stronger NT-based authentication and a more robust database).

Click here to learn about adding a new WinGate user

Click here to learn about adding a new WinGate group

Click here to learn more about managing users/groups using the WinGate user database

Computers

A computer in WinGate is a record of a physical computer that is connected to WinGate via the LAN. Individual computers are tracked according to their private IP numbers (which will be uniquely assigned automatically if you are using the WinGate DHCP Service).

Because users only exist on a LAN in the context of a computer, you can configure WinGate to make certain assumptions based upon this. For instance, John is the only person who ever logs on to the computer named JOHNSPC with a private IP of 192.168.0.55. Therefore, WinGate can assume that any activity on this computer is caused by John (and can enforce policies accordingly).

These assumptions correspond to Confidence Levels (how confident WinGate is about the identity of the user on that computer.)

By default, a computer will be unknown and assumptions will only be made where you specify these.

WinGate will recognize 3 levels of users on the network:

Level

Explanation

Unknown

WinGate has no knowledge of this user.

Assumed

WinGate makes an assumption about the identity of the user, based upon the IP number of the computer connected or the network name of the computer (this is set up under Locations in GateKeeper). In addition, users can make use of insecure authentication in Telnet or SOCKS 5 to achieve an "assumed level" of authentication (an assumed user is less secure than an authenticated user).

Authenticated

WinGate can verify the identity of the users because they have authenticated (i.e. they have supplied a correct username and password to WinGate). Users can authenticate themselves by a range of methods provided by WinGate.

Note:

Within WinGate the terms Logged in and Authenticated are used synonymously.

Once you understand the WinGate concepts of users, groups and confidence levels, you are ready to set up policies that may restrict what they do.

Click to learn about implementing security with WinGate Policies


User database authentication

Choosing a user database

To be able to implement policies to control users and groups effectively in WinGate, administrators need to decide which user database will be used to identify and authenticate users and groups.

You can select which user database WinGate uses to check for a match when a user enters a name and password when attempting to access a WinGate service.

In WinGate administrators have two choices, either:

  1. WinGate user database.
  2. Operating system/Remote user database.

The WinGate user database is selected and used by default, however the Operating system/remote database can be selected via the Database options on the Users tab of the GateKeeper Control Panel.

Notes on Authentication:

  • Passwords for both NT/2000/XP and WinGate are always case-sensitive (i.e. password, Password & PASSWORD are not treated as equal).
  • Once a user has successfully authenticated with WinGate, he/she will be able to access any WinGate services for the duration of the session (this is because WinGate now recognizes any requests from that PC as coming from an authenticated user).

  • If using Operating system/Remote Database authentication, a valid Windows OS account is required for each WinGate user, as WinGate will show the users from the Operating system/Remote users database.

    Note:

    If you change to Operating system/NT Authentication, some WinGate users may disappear if there is no corresponding NT user.

  • WinGate never stores or records Operating system passwords – it uses the Operating system to verify their correctness.
  • The Java Client authentication can not be integrated with Operating system/remote system Database. This method will only work with using the WinGate user database.

Operating system/NT-based authentication will work for the following WinGate authentication methods:

  • NTLM authentication in the Proxy services.
  • Winsock Redirector Service (via the WinGate Internet Client)
  • Remote Control Service (via GateKeeper).
  • POP Server.

Operating system/NT-based authentication will NOT work for:

  • WWW Proxy Service (via the Java Client).
  • SOCKS5 Proxy (passed in plain-text as specified in RFC1929)
  • Telnet Proxy (passed in plain-text).

WinGate User passwords

This option is only available if you are using the traditional WinGate user database (i.e. not Operating System/Remote database integration).

When a user must be authenticated, the supplied user name and password (credentials) will be checked against those stored at the server.

Note:

If you have imported users from another source (e.g. text file or NT ) this password will be blank – you will need to set these.

Once a WinGate password has been set for a user account it is stored in an encrypted format.

Windows NT / 2000/XP/.Net User Passwords

This option is the most secure, but is only available when you have chosen to use the Operating system/Remote user database with WinGate.

It will allow users to enter an NT username and password to authenticate with WinGate. This builds upon the tried and tested strength of NT security.

WinGate will always try to use the details that the user is logged into Windows with first, whether the user is logged into Windows NT, 2000, 95, 98 or ME. If this fails then the user will be asked to enter their Windows OS credentials.

At this point WinGate uses the Operating system to verify whether the password is correct – WinGate never knows, stores or transmits the password in anyway (it simply passes any details to the Operating system/remote Database where they are confirmed or denied).


Using the WinGate user database

Setting up custom users and groups is a key feature of WinGate. It allows you to create meaningful policies that control and track access to your key WinGate services.

WinGate policies can be driven by one of two user databases:

  1. WinGate user database
  2. Windows NT / 2000 user database (Click here for more information on using a Operating system/Remote user database)

This topic outlines how to manage users and groups when you have selected to use the WinGate user database and GateKeeper for user management.

Note:

  • 9x users will only be able to manage users and groups in this way.
  • Setting up users and groups is not required by WinGate (it will function fine without them). However, it does dramatically improve your ability to manage and record Internet access.

The WinGate user database

WinGate has a built in user database for the management of users and groups who need to have their Internet access and activities controlled by policies in WinGate. Unless you have chosen to use the Operating System/Remote user database option during the installations, the WinGate user database automatically creates two default users, and two default groups.

Default users

  1. Administrator account

    The Administrator user account has full control over all aspects of WinGate configuration and cannot be deleted. When WinGate is first installed the Administrator account will have no password but you will be prompted by GateKeeper to set one immediately.

    You can leave the administrator password blank if you like but WinGate will only allow you to connect with GateKeeper from localhost, not remotely (by changing the bindings). This is a security precaution taken to prevent unwanted users on the Internet (or on your LAN) from hacking into your WinGate configuration.

    You will be informed by a System Message if the Remote Control Service bindings are automatically altered for this reason.

  2. Guest account

    The Guest user account has no default password and cannot be deleted. Guest is the account that all unknown users access by default. By default, the guest has rights to allow them to access all services but no rights for configuring anything. You can increase or decrease these rights depending on the level of security required by your network.

Default groups

  1. Administrators

    Members of the administrators group (including the user Administrator) are given full access to modify, control and administrate WinGate.

  2. Users

    The Users group includes both the Administrator and Guest user accounts and is the default group that all new users are added to.

Assumed users

You can configure WinGate to assume the identity of a user based on the IP address or network name of their computer. This is very convenient when you want to track your users but do not require full authentication. This is most useful when each person on your network uses the same computer each time.

Assumptions can save people logging in. If some computers are only ever used by one person, then give them an assumption and they won’t have to log in. If you set up your bindings in a secure way, your network can’t be accessed from outside. You may decide you don’t require clients to log in.

Click here to read about User Assumptions

Restricting Guest access

If somebody is accessing WinGate services from an unknown location (i.e. no location entry) without authenticating, they will be user Guest. Accounting does not have to be enforced (i.e. charged), but it is useful to see who uses the Internet the most. You can also stipulate that someone’s account balance be positive.

A shared user account is very useful. Setting up one or more user accounts that can be used by different people is a way of tracking the usage of a group. This is most likely to be used in schools, where a whole class can use one user account (e.g. Room4). A tutor can have an individual account, but be in the same group and also in an Admin group. This way you can monitor the group usage and won’t have to set up so many accounts.

Additional cautions and consideration

You may implement any of these policies plus many more at your discretion:

  1. Allow administration only from the WinGate server, or any other predetermined computer on the network.
  2. Require authentication or not.
  3. Have separate accounts for all administrators.
  4. Require authentication, but have shared user accounts (e.g. per class, see below)
  5. Account restricting for groups and individuals to monitor access levels
  6. Groups per company division with a different set of rights (like accounting, marketing, sales).


Using the Operating System / Remote user database

WinGate allows for administrators to utilize the operating system user database on the system on which it is installed, or a remote user database from a domain controller to control user and group activity in WinGate.

When first installed WinGate will default to using the built in WinGate user database (If the Use Operating System database option is not selected during the installation.)

The Operating System/Remote user database option can only utilize user databases on Windows NT/2000/XP Pro/2003(.Net server) operating systems. It cannot be used with Windows 9x operating systems.

To use the Operating System/Remote user database in WinGate:

  1. Open GateKeeper.
  2. Select the Users tab in the in GateKeeper Control Panel.

  3. Select User Database options, (you will be presented with the User Database Options dialog).

    User Database options

    Close

  4. Select either Operating System (Windows) user database, or Use remote user database (Domain Controllers/Active Directory).
  5. Select the desired synchronisation options (or Synchronise now button, to synchronise the database immediately)
  6. Click OK to implement changes.
  7. On exiting the User Database options configuration, check to see that the newly synchronised users and groups appear under each User and Group heading on the Users tab in GateKeeper.

Click here to read more on the User Database options dialog

Note:

WinGate only utilizes users and groups in the chosen database to control activity through WinGate (such as Internet access), and implementation of WinGate policies.

It cannot be used to change or control Operating system level policies or security.

Remote database synchronising

When using an Active Directory Domain Controller user database there is one further step required for this to work correctly:

  1. Open the Computer Management MMC (found in Administrative tools in Windows) on the WinGate server.
  2. Open the Services and Applications configuration that lists all Services.
  3. Select the Qbik WinGate Engine service.
  4. Right click on this service and select Properties.
  5. Select the Log On tab.
  6. Where it says Log on as, select the This Account option and browse the Active directory for a suitable account with Domain Administration equivalent privileges. It is recommended that administrators create a special account in Active Directory Users and Computers for this purpose.
  7. Stop and then restart the WinGate engine for the changes to affect.
  8. Re-synchronise the database from the User Database options configuration found under the Users tab in GateKeeper.

In an Active Directory environment users and groups are managed from the Active Directory Users and Groups mmc, which is located on each Domain Controller. Local User and Group management will not be available on the machine on which WinGate is installed as it is when using the local Operating System (Windows) database option.

Please note:

The Use remote user database (Domain Controllers/Active Directory)option is only available only to WinGate 6 Pro and Enterprise licenses.

©2009 Qbik New Zealand Limited


User Database Options

The User Database Options dialog on the Users tab in the GateKeeper Control Panel allows you to select either an Operating system user database or a remote user database such as a domain controller to be used by WinGate.

User Database options dialog

Close

User and Group Management

checkbox Use the Operating System (Windows) user database

Selecting this option allows you to use the Local Windows user database that is on the machine where WinGate is installed.

checkbox Use remote user database (Domain Controller/Active Directory)

Selecting this option allows you to use the Windows user database on a domain controller if you are in NT or Active Directory environment.

Click here to read more about Remote Database synchronising in the Using the Operating System user database section

NT User Manager

Launches the Windows user manager dialog. This allows you to continue operating from within GateKeeper while managing your users and groups from within Windows.

Database synchronisation

checkbox Synchronise entire database when WinGate starts

This will set WinGate to synchronise with the Windows user database whenever the WinGate engine is started.

checkbox Synchronise entire database when an Administrator logs in

WinGate will automatically synchronise itself when ever the Administrator logs into GateKeeper or authenticates themselves through WinGate.

checkbox Synchronise individual users when they log in for the first time

When an unrecognised user attempts to authenticate through WinGate (this tips WinGate that a new user may have been added to NT).

Synchronise now:

WinGate will check the Windows user database and update itself. Once you click the Apply or OK button it will reflect the most current user database.

Note:

WinGate only utilizes users and groups in the chosen database to control activity through WinGate (such as Internet access), and implementation of WinGate policies.

It cannot be used to change or control Operating system level policies or security.

©2008 Qbik New Zealand Ltd


Users tab

The Users tab on the GateKeeper Control Panel provides easy access to the tools used to manage users, groups, user databases and system policies in WinGate.

Close

Options on the Users tab include:

Option

Description

Users

This lists all of the current users that are known and used by WinGate. (Regardless of what user database has been used). Double clicking on a user allows you to configure details for the user in the user properties.

Groups

This lists all of the current groups that are used by WinGate.(Regardless of what user database has been used)

Database options

The Database options allow you to select whether or not to use the Operating System/Remote user database for implementing policies and control in WinGate. (The built in WinGate user database is used by default)

Note:

When using the Operating System or Remote user database option, once the users and groups are listed in WinGate, then all WinGate related policy and control over these users and groups is performed inside of GateKeeper.

Local Network/Domain user and group control (i.e. access to shares, permissions etc) is still controlled by the Operating system/Domain Controller.

WinGate management for user and group control and policies relates only to WinGate operations.

Assumed Users

Assumed Users allows you to configure location assumptions for WinGate. You can set WinGate to assume that if a connection is received from a particular IP address or computer name, then it is deemed to be a particular user connecting.

System Policies

The System Policies option is where you can configure policies that will be used throughout WinGate, as opposed to Service policies which are configured on a service by service basis.

Multi-user Machines

The Multi-user Machines option (available only with a WinGate Enterprise license) allows you to specify Multi-user machines (e.g. Terminal Server machines, "thin client" servers) on your network, so that WinGate will be able to authenticate and identify individual login client sessions from the Multi-user machine.

Note:

The Multi-user machines option only supports Multi-User machines that use NTLM authentication.


Users

When using the WinGate user database, creating your own users and groups enables you to set up policies on a per-user and per-group basis.

This allows you to have much tighter control over your networks Internet access through features such as time/location based restrictions, accounting and auditing.

Creating new users

Whenever you create a custom user, the default rights and characteristics assigned to that user are based on a default user template.

You can modify this template to make it easier to create users (see the Modifying the default user template section below).

To create a new user:

  1. Open GateKeeper.
  2. Select the Users tab in the GateKeeper Control Panel.

  3. Right-click the mouse anywhere and select New User.

    Add a new user

    Close | Close all images

  4. You will be presented with the Properties for new user configuration.

    Properties for new user

    Close | Close all images

  5. Type in the user name into the Username field.
  6. Enter the user’s Real name (optional).
  7. Get the user to enter and confirm their Password, or leave it blank and select User must change password at next logon.
  8. Enter a description of the user e.g. Support Technician.
  9. Set the options for this user.
  10. Click OK.

Note:

The following characters are not valid in a username: [ ] + = \ / : ; , * ? <>" |

To clone an existing user:

  1. Open GateKeeper.

  2. Select the Users tab in the GateKeeper Control Panel.

    Close | Close all images

  3. Righ-click on the existing user you wish to clone and select Clone user from the context-menu that appears. This will open the Properties for new user configuration.
  4. On the User Info tab change the Username, Description and Password for the new user.
  5. Change any other properties as required and click OK.

Modifying the default user template:

By default, WinGate will create users with a minimal set of attributes.

If the Administrator wants further control over what details are set for newly added users, they can set up a user called "default". Any attributes of the default user will be carried over to newly created users (it acts as a template for creating new users).

  1. Open GateKeeper.
  2. Open the Users tab on the GateKeeper Control Panel.
  3. Right-click the mouse anywhere and select New User.
  4. On the Properties for new user configuration, enter the user name "default" in the Username box.
  5. Make any other selection settings that you want to be used in the future when creating new users. Password options (you may want a default password), Logon options, Groups, Auditing and Accounting details are all available.
  6. Click OK.

In future all newly added users will have the attributes of the user called default, all you need to change is the user name.


User properties - Group tab

User properties - Groups tab

The Groups tab in the users properties dialog displays the current groups that the user is a member of.

User properties - Groups tab

Close

To add the user to a group:

  1. Select the Is not a member of: window
  2. Double click on the desired group that you wish to the user to be a member of. This will move the group to the Is a member of: window.

Similarly, to remove a user from a group double click on the group in the Is a member of: window that you want to remove the user from.

Note:

You can also edit a users group membership by editing the actual group(s) from the Users tab on the GateKeeper Control Panel.


User properties - Email tab

The Email tab on the User properties dialog is used to create aliases for your users’ email addresses.

This will match up email addresses to known users from the WinGate user database.

User properties - Email tab

Close | Close all images

checkbox This user has a mailbox on this server, type:

This check box allows you to specify if the user has a mailbox on the WinGate server, and what type of mailbox it is: POP3 or IMAP4 (Users can only have either an IMAP4 or POP3 mailbox, but not both)

If this box is not checked, then no other option on this screen will be available.

Current effective addresses

This window will list of the user’s active email addresses on this mail server.

checkbox Limit mailbox capacity to ? MB

This limit is on a per user basis.

checkbox Override plaintext password for POP3/IMAP4

If you want to specify a different password for the user’s email (as opposed to the actual Users password) you can input this here.

IMAP4 specific options

These two options will only be available when the users email mailbox is an IMAP4 mailbox.

IMAP4 specifc options

Close | Close all images

If message marked for deletion

When a message is marked for deletion you can choose an option from the drop down menu for how it will be handled by the IMAP4 server.

The options are:

  • Do nothing
  • remove it immediately.
  • move it to trash folder (a folder called Trash must already have been created for this option to be effective).

checkbox Clean messages appended by Eudora

Eudora doesn't set some content type headers properly, and can leave embedded tags in email content. This means email submitted by Eudora may not display properly in other email clients. This option cleans up any messages appended.

Note:

When a user has an IMAP4 mailbox their messages will be stored under the WinGate\Mail\IMAP\"Username" directory rather then WinGate\Mail\POP3 (when the mailbox is a POP3 mailbox)


User properties - Accounting tab

The accounting features of the Accounting tab in the User properties dialog make WinGate a useful LAN management tool.

User properties - Accounting tab

Close

Accounting information is updated in real time if you are viewing the user record of someone that is accessing the Internet.

Data quantity totals are updated at the termination of each session. Time on line is updated when all a user’s data sessions have terminated.

Sections and terms are explained below.

  • Data Measures

    Field

    Description

    Bytes sent to client

    This is the total number of bytes WinGate has sent to the client computer. In the case of HTTP use, a lot of this will come from the cache.

    Bytes received from client

    This is the data that the client has sent to WinGate.

    Bytes sent for client

    This is the data that WinGate has sent to servers on behalf of the client. This is usually different to the number of bytes received from the client.

    Bytes received for client

    This is the amount of data WinGate has downloaded from the Internet on behalf of the client. This will likely be lower than the number of bytes sent to client, due to caching.

    Seconds online

    This is the number of seconds that a client was registered with WinGate. Note that this is not a reliable way of telling how much time a user spends on the net if they are logged on. In this case, the time is the entire period they are logged on. Being logged on does not imply Internet use. Seconds online is updated at the end of all user sessions i.e. when a user logs out.

  • Rate

    In the Rate boxes you can specify what rate you will charge users at.

    Rate Charges can be either:

    1. Per Megabyte (Which is measured against typically against either Bytes received for client and Bytes sent for client data measures)

    2. Time online (The Time online rate is measured per hour against the seconds online data measure)

    The rate can be entered in standard decimal currency notation.

    e.g.

    If you were charging a client the rate of $1.50 per Megabyte, then you would enter 1.50 in the Rate box for the desired data measurement.

  • Balances

    Field

    Description

    Total Charges

    This is the sum of the charges accrued.

    Opening Balance

    This is what the user has paid so far.

    Closing Balance

    This is the Opening Balance less Total Charges.

    Reset

    This button resets the Quantity fields. Beware, there is no confirm dialog, so if you make a mistake, press cancel

The Scheduler in GateKeeper can be set to export and reset the user database information.

Example Scenarios:

  • Specify an amount, maybe $20, and that will be free for the user. If the Closing Balance goes negative, the user pays you that amount.
  • User pays an amount (this goes in Opening balance), they can use the Internet till their balance is zero, then access is cut off. This is ideal for Internet Cafes.

Reset accounting totals

This button will zero all data amounts, both charges and balances.


User properties - Auditing tab

The Auditing tab found in the properties of a user, allows you to audit the individual user's activities.

User properties - Auditing tab

Close

All per-user monitoring is stored in Audit files. These files are in a Tab delimited format.

A text editor or the Logfile server can be used to view these files.

User audits are stored by default as:

%WinGatePath%\audit\username.log


Groups

Groups are an integral part of extending the user rules and helping to ease the administration of assigning policies.

Groups are logical collections of users who share common features.

Groups can have any number of members. A member can be a user or another group, allowing for the nesting of groups within groups.

Individual users can be in any number of groups. Rights can be applied on a User or Group basis.

Note:

  1. When using the WinGate user database groups can be added easily from the Users tab on the GateKeeper Control Panel.
  2. When using the Windows Operating System database/ Remote user database, WinGate will not have access to the Operating System security information about users and groups. As a result if user or group names are changed on the Operating System or domain controller being used, then these will be seen as new users and groups by WinGate when it synchronises with the Operating system or remote user database.
  3. All operating system/domain user and group management is only configurable on the domain controller or Operating system that holds the user database. All policies set in WinGate apply to the users and groups that have been synchronised in WinGate and to WinGate specific functions. These policies are in no way controlled by the security of the Operating system or domain policy.

To add a Group (when using the WinGate user database) :

  1. Open GateKeeper.

  2. Select Users tab in the GateKeeper Control Panel.

    Close | Close all images

  3. Right-click anywhere on the Users tab and select New Group.

  4. The New Group configuration will appear.

    New group dialog

    Close | Close all images

  5. Enter a Group Name and Description for the group.
  6. Select a user or group from the Non-members window and click the Add button to add the chosen member to the group.
  7. Click OK.

Note:

When using the Operating System/Remote user Database, you can only add groups by using the User manager/Local Users and Groups/Active directory Users and groups mmc, in the operating system.

To Edit a Group (when using the WinGate user database) :

  1. Double click the group name on the Users tab.

    The Edit Group configuration will appear.

    Edit group dialog

    Close | Close all images

  2. Select the users and groups from the Non-members window that you want to add to the group and click the Add button
  3. Select the users and groups from the Members window that you want to remove from the group, and click the Remove button.


Importing users accounts

The User Import Wizard enables the administrator to import all users and group information for a WinGate user database, from text files.(tab delimited only)

This feature enables a WinGate administrator to import users from a simple text file (where the each information field is delimited/separated by tabs).

We currently do not support importing from a comma-delimited file.

You can import as much or as little information as you like – user names, descriptions, real names, group memberships, user templates etc (even existing audit information if the details were exported to a text file by WinGate).

This can save you time when migrating from one WinGate server to another (or when you must rebuild your gateway computer). Run the User Export Wizard to first output the entire WinGate user database to a text file. It is also much faster for entering many users at once and can be combined with User templates for even greater speed and control.

User Import Wizard

Close | Close all images

Open

This will launch a browse dialog so that you can select a text file from which to import user and group information (this MUST be in a tab-delimited format).

Delete

Once you have selected a file to import, you have the opportunity to remove any user or group records that you do NOT want imported. When you press OK the remaining record will be imported to the WinGate User Database.

checkbox Merge members if group exist

This option is only applicable when you are importing users in to an existing WinGate User Database (that already contains the standard or custom users and groups).

Example:

Jim & Bob are already in the Administrators group. You are importing a new Administrators group that has a member called Harry. After the import is complete the Administrators group will consists of Jim, Bob and also Harry (only if the Merge members if group exist option is on).

Importing Users and Groups into WinGate:

  1. Make sure that you have a text file listing all user information and that the text file is in a valid WinGate format (see the sample in the WinGate program files folder under \samples).
  2. Open GateKeeper.

  3. Select the Users tab on the GateKeeper Control Panel.

    Close | Close all images

  4. Right click anywhere in this tab and select Import Users from the menu.

  5. This will open the Users Import Wizard.

    User Import Wizard

    Close | Close all images

  6. Select the Open button and select the location of the text file.
  7. Once the new details appear in the Users Import Wizard, click OK or select appropriate to details to remove and click Delete first before clicking OK.
  8. A small pop up listing details of the import will appear.
  9. Click OK to close and now the new Users and Groups should appear on the Users tab.

Notes:

  • Both user names and group names are case-sensitive to provide maximum security (this means that the usernames "Matt", "matt" and "MATT" would all be recognized by WinGate as separate users)
  • If a duplicate user is found (i.e. a user specified in the text file already exists in the WinGate user database) the user import wizard will NOT re-import that user. This is a safeguard to ensure that no existing user information is overwritten. To overwrite the existing user account you must first delete that account with GateKeeper.
  • Once you have successfully imported user information into WinGate (users and groups) you should always DELETE the text file (in the interest of security).
  • When adding new users and groups to an existing user database it is a worthwhile precaution to backup the WinGate registry (this will allow you to rollback in the case of any unwanted changes).

Click here to read about exporting user accounts


Exporting user accounts

Exporting user accounts allows you to export the summary details from the user accounts to a single file.

This file is in a tab-delimited format for easy import into a database.

Exporting user accounts:

  1. Open GateKeeper.
  2. Select the Users tab from the GateKeeper Control Panel.

  3. Right-click anywhere in this tab and select Export Users.

    Close | Close all images

  4. This will open the User Export Wizard dialog.

    User Export Wizard

    Close | Close all images

    Export to text file

    This option in the action dialog can be a filename in the WinGate directory such as:

    • user-accounting.txt
    • a path from the WinGate directory audit\user-accounting.txt or ..\user-accounting.txt. Any suitable file name can be chosen.

    File type

    This is either tab-delimited or comma-delimited. A delimiter is another word for the separator between fields of information. This option determines the format of the text file that will be created.

    Note:

    WinGate can only import information in a tab-delimited format.

Exported fields

These are the exported fields. Each are separated by tabs:

Name

Type

Description

Template/Members

Password

RealName

AuditOptions

IsEnabled

CannotChangePassword

MustChangePassword

AuditUser

Timestamp

Username

Real Name

Client Send (bytes)

Client Received (bytes)

Server Send (bytes)

Server Received (bytes)

Time on line (seconds)

Opening

Closing

Example:

While the format may look ‘crooked’, the gap between each field is a "tab" character, and is the standard text import format.

11/11/97 15:44:04 mary-bob 80085 3053 0 0 1455 0 0

11/11/97 15:44:04 Guest 194 0 0 0 0 0 0

11/11/97 15:44:04 jimmy-sue 0 0 0 0 0 0 0

11/11/97 15:44:04 Administrator 173734 12906 0 0 6957 0 0


WinGate authentication methods

To implement WinGate policies and control WinGate needs to identify users as they connect.

There are two ways WinGate identifies users either through location assumption or authentication.

The authentication of WinGate users is based on either:

  • WinGate passwords (when using WinGate's built in user database).
  • Windows NT / 2000/XP Pro/.Net(2003) passwords (when using the Operating System Database/Remote database authentication).

Authentication is required by WinGate so that it can determine which user is accessing which services, and apply the policies set by the administrator, appropriately.

You should learn about using a particular user database before learning how to implement authentication:

  • Selecting a user database
  • Using WinGate user database
  • Using the Windows Operating System/Remote user database

There are Four different ways of getting users to authenticate (supply a name and password) for key WinGate Services:

  1. Users can authenticate for the Winsock Redirector Service with the WinGate Internet Client login dialog. Click here for more
  2. Logging on with a remote GateKeeper (With WinGate Pro and Enterprise). Click here for more
  3. Users can authenticate for WWW Proxy Service with the WinGate Java logon applet. Click here for more
  4. Users can authenticate for WWW Proxy Service using NTLM logon in Internet Explorer (or NTLM supported browser). Click here for more

Note:

About Insecure Authentication with Telnet:

In addition to the above, users can make use of insecure authentication in Telnet or SOCKS 5 to achieve an assumed level of authentication.

Please Note:

Ability to use NTLM authentication in the WWW Proxy is available only to WinGate 6 Pro and Enterprise licenses.

©2009 Qbik New Zealand Limited


Authentication methods - GateKeeper

GateKeeper authentication

GateKeeper can be used by the clients on the network to authenticate themselves with WinGate so they can access Internet services.

It communicates with the WinGate engine using the Remote Control Service so this is the service that you are authenticating for (and is the highest level of authentication). In order for users to be able to authenticate with the GateKeeper.exe, the internal network interface should be bound to the Remote Control Service.

To use GateKeeper to authenticate users in WinGate:

  1. Configure the Remote Control Service

    1. Open GateKeeper.
    2. Select the Remote Control Service from the System tab on the GateKeeper Contol Panel.

    3. Select the Bindings configuration, and if there is no internal interface in the Binding Policy window then click the Add button.

      Remote Control Service - Bindings configuration

      Close | Close all images

    4. On the Dynamic Binding Policy dialog that appears, select either the specific internal network interface that is listed, or the Any Internal Adapter check box.

      Dynamic Bindings Policy

      Close | Close all images

    5. Click OK, and you will be returned to the Remote Control Service bindings configuration. You will now see the Internal adapter in the Binding policy window.
    6. Click OK to exit the Remote Control service.

  2. Configure the GateKeeper.exe

    1. Copy GateKeeper.exe from the WinGate server \WinGate installation directory to a location on the remote machine.
    2. On the remote machine open the newly copied GateKeeper.exe.

    3. Enter the following information when logging on:

      Remote GateKeeper logon

      Close | Close all images

      • Username:

        A WinGate user account (not Windows unless using the Operating System (Windows) database option.)

      • Password:

        The password for the WinGate user account entered.

      • Server:

        The network name or IP address of the computer that WinGate is running on.

      • Port:

        This will always be Port 808 (unless you explicitly change the port that the Remote Control Service runs on).

Once a user has successfully logged into GateKeeper (the user has been authenticated) they can now use normal Internet applications to access the Internet, without needing to use GateKeeper. However if the user does not communicate with the WinGate within the time out period set in the Remote Control Service, they will need to re-authenticate through GateKeeper to access the Internet again.

If users are having problems logging into GateKeeper then check the bindings on the Remote Control Service. Make sure that this service is bound to the interface that users on the network will connect to WinGate on (LAN interface).

Note:

If there is no Administrator password set, then WinGate will not allow the Remote Control Service to bind to any publicly visible (external) interfaces (e.g. the Internet). This is to prevent intruders from the Internet zone logging into your WinGate engine and making changes.


Authentication methods - WGIC

WinGate Internet Client authentication

When WinGate clients on the network have the WinGate Internet Client (WGIC) installed, you can require them to securely authenticate themselves through the Winsock Redirector Service on the WinGate server.

This is configured by setting the authentication policy in the policies configuration of the Winsock Redirector Service in GateKeeper on the WinGate server.

Requiring users to authenticate for Winsock Redirector Service has the following advantages:

  • Prevents unauthorized users gaining Internet access from unattended computers.
  • Prevents users installing their own unauthorized copy of the WinGate Internet Client.
  • Provides improved control and logging of individual users.

To configure WinGate to authenticate users with WGIC:

  1. Select the Winsock Redirector Service from the System tab in the GateKeeper Control Panel.

  2. Select the Policies configuration.

    Winsock Redirector Service - Policies configuration

    Close | Close all images

  3. Select the User can access this service from the Right drop down menu at the top of the screen, then click the Add button.

  4. On the Properties for new recipient dialog that appears select the Recipient tab.

    Properties for new recipient screen

    Close | Close all images

  5. Select either the Everyone radio button, or Specify user or group and select the desired user or group who you want authenticated.
  6. Select the User must be authenticated radio button at the bottom of the Recipient tab.
  7. Configure any other desired options that will be applied to this policy.

  8. Click OK to return to the Policies configuration of the Winsock Redirector Service.

    Winsock Redirector Service - Policies configuration

    Close | Close all images

  9. Select the are ignored option from the Default rights (System policies) drop down menu.
  10. Click OK to confirm your changes and exit the Winsock Redirector service configuration.

Now all client computers will be presented with the WGIC Login dialog the first time an application attempts to connect to WinGate.

WGIC Login dialog

Close | Close all images


Authentication methods - Java authentication

Java authentication

The WinGate Logon java applet is a multi-purpose tool for authenticating WinGate users.

Java Logon applet

Close | Close all images

The applet is loaded by any web browser when ALL of the following are true:

  1. The web browser is set to connect to the Internet with the WinGate Proxy.
  2. The WWW Proxy Service is configured to use Java Client authentication as required by policies (enable this with the checkbox on the General configuration of the WWW Proxy Service properties)
  3. The System or Service policies require that the User must be authenticated (this option is available by double-clicking a policy recipient e.g. Everybody)

To use the WinGate Java logon to authenticate users using the WWW Proxy through WinGate:

  1. Configure the Remote Control Service:

    1. Open GateKeeper.
    2. Select the Remote Control Service from the System tab on the GateKeeper Control Panel.

    3. Select the Bindings configuration, and if there is no internal interface in the Binding policy window then click the Add button.

      Remote Control Service - Bindings configuration

      Close | Close all images

    4. On the Dynamic Binding Policy dialog that appears, select either the specific internal network interface that is listed, or the Any Internal Adapter check box.

      Dynamic Bindings Policy

      Close | Close all images

    5. Click OK, and you will be returned to the Remote Control service bindings configuration. You will now see the Internal adapter in the Binding policy window.
    6. Click OK to exit the Remote Control service.

  2. Configure the Authentication policy:

    1. Select the WWW proxy service from the Services tab in the GateKeeper Control Panel.
    2. On the General configuration under the Authentication where required by policies section, tick the Java Client checkbox.

      (Please note that this will not be available when using the Operating System/Remote user database with WinGate, as Java doesn't support the use of NTLM authentication mechanisms.)

      WWW Proxy service general screen

      Close | Close all images

    3. Select the Policies configuration.

      WWW Proxy server - Policies configuration

      Close | Close all images

    4. Select the User can access this service from the Right drop down menu at the top of the screen, then click the Add button.

    5. On the Properties for new recipient dialog that appears select the Recipient tab.

      Properties for new recipient - Recipient tab

      Close | Close all images

    6. Select either the Everyone radio button, or Specify user or group and select the desired user or group who you want authenticated.
    7. Select the User must be authenticated radio button at the bottom of the Recipient tab.
    8. Configure any other desired options that will be applied to this policy.

    9. Click OK to return to the Policies configuration of the WWW Proxy service.

      WWW Proxy server - Policies configuration

      Close | Close all images

    10. Select the are ignored option from the Default rights (System policies) drop down menu.
    11. Click OK to confirm your changes and exit the WWW Proxy service configuration.

Users will now be presented with the Java Logon applet whenever they attempt to access the Internet with their browser.

Though the user must use a web browser to load the applet, this authentication works for WinGate Services other than the WWW proxy service.

e.g.

You can configure the FTP Service to User must be authenticated.

To authenticate themselves, (if the WGIC is not running) the users simply start their web browser and logs into the Java Applet.

Once the login is complete, the users can start the FTP client and will be authenticated.

Note:

  • The Remote Control Service must be bound to the local LAN Interface (Internal adapter) for Java authentication to work. (See the RCS steps above)

  • The Java Applet will only appear when a particular user requires a higher level of authentication for the request being made.

    For example, if you configure the WWW Proxy Service to User may be assumed then the applet will only be served to non-assumed users.

  • Java Login will Not work when NT Authentication is used by WinGate (The Java Authentication will not be available in the WWW proxy when this is the case).


Assumed users

Assumed users are a method of tracking users without requiring your users to log into WinGate. You can set up assumptions so that when someone connects from a known location (identified by either an IP address or machine name), they will be assumed to be a given WinGate user.

Assumptions can save users from logging in. If certain computers are only ever used by one person, then set up an assumption and they will not be required to log in to authenticate.

Adding an assumption:

  1. Open GateKeeper.

  2. Select the Users tab on the GateKeeper Control Panel.

    Close | Close all images

  3. Double click on the Assumed Users icon. This will open the Assumed users dialog.

    Assumed Users configuration

    Close | Close all images

  4. Select By IP Address tab for an IP-based assumption. Or select By Name tab for a computer name-based assumption (this is the NETBIOS or Windows networking name of the computer).

  5. Click Add. This will bring up the Location dialog

    Close | Close all images

  6. Type in a computer name or IP address for which you wish to make an assumption.
  7. Choose the user you wish to assume will be using that computer.
  8. Click OK.

Notes:

  • Only WinGate DHCP clients can use computer name-based assumptions.
  • When you set up IP assumptions (locations) you can use the wild card * to mean ‘any’.
  • IP Assumptions are read from the top down. They will associate with the first match.

e.g.:

192.168.0.1 john

192.168.0.3 alf

192.168.*.* fred

192.168.0.* cilla

The problem here is that Cilla will never be reached because line 3 - fred, covers anything that is not 192.168.0.1 or 192.168.0.3. If Cilla was promoted like this:

192.168.0.1 john

192.168.0.3 alf

192.168.0.* cilla

192.168.*.* fred

Then Cilla would be assumed for any connection from the 192.168.0.* range of IPs except 192.168.0.1 and 192.168.0.3, and if someone connected from the IP address 192.168.1.12, it would be associated with Fred.

There is an implicit assumption of *.*.*.* ? Guest, as anyone who has not logged in, and has no assumption, is in fact a Guest. This is logically at the bottom of the list, as it will associate with any IP.


NTLM authentication

Administrators can utilize the NTLM authentication mechanism used by Windows operating systems to help authenticate users with WinGate.

This form of authentication requires the Operating System(Windows)/ Remote user database option to be in use in WinGate.

Both the WinGate Internet Client (WGIC) and GateKeeper authentication methods support using NTLM. Unfortunately it is not compatible with Java authentication method.

To use NTLM with WGIC or GateKeeper authentication:

  1. Make sure WinGate is set to use the Operating system/Remote (Windows) user database.
  2. Configure clients to use either WGIC Authentication or GateKeeper Authentication.
  3. Users will need to log in using a valid Username and password from the chosen Operating system database.
  4. Once authenticated in WinGate, users will appear on the Activity tab in GateKeeper as Authenticated NTLM.

Using NTLM with the WWW Proxy

When clients with browsers that support NTLM (Internet Explorer other Windows based browsers) are set to use a proxy server they can be authenticated via NTLM with the WWW Proxy WinGate.

This can be useful in an Active Directory situation where group policy can be centrally set on the browser configuration settings (namely setting what the default proxy server (WinGate) is).

As this group policy can be set to affect all browsers across the network, it provides an easy implementation of authentication and control of Internet access without the need for individual client configuration, as all clients will now be authenticated via NTLM through WinGate.

To use NTLM with proxy clients through WinGate:

  1. On the Server

    1. Select the WWW proxy service from the Services tab in the GateKeeper Control Panel.

    2. On the General configuration under the Authentication where required by policies section, tick the NTLM checkbox.

      (Please note that this will only be available when using the Operating System/Remote user database with WinGate, as mentioned above.)

      WWW Proxy server - General configuration

      Close | Close all images

    3. Select the Policies configuration.

      WWW Proxy server - Policies configuration

      Close | Close all images

    4. Select the User can access this service from the Right drop down menu at the top of the screen, then click the Add button.

    5. On the Properties for new recipient dialog that appears select the Recipient tab.

      Properties for (new) recipient screen

      Close | Close all images

    6. Select either the Everyone radio button, or Specify user or group and select the desired user or group who you want authenticated.
    7. Select the User must be authenticated radio button at the bottom of the Recipient tab.
    8. Configure any other desired options that will be applied to this policy.

    9. Click OK to return to the Policies configuration of the WWW Proxy service.

      WWW Proxy server - Policies configuration

      Close | Close all images

    10. Select the are ignored option from the Default rights (System policies) drop down menu.
    11. Click OK to confirm your changes and exit the WWW Proxy service configuration.

  2. On the Client

    1. Set the browser to use a proxy server (the IP address of the WinGate server)
    2. Depending on the browser used, you can set the browser security settings for user authentication to Use current Windows Username and Password. This will save the user having to enter their Username and password every time the open a browser session. Obviously this must be a valid Windows user and password in the database that WinGate has been set to use.

Please Note:

Use of NTLM Authentication in the WWW Proxy is only available to WinGate 6 Pro and Enterprise licenses

©2009 Qbik New Zealand Limited


Multi-user Machines

The Multi-user Machines support in WinGate allows individual authentication of multiple users who are using a terminal server to access the Internet. In most normal circumstances WinGate would only see one user connecting (with multiple sessions) from the terminal server.

However with the advent of WinGate 6.1 it is possible to authenticate each simultaneous individual user access from the terminal server, in WinGate.

The purpose of the Multi-user machine configuration is to enable you to list the IP addresses of Terminal Servers used on the network. This way when multiple users use the specified Terminal server to access the Internet, they can be individually authenticated through WinGate.

To add a Multi-user Machine:

  1. Open GateKeeper.

  2. Double click on the Multi-user Machines icon in the Users tab in the GateKeeper Control Panel.

    Multi-user Machine support

    Close | Close all images

  3. On the Multi-user Machines configuration, enter the IP address of the machine that has been designated as a terminal server(s).

    Multi-user Machines configuration

    Close | Close all images

  4. Click Add to add the IP.
  5. Conversely, you may highlight any listed IP address and click delete to remove an IP from this list of terminal servers.
  6. Click Ok.

Example of Multi-user activity in the Activity tab

Multi-user Machine activity, the terminal server using WGIC for client access

Close | Close all images

Note:

Since users are individually logging on to the Terminal server (Windows OS), WinGate must be set to use the Operating System (Windows)/ Remote Database to use NTLM for authentication.

Please Note:

Multi-user Machine support is only available in WinGate 6.1 when using an Enterprise license.

©2009 Qbik New Zealand Limited


WinGate policies and rights

Security in WinGate is managed by the assignment of various rights to individuals and groups (and these assignments form policies). In this manner, WinGate security operates in a similar way to the Windows NT user system.

Policies in WinGate can be implemented at both the system level (all WinGate operations) and on a service-by-service basis. You can create a mix of policies at both levels to enforce the level of security required for your network.

System policies

System policies are the primary way for implementing security and control with WinGate. Policies can be defined per user, per group as well as per time of day, and can be restricted on a per request basis. These are the overall restrictions that apply to all services (unless these are overridden at the service policy level).

Click here to learn more about assigning rights through System policies

Service policies

Service policies are the secondary way for implementing security and control with WinGate. These rules are evaluated only for the service that they are applied to.

Click here to learn more about assigning rights per Service with GateKeeper

Rights available in WinGate

Policies are created by assigning rights to users and groups (Recipients).

Click here to learn more about the Rights available in WinGate

Recipient properties configuration

When creating a policy in WinGate you can configure other options specifically for that recipient of that policy.

Click here to learn more about the configuring Policy recipient options


System policies

The System Policies configuration located on the Users tab in the GateKeeper control panel, allows you to set policies across all operations in WinGate, unless they are integrated with separate per Service policies. Click here to read about integrating System and Service policies.

System Policies configuration

Close | Close all images

To add/edit rights for a Recipient through System Policies:

  1. Open GateKeeper.
  2. Select the System Policy icon on the Users tab in the GateKeeper Control Panel.

  3. The System Policies configuration will appear.

    System Policies configuration

    Close | Close all images

  4. Select the desired right from the Right drop down menu.
  5. Click the Add button to add a new recipient to that right.

  6. This will bring up the Properties for new recipient dialog.

    Properties for new recipient screen

    Close | Close all images

  7. On the Recipient tab, select either the Everyone or Specify user or group radio button to choose the intended users/groups.
  8. Configure other desired options (such as Time and location restrictions etc) for the chosen recipient that will be applied to this policy.
  9. Click OK to exit to Properties of new recipient screen.
  10. On the System Policies configuration check that the new recipient(s) have been added to the Right.

Important Note:

In WinGate EVERYONE is assigned access under Users can access services/this service policy.

This is done primarily so that access to all services is available until restricted by the Administrator through either System or Service policies.

This effectively allows the Administrator access to the Remote Control service so that they can log into GateKeeper for the first time. If EVERYONE is removed then this will deny all access to the Remote Control service, and so no-one including the Administrator will be allowed to log into WinGate.

DO NOT remove EVERYONE entry from the Users can access services/this service policy in System Policies unless the ADMINISTRATOR has been given specific rights to access the Remote Control service. Alternatively, you can configure the Remote Control Service so that it ignores System Policies and will use the Service policy that has been assigned instead.

If you happen to find that EVERYONE has been removed from the Users can access services/this service policy in System Policies, then use the following steps to bring back this functionality to WinGate:

  1. Back up the WinGate registry.
  2. Open the Registry with RegEdit and locate the following key HKLM\Qbik Software\WinGate\DefaultRights\Access
  3. Add the following Subkeys:

    Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Qbik Software\WinGate\DefaultRights\Access\Recipient0]

    "UserName"="Everyone"

    "Description"="Unrestricted rights"

    "SpecifyUser"=dword:00000000

    "SpecifyLocation"=dword:00000000

    "SpecifyTime"=dword:00000000

    "SpecifyBan"=dword:00000000

    "SpecifyRequest"=dword:00000000

    "MinimumSecurityLevel"=dword:00000000

    Key :[HKEY_LOCAL_MACHINE\SOFTWARE\Qbik Software\WinGate\DefaultRights\Access\Recipient0\BanFilter]

    "Name"=""

    "Description"=""

    Key:[HKEY_LOCAL_MACHINE\SOFTWARE\Qbik Software\WinGate\DefaultRights\Access\Recipient0\ExcludedLocations]

    Key:[HKEY_LOCAL_MACHINE\SOFTWARE\Qbik Software\WinGate\DefaultRights\Access\Recipient0\IncludedLocations]

    Key:[HKEY_LOCAL_MACHINE\SOFTWARE\Qbik Software\WinGate\DefaultRights\Access\Recipient0\RequestFilter]

    Key:[HKEY_LOCAL_MACHINE\SOFTWARE\Qbik Software\WinGate\DefaultRights\Access\Recipient0\TimeFilter]

    "Name"=""

    "Description"=""


Service policies

WinGate allows administrators to set policies on a per service basis. These are accessible from the Policies configuration of each service.

Close | Close all images

Although these rights are worded the same as the System policy rights, they are only imposed on the service that they are being configured for.

It is possible to integrate these to work with System policies for tighter security and control.

Click here to learn more about integrating System and Service policies

There are 3 rights to which users can be assigned in any service:

  1. Users can access this service

    This right specifies which users can use this service, and what requests they can make.

  2. Users can modify this service

    This right specifies which users can modify the settings of this service.

  3. User can start/stop this service

    This right specifies which users can start or stop this service.

To add/edit rights for a recipient through Policies on each User service:

  1. Open GateKeeper.
  2. Select the desired service from the Services tab in the GateKeeper Control Panel.
  3. Select the Policies configuration.
  4. Select the desired right from the Right drop down menu.

  5. Click the Add button to add a new recipient to that right. This will bring up the Properties for new recipient dialog.

    Properties for new recipient dialog

    Close | Close all images

  6. On the Recipient tab select either the Everyone or Specify user or group radio button to choose the intended users/groups.
  7. Configure other desired options (such as Time and location restrictions etc) for the chosen recipient that will be applied to this policy.
  8. Click OK to exit to Properties for new recipient dialog.
  9. On the Policy configuration screen, check that the new recipient(s) have been added to the Right.

When you access the Internet or change WinGate configuration, WinGate will look through the recipient list assigned to that event. It either finds a recipient with that right, or reaches the end of the list of recipients.

If it fails then the right is not granted, and the user will be denied access. If the recipient is found with that right then that right is granted and subject to the conditions in the Recipient properties.

Click here for more information on Recipient properties


Integrating System and Service policies

This is the key to a comprehensive security policy with WinGate.

It is important to integrate the policies that apply for individual services (Service Policies) with those policies that apply to everything, system-wide (System Policies).

You do this by specifying one of the options below when you define rights/policy for a particular Service.

The default rights (System policies) setting is found at the front of the Policies configuration of each service.

Close

The settings are:

  • are ignored

    The service will grant access if its rules allow the specific request, ignoring the default rights. This means System Policies do not apply for this service (the policies configured and subsequent recipient options will be the only security for that service).

  • may be used instead

    The service will grant access if its rules allow the specific request OR if the default rights allow the specific request. This option is called may be used instead and is the default. This means that something permitted by the Service Policies may be restricted by the System Policies. This implements two-levels of security so is a reasonably secure approach.

  • MUST also be granted

    The service will grant access if the service policies allow access AND the default rights allow the specific request. This option is called MUST also be granted. This is the greatest level of security as both policies must explicitly grant rights for a user. Of course it is also the least flexible of these three approaches.


WinGate policy rights

  • System Policies

    System Policies define the default access and control rights to WinGate services and functions.

    System policy rights are configurable in the System Policies configuration.

    System Policies configuration

    Close | Close all images

    This can be accessed by clicking the System Policies icon on the Users tab in GateKeeper.

    System Policies icon

    Close | Close all images

    Click here for details on how to configure System Policies.

    System Right

    Description

    Users can create/delete services

    Users with this right can create or delete WinGate services in GateKeeper.

    Note:

    All other service rights (except for Users can access services) are dependant on the user having this right.

    Users can access services

    This right specifies which users can use services, and what requests they can make.

    User can start/stop services

    This right specifies which users can start or stop WinGate services.

    Users can modify services

    This right specifies which users can modify the settings of WinGate services.

    Users have simultaneous access from multiple computers

    This right allows users to access services from more than one computer at once. The Administrators have this right by default.

    Users can create and edit users

    This right specifies which users can modify the user database, creating and editing users and groups.

    Note:

    All other user rights are dependant on the user having this right.

    User has power user rights

    This right covers a range of administrator-type activities, but which do not necessitate separate rights themselves. By default this right is assigned to the administrator group only.

    Users can monitor activity on this server

    This right specifies which users can monitor activity on the server. This allows the user to see the status of all sessions on the server.

    Users can delete sessions from this server

    This right specifies which users can delete sessions from the server.

    Users can modify and control system policies

    This right specifies which users can modify system policies. If a user does not have this right then the icon for policies will not appear.

    Users can modify and control WinGate dialer

    Users with this right can modify and control WinGate dialer profiles.

    Users can modify and control WinGate cache

    Users with this right can modify and control WinGate cache settings through GateKeeper.

    Users can shutdown WinGate

    Users with this right can shutdown the WinGate service itself. It is recommended that only Administrators be allowed this right, as it is not correctable with GateKeeper. To restart the service it must be started in Control Panel (NT) or with the ‘Start WinGate Engine’ icon in the WinGate group.

    Users can change WinGate license

    This right allows the recipient to change the license details in the System info section.

    Users can change WinGate scheduler

    This right lets the Administrator control who has access to edit the scheduler. This should only be available to a select group, say Administrators and Backup operators.

  • Service Policies

    These are accessible from the Policies screen of each service.

    Close | Close all images

    There are 3 rights to which users can be assigned in any Service:

    Right

    Description

    Users can access this service

    This right specifies which users can use this service, and what requests they can make.

    Users can modify or delete services/this service

    This right specifies which users can modify the settings of this service or even delete it.

    User can start/stop this service

    This right specifies which users can start or stop this service.

Note:

You will see that these rights are the same as the service rights found in the System Policies, however it must be remembered that the service rights above are being set on the particular service where as the System policies are set System wide.

Click here to learn more about integrating System and Service policies


Setting rules

The flexibility of the WinGate rules (filters) allows many options when setting the User can access this service/services right in the Service and System Policy configurations. You can specify criterion on which the filters will work.

There are two main places where rules can be created:

  1. The Ban list or Advanced tabs on the Recipient properties configuration when setting a User can acess this service/these services System or Service policy.
  2. Caching

Services example:

You may want to allow access only to a certain site, e.g. www.wingate.com pages.

  1. Open GateKeeper
  2. Open the WWW proxy properties on the Services tab of the GateKeeper Control Panel.

  3. Select the Policies configuration.

    Close | Close all images

  4. Select the Users can access this service option from the Right drop down menu.
  5. Double-click the recipient you wish to restrict, or click Add to add a new recipient. This will open the Properties for new recipient dialog.

  6. Select the Recipient tab.

    Close | Close all images

  7. Select either Everyone or Specify user or group radio button, to choose who will be affected by this policy.

    Note:

    If this policy is for specific users or groups then you must select either the user may be assumed or user must be authenticated radio button options for WinGate to identify the user so it can implement the policy.

  8. Select the Advanced tab.

    Close | Close all images

  9. Select the Specify which requests this recipient has rights for radio button.
  10. Click Add Filter to add a new filter.

  11. Click the Add Criterion button. This will open the Criterion dialog

    Close | Close all images

  12. Select the This criterion is met if radio button.
  13. Select Server name contains www.wingate.com.
  14. If you want to add more sites, add more filters with an appropriate criterion.
  15. Click OK to exit the Recipient properties dialog.

  16. On the main Policy screen of the WWW service, set the Default rights (System policies) option to are ignored. This will make sure that this policy is always applied over any system policy.

    Policy Default Rights

    Close | Close all images

In the above example you could create different filters (with similar criterion) like this and this will allow any pages from the listed sites, but nothing from any other sites.

Evaluating Filters and Rules

Essentially, all filters in a policy are joined with Boolean/conditional ORs. This means that if either filter evaluates to true, then the activity is restricted/allowed (depending on how you have configured it).

On the other hand, the rules criterion within filters are joined with Boolean/conditional ANDs, which means that they must all evaluate to true for the specific filter to apply.

  • AND

    If criteria are joined with an AND, then they must all evaluate to true for the rule to apply.

  • OR

    If criteria are joined with an OR, then only one of the criteria must evaluate to true for the rule to apply.

  • NOT

    This means that a rule will apply if the criteria does not evaluate to true.

You have access to a number of variables when specifying a criterion. Here is the list of variables that you have access to when setting up criteria.

In this list, All means all services except DHCP.

Criterion Variables

Variable

Variable Type

Services

Description

Client IP number

String

All

The IP address the user is connected from

Client port number

Number

All

The port number on the client’s computer

Client NetBIOS name

String

All + DHCP

The network name of the computer connecting

Client MAC address

String

All + DHCP

The MAC address of the LAN adapter in the requesting computer

Client is a DHCP client

True/False

All

The connecting computer has an IP assigned by WinGate.

Server name

String

All

The name or IP of the server the client has asked to be connected to

Server port number

Number

All

The port number on the server the client has asked to be connected to

User: Username

String

All

The username (in WinGate) of the client. This is the account to which data and time will be recorded

User: Authentication level

Number

All

The user authentication level. 0 = unknown user 1 = Assumed 2 = Authenticated.

User: Bytes sent to client

Number

All

The number of bytes sent to date to the client from WinGate

User: Bytes received from client

Number

All

The number of bytes received to date from the client by WinGate

User: Bytes sent for client

Number

All

The number of bytes sent to date by WinGate on behalf of the client (e.g. to servers)

User: Bytes received for client

Number

All

The number of bytes received to date by WinGate on behalf of the client (e.g. to servers).

User: Seconds on line

Number

All

The number of seconds the user has been accessing WinGate to Date

User: Account balance

Number

All

The user’s account balance

Session description

String

All

Description of session

HTTP Protocol

String

WWW

The protocol the user has requested in the URL, e.g. http, ftp, wais, ssl, gopher

HTTP Method

String

WWW

The HTTP command sent by the user, e.g. GET, HEAD, LIST, PUT, CONNECT, POST

HTTP Resource

String

WWW

The file requested by the user

HTTP URL

String

WWW

The full URL

HTTP POST data

String

WWW

The contents of any form sent using the POST method

HTTP Query string

String

WWW

The contents of the query string. This is normally the contents of a form posted by the GET method

HTTP Header field

String

WWW

Any specified HTTP request header as defined in the HTTP protocol standard. You must supply the name of the field e.g. "User-Agent", "If-Modified-Since", etc

Is Non-proxy method

True/False

All Proxies

Whether the request was a non-proxy request

Session was handed over

True/False

WWW

Whether the session was handed over from SOCKS

POP3 Username

String

POP3

The username of the POP3 mailbox the user is accessing

FTP Username

String

FTP

The username on the FTP server the user is accessing

VDOLive File

String

VDOLive

The file requested by the VDOLive player

SOCKS Protocol version

Number

SOCKS

The SOCKS protocol version number - 4 or 5 are valid

SOCKS Command

Number

SOCKS

the SOCKS command 1 = connect2 = bind3 = UDP associate (SOCKS5 only)

SOCKS Address type

Number

SOCKS

the SOCKS address type (relevant for SOCKS5 requests only)1 = IP42 = Name 3 = IP6 (not supported)

The variable type determines what comparisons you can make with that variable. If the variable is a number, you can check whether a number you specify is greater than, less than, or equal to the variable you select.

If the variable is a string then you can apply comparisons such as "contains", "begins with", "ends with" or is "empty".


Policy recipients - Recipient tab

When adding recipients to a right in a System or Service policy, there are a number of configurable options that you can apply to the Policy recipient.

These are found on the Properties of the recipient dialog which is opened when you add or edit a policy in WinGate.

Recipient tab

The Recipient tab in the Properties of the recipient dialog specifies who is the recipient of the right you are editing.

Properties of recipient - Recipient tab

Close

You may choose Everyone, or Specify user or group.

The Administrator can choose from three levels of authentication:

( Click here to read about the methods of authentication available in WinGate )

  1. Selecting the User must be authenticated option lets you require users to authenticate with WinGate.
  2. Selecting the User may be assumed option allows authenticated and assumed users, but non-authenticated users from an unknown location will be denied.
  3. Selecting User may be unknown means that this recipient applies to anyone.

Properties of the recipient tabs:

  • Location tab
  • Time tab
  • Ban list tab
  • Advanced tab

Click here to read more on setting rules, filters, and criterion


Properties of recipient - Location tab

The Location tab is used to restrict the locations where the recipient can use the right.

Propeties of recipient - Location tab

Close

A user connecting from any of the included locations is a valid recipient.

A user connecting from any of the excluded locations is not a valid recipient.

This allows you to restrict rights based on the location of the user.

You can specify rights that are available from:

  • Everywhere
  • A range of IP numbers (by use of a filter)
  • A single IP

In order for the right to be granted, the IP number of the computer that the user is on must match at least one Included location, and must not match any of the Excluded locations.

An IP Filter can contain wild cards, allowing you to specify a range of IP addresses.

By using wild cards (e.g. the characters ‘?’ and ‘*’) you can tell WinGate to ignore certain parts of the IP address when comparing against the location restrictions.

These wild cards work in the same way as they do for DOS filenames, so if you are familiar with this then this concept should be easy.


Properties of recipient - Time tab

The Time tab allows you to specify when the recipient has rights.

Properties of recipient - Time tab

Close | Close all images

You can specify always, or you can specify times when the recipient has the rights, and times when the recipient does not have the rights.

You do this by adding time-slices to the included times or excluded times.

Close | Close all images

If you choose to specify when the recipient has rights, then you must add an included time for when you want the right to apply.

You can specify times on a regular or one-off basis, so you can set up rules like "every weekday from 09:00:00 to 17:00:00" or "From 12-Jan-97 12:00:00 to 13-Jan-97 12:00:00".


Properties of recipient - Ban list tab

The Ban list tab found on the Recipient properties dialog, is the most useful tab for limiting users access.

Properties of recipient - Ban list tab

Close | Close all images

This list bans anything that matches any of the criteria. In the example given below , no one can access the server 'Naughty.com'. Bans can be made globally with System Policies, or configured on a per-service basis.

Example

To add a Global ban for www.naughty.com:

  1. Open GateKeeper.

  2. Open Users tab on the GateKeeper control panel and select System Policies icon to open the System policies dialog.

    System Policies dialog

    Close | Close all images

  3. Double click the Everyone recipient in the window to bring up the Properties for Everyone recipient dialog.

  4. Select the Ban list tab.

  5. Select Enable ban list check box.
  6. Click Add.

  7. On the new Criterion dialog select This criterion is met if radio button.

    Close | Close all images

  8. Select Server name, equals
  9. Enter the name you wish to ban, i.e. www.naughty.com
  10. Click OK.

The ban will then appear as a filter in the Ban list window.

Note:

  • The Ban list tab is only available when setting a policy on the User can access this service/access services right.
  • A recipient is banned if any criteria match the global or service ban list.
  • Anything you ban is inaccessible for that recipient.
  • It is easier to ban URLs containing certain words than complete URLs or sites.
  • You can deny access to certain parts of a site with a ban of URL contains 'www.servername.com/dir1/dir2/'. This will allow access to any other part of a site. This can be used for access control depending on logged on user or group.


Properties of new Recipient - Advanced tab

Properties of recipient - Advanced tab

The Advanced tab allows you to place restrictions on the request that a user can make when accessing a service. You can specify combinations of required and banned criteria in order to limit the requests your users can make.

Propeties of recipient - Advanced tab

Close

If you choose to specify which requests the recipient has rights for when they access this service then you specify filters and criteria.

If you specify no included criteria, then there are no restrictions. This dialog follows the same logic as the Caching configuration.

Note:

The Advanced tab is only available when setting a policy on the User can access this service/access services right.

Click here to read more on setting rules, filters, and criterions


WinGate in an Active Directory

WinGate has been designed to work well within an Active Directory domain, however there are some considerations that Administrators should be aware of to make WinGate function correctly within this type of environment.

Active Directory overview

When implementing WinGate in a native mode Active Directory environment, there are some features of the Active Directory that will affect the way that WinGate needs to be configured.

Active Directory requires a DNS server be available to register client IP address details and resolve DNS lookups for client machines in the AD. DNS servers are also required by clients to find info about Domain Controllers in the AD. When a domain controller is set up correctly it registers specific AD info (through SRV records) with the Active Directory DNS server.

To provide Internet address resolution for clients in the Active Directory, the Active Directory DNS server properties has a Forwarders tab which can be set to a specify an Internet DNS server that it will refer to for DNS requests that are outside of the domain that it is responsible for, if it is unable to resolve the Internet DNS lookup for the client.

Client workstations will use the AD DNS server for the Domain requests for their Active Directory, and any Internet requests will be forwarded to the Internet DNS server specified in the Forwarders configuration if the Active Directory DNS server is unable to resolve the request itself. (Common if the Active Directory DNS server is not connected directly to the Internet)

Active Directory and WinGate

  • Using WinGate for client Internet DNS lookups

    As mentioned above, if the Active Directory DNS server does not have a direct connection to the Internet, or cannot resolve Internet DNS requests for clients then you can set the Active Directory DNS server to forward all client Internet DNS requests to WinGate to resolve:

    To use WinGate for client Internet requests:

    1. When WinGate is being used in the Active Directory, and you wish to have WinGate take care of client Internet DNS requests, then the private IP address used on the internal network interface of the WinGate server should be listed in the Forwarders tab in the properties on the Active Directory DNS server.

      This is found in the AD DNS server's properties (configured in the DNS.mmc).

      This way all of the clients Internet DNS requests will be forwarded by the Active Directory DNS server to the WinGate server for completion.

    2. The internal IP address of the Active Directory server should be placed in the DNS server option of the WinGate Advanced Options that is found under Start Menu\Programs\WinGate\Advanced Options.

      WinGate Advanced Options

      Close

      This is required to prevent DNS loops occurring between WinGate and the Active Directory DNS server.

  • Using the Active Directory DNS server for Internet DNS lookups

    Since all client workstations in the Active Directory will have their DNS network setting pointed at the Active Directory DNS server (this is an Active Directory requirement) all of their DNS request both local and Internet can be resolved by the Active Directory DNS server. There is no requirement in this situation for the WinGate server IP address to be entered on the Forwarders tab of the Active Directory DNS server properties.

  • WinGate installed on the same machine as the Active Directory DNS server

    If WinGate has been installed to the same machine running the Active Directory DNS Server, then there is no requirement for WinGate DNS. In this situation the DNS service in WinGate should be disabled as the Active directory DNS Server running on the machine will already provide DNS resolution.

  • DHCP considerations

    In most Active Directory scenarios clients will be receiving IP address details (and other network settings) from a Microsoft DHCP server on the network.

    If WinGate clients are using NAT (Network Address Translation) client connection method through WinGate, then Administrators should make sure that the Router (Gateway) option in the Microsoft DHCP Server configuration, is set to issue clients with the internal IP address of the WinGate server.

    Due to the common use of DHCP in Active directory, the WinGate DHCP service should be disabled so it does not to interfere with the Active Directory DHCP server operations.

  • User database

    Since a major goal of Active Directory is to have strong control of users and groups, this can be further enhanced when using WinGate Enterprise licence, by having WinGate utilize the user database of the Active directory domain for its control of user access.

    Once WinGate is installed, this can be configured through the Database options found on the Users tab in GateKeeper.

Click here for step by step procedures on configuring WinGate in an Active Directory


Configuring WinGate in an Active Directory

WinGate has been designed to work in an Active Directory. While the set up of Active Directory domains (and forests) can vary depending on particular scenarios, there are several configuration requirements for WinGate to function correctly in an Active Directory.

The WinGate server

  • DNS

    If WinGate is installed on the SAME machine as the Active Directory DNS server:

    1. Open GateKeeper.
    2. Select the DNS service from the System tab on the GateKeeper Control Panel.

    3. Select the General configuration.

      DNS Service General configuration

      Close | Close all images

    4. From the Service startup drop down menu select Service is Disabled.
    5. Click OK.

    This will stop the DNS service in WinGate and prevent it from starting again, so that it will not interfere with the Active Directory DNS server. WinGate's DNS service is not required in this situation.

    The external network interface (Internet connection) will have an upstream DNS server, which WinGate will use when the Active directory DNS server (on the same machine) cannot resolve domain name requests made by WinGate clients. There is no other configuration required.

    If WinGate is installed on a different machine to the Active Directory DNS server then you can either choose to use the Active Directory DNS Server for client Internet DNS lookups or you can have clients use WinGate for their Internet DNS lookups.

    Using WinGate for Internet DNS lookups:

    1. Open the Active Directory DNS Server MMC.
    2. Right click on the DNS server and select properties.
    3. In the DNS server properties, select the Forwarders tab.
    4. In the Forwarders tab enter the LAN IP address of the WinGate server.
    5. Click OK to save changes to the DNS server.

    This will allow all client DNS requests that can't be answered locally by the Active Directory server to be forwarded to WinGate (and the Internet) for resolution. This is particularly helpful in scenarios where the Active Directory DNS server is not connected to the Internet.

    The next step is done on the WinGate server:

    1. Open the WinGate Advanced options in the WinGate programs entry on the start menu.

    2. Select the DNS Servers option.

      Advanced Options - DNS screen

      Close | Close all images

    3. Enter the LAN IP address of the Active Directory DNS server.
    4. Click OK.

    This step is IMPORTANT to prevent DNS looping across the network.

    Using the Active Directory DNS server for Internet DNS lookups:

    Since all client workstations in the Active Directory will have their DNS network setting pointed at the Active Directory DNS server (this is an Active Directory requirement) all of their DNS request both local and Internet can be resolved by the Active Directory DNS server.

    There is no requirement in this situation for the WinGate server IP address to be entered on the Forwarders tab of the Active Directory DNS server properties.

    However the Active Directory DNS server IP address should be entered into the WinGate Advanced configuration. (as described above) to prevent DNS looping across the Active Directory.

  • DHCP

    WinGate offers a comprehensive DHCP service, to allow for ease of IP addressing across the network, however it does not offer the registration of client IP address with the Active Directory DNS server.

    Due to the important role DHCP often plays in Active Directory (with MS DHCP servers ability to register IP addresses with the Active Directory DNS server automatically) it is recommended that the WinGate DHCP service be disabled and the MS DHCP service be used instead.

    To disable the WinGate DHCP service:

    1. Open GateKeeper.
    2. Select the DHCP service from the System tab.

    3. Select the General configuration.

      DHCP Service General screen

      Close | Close all images

    4. From the Service startup drop down menu select Service is Disabled.
    5. Click OK.

    If WinGate clients are using the NAT (Network Address Translation) method to connect to the Internet through WinGate, then these clients should be given the IP address of the WinGate server as their Gateway setting (as this Gateway address is required for NAT).

    This can be done by specifying the Gateway (Router) option in the scope properties/config on the DHCP server.

  • Active Directory user database with WinGate

    WinGate can use the Active Directory user database to authenticate and control user access if required.

    Note:

    The Remote User Database option in WinGate is only available with a WinGate Professional or Enterprise license.

    For the purpose of utilizing the Active Directory user database to authenticate and control users through WinGate, the WinGate engine service running on the server where WinGate is installed, must be able to logon to the domain with an account that has Domain Administrator equivalent rights.

    It is recommended that a user account is created in the Active Directory for this purpose (e.g. create a user called WinGateEngine and make it a member of the Domain Administrators group.)

    Once this user is created:

    1. Open the Computer Management MMC (found in Administrative tools in Windows) on the WinGate server.
    2. Open the Services and Applications configuration that lists all Services.
    3. Select the Qbik WinGate Engine service.
    4. Right click on this service and select Properties.
    5. Select the Log On tab.
    6. Where it says Log on as, select the This Account option and browse the Active directory for a suitable account with Domain Administration equivalent privileges. (It is recommended that administrators create a special account in Active Directory Users and Computers for this purpose.)
    7. Stop and then restart the WinGate engine for the changes to affect.

      Once this is done then Administrators can select the Remote database option in GateKeeper to utilize the Active Directory user database.


WinGate System Services

WinGate System Services provide easy configuration for WinGate system based operations.

Close

WinGate System services include:

System Service | Description
DHCP | The DHCP service provides IP address details for WinGate LAN clients.
Winsock Redirector Service (WRP) | The Winsock Redirector Service, handles Internet requests made from workstations which have the WinGate Internet Client installed. The WinGate Internet Client communicates with the Winsock Redirector Service by using WRP (Winsock Redirection Protocol) a protocol designed by the developers of WinGate.
GDP | Generic Discovery Protocol is used by the WinGate Internet Client to discover the location of the WinGate server on the network.
DNS | The DNS service provides DNS lookup resolution for clients.
Remote Control Service | The Remote Control Service is used by WinGate to control and encrypt communication between GateKeeper and the WinGate engine, allowing you to remotely control WinGate via the GateKeeper.exe gui.
POP3 Server | The POP3 server provides the POP3 services to the WinGate Mail server
SMTP Server | The SMTP server provides the SMTP services to the WinGate Mail server
IMAP4 Server | The IMAP4 Server provides IMAP4 services to clients who have IMAP4 mailboxes on the WinGate server
Email | Email is where you can configure options for the WinGate Mail server.
Caching | Caching is where you can configure how the WWW Proxy server service will cache clients commonly accessed web pages.
Scheduler | The Scheduler service allows you to configure scheduled actions that will happen when a particular event takes place in WinGate.
Dialer | The Dialer service allows you to configure WinGate to use any dial up profiles that it finds in the operating system to access the Internet.
Extended Networking | This is where you can configure the Extended Network Services offered by the extended network driver in WinGate, such as the firewall, routing and NAT (Network Address Translation).
DNS/WINS Resolver | The DNS Resolver allows you to set which DNS and WINS servers WinGate will use for client requests.
Server Certificates | This is where you can generate X509 Certificates for use in SSL related communication sessions to and from the WinGate server.


WinGate User Services

WinGate User Services provide core proxy functionality for WinGate clients.

Close

These include proxies for individual protocols and TCP/UDP Mapped Links.

Proxies connect to the Internet on the clients behalf by passing client requests to the external server. WinGate has a range of preset proxies including WWW, POP3 (email), FTP, Telnet, Streamworks, RTSP proxies. All user services are highly configurable. Each service however has its own configuration requirements.

WinGate also has TCP and UDP mapping services. These are the most basic user service which simply redirect requests to another location. ( Click here to read about TCP and UDP mapped links )

By default the WinGate installer will add the standard proxy server services and start them on standard ports.

Listed below are the configuration screens found in the User Services.

Service configuration screen | Service | Description
General | All | This has the name and description of the Service, and the port on which connections are accepted. It also allows you to configure start up options such as manual, automatic and disabled.
Bindings | All | This tab enables the administrator to specify what interfaces allow incoming requests for that service. The interfaces listed are all possible interfaces on the WinGate server
Gateways | All | This configuration screen allows the administrator to set which available interface gateway the particular service should use
Sessions | All | This configuration screen has configurable timeouts for the service, and some services can limit the number of connections
Plugins | FTP, Logfile server, WWW, POP3 | This configuration screen allows administrators to enable or disable data scanning plugins for a particular service
Web Server | WWW Proxy, Logfile server | This configuration screen allows administrators to configure how the WWW Proxy should handle Server requests (non-proxy requests) based on matching host tags in the request. It also provides the ability for the WWW to serve web pages to Server requests.
Server requests | FTP, POP3, VDOLive | This configuration screen enables the Administrator to integrate other servers with WinGate, by dealing with requests on the port that are not in the Proxy request form (Server requests)
Connection | FTP,POP3, Logfile server, RTSP, Telnet, WWW, TCP mapped links | This configuration screen allows the administrator to choose how the proxy makes the connection to the Internet. Choices include Directly, Cascade, SOCKS4, or SSL
Policies | All | Every service has its own rules. There is an option to include default policies. If these are included, then privileges from ‘Default Policies’ will be included.
Logging | All | All services can be logged or audited. Logging records details about how each service is used.
HTTPS | WWW, Logfile server | On this configuration screen administrators can set how the service will handle HTTPS connections
Mappings | Mapped links | This configuration screen controls configuration of mappings per user or location.
Encryption | TCP Mapped links | This configuration screen configures encryption options that are available for TCP Mapped links
Advanced SOCKS | SOCKS | This configuration screen contains several options relevant to SOCKS including HTTP hand-over and options for SOCKS requests


General configuration

The General configuration found in each Proxy Service is usually laid out the same, unless particularly noted.

Close

Service Name

The name of the service.

Description

Description of the service (this is not a mandatory field)

Startup options

Service startup

  1. Service is disabled

    The service will be completely disabled and will remain this way until configured differently. This means that the service will not start even after a complete reboot of the PC.

  2. Manual start/stop

    The service will not start/stop unless instigated by the administrator in GateKeeper.

  3. Service will start automatically (default)

    This is the default setting that allows the service to start automatically when ever it is needed, including after a reboot of the PC.

Service port

This is the port that client connections will use to connect through the service. e.g. WWW port 80, FTP port 21. It must be unique, and not in use by any other service.

Note:

In the above Service General configuration example for the WWW Proxy server, there is an extra setting called Authentication where required by policies. This is a setting is particular to the WWW Proxy server. When the General configuration screen of a service has extra settings, these will be explained in the help for the relevant service


Sessions configuration

The Sessions configuration in each service allows you to control some details of the connection made to the service by clients through WinGate.

Close

Timeouts

The Timeouts function is to monitor all WinGate sessions, and if any of those sessions are not active in the specified time, (e.g. user stops browsing the Web via the WWW proxy) they are terminated - 60 seconds is the default.

Note:

This period has no bearing on the hang up time for any modem connection, as this timeout can be set in the Dialer configuration.

It is essential to remove or increase the timeout on the Remote control service if you wish to stay logged into GateKeeper for any length of time.

Transparent proxy

Transparent proxy allows NAT and WGIC client traffic to be redirected through the appropriate proxy service, so they can be controlled by the policies and settings available in that service.

It is mandatory for the transparent proxy to be turned on in order for NAT and WGIC traffic to be subjected to any data scanning plugins available for a particular service (e.g. Kaspersky Antivirus plug-in scanning FTP downloads via the FTP proxy)

To enable intercepts in the Transparent proxy:

  1. Check the Intercept connections… box.
  2. Click the Add button to add the port number(s) that clients connect to the service on, and you wish to have intercepted.
  3. Click OK to accept changes.
  4. Re-open the Sessions screen to see that the port intercept is listed and reading as Started.

Click here to read more about Transparent Redirection

Note:

The DHCP service does not have a Sessions screen.

The Transparent proxy feature is not available for all services.


Server Requests configuration

Found in FTP, POP3, XMDA, and VDO Proxy service configurations, the Server Requests configuration is used to configure the way that each service will handle non-proxy (Server) requests.

Server Requests configuration

Close

  • Reject request

    By default, WinGate will reject any non-proxy requests received.

  • Pipe request through to a predetermined server

    If you select this option WinGate will pipe the request to another server.

    Typically (though not necessarily) this could be a FTP,POP3 server somewhere on your network or on the Internet. It is effectively an active Mapped Link that listens on the same port as your Proxy.


Connection configuration

The Connection configuration screen allows control over the method used to make the connection.

Close

  • Directly

    • This option is the default. Use direct connection when the WinGate server is directly connected to the Internet.

  • Through cascaded proxy server

    • This will cause the service to connect via the service on the specified computer and port. Use this option if you normally access the Internet via another proxy server. Many ISPs have HTTP proxies (usually on port 8080). Large networks may also have multi level cascaded caching.

  • Through SOCKS5 server

    • This causes connection via the specified SOCKS5 server, with the specified password.

  • Through HTTP proxy with SSL support

    • This option uses SSL tunneling via the HTTP proxy specified.

  • Option boxes:

    • These edit boxes are enabled according to the option selected above. If you are connecting to a cascaded proxy or SOCKS5 server, enter the required details for the server.


Policies configuration

The Policies configuration in each WinGate service is used when Administrators wish to apply a certain right to a user or group for that particular service rather then a system wide policy (which is is set in the System policies configuration on the Users tab of the GateKeeper Control Panel).

Close | Close all images

There are 3 rights to which users can be assigned in any service:

  1. Users can access this service

    This right specifies which users can use this service, and what requests they can make.

  2. Users can modify this service

    This right specifies which users can modify the settings of this service.

  3. User can start/stop this service

    This right specifies which users can start or stop this service.

Although these rights are worded the same as the System policy rights, they are only imposed on the service that they are being configured for.

It is possible to integrate these to work with System policies for tighter security and control.

Click here to learn more about Integrating System and Service policies

How to add a policy on each User service:

  1. Open GateKeeper.
  2. Select the desired Service from the Services tab in the GateKeeper Control Panel.
  3. Select the Policies configuration.
  4. Select the desired right from the Right drop down menu.

  5. Click the Add button to add a new recipient to that right. This will bring up the Properties for (new) recipient dialog

    Properties of (new) recipient dialog

    Close | Close all images

  6. On the Recipient tab, select either the Everyone or Specify user or group radio button for the recipients that you want to be affected by this policy.
  7. Select whether the recipients may be unknown, assumed, or need to be authenticated by WinGate. (If setting a policy for a specific user then WinGate must be able to identify this user for the policy to apply. In this case the setting either User may be assumed or User must be authenticated should be chosen).
  8. Configure the desired options for the chosen recipient from the other tabs on the Properties for (new) recipient dialog.

  9. Click OK to add the policy to the Policies configuration.

    Properties of (new) recipient

    Close | Close all images

  10. On the Policy configuration select from the Default rights (System Policies) drop down menu how this policy will interact with any System wide policies that have been set in WinGate.
  11. Click OK to save changes.

Click here for more information on the properties of recipient dialog


Auditing and logging

Advanced monitoring allows an administrator to see full details of all WinGate activity so they can control user and system access more effectively.

Logging

All WinGate service properties have a Logging configuration screen.

Close

All per-service monitoring is recorded in the log files.

These files are in a Tab delimited format. Service logs are stored by default as: %WinGatePath%\logs\servicename.log.

The file format for auditing and logging files is:

Date | Time | IP Address | Session # | EventType | Event Details
12/02/96 | 15:01:25 | 192.168.0.1 | 0000006100 | Modify | user John
12/02/96 | 15:04:35 | 192.168.0.1 | 0000007126 | Created http:// |

There are two divisions of audit/logging events that will allow several options.

Administrators may select any or all of these to suit their auditing/logging requirements. The default options are indicated.

Session Events

blank checkbox Session creation (Default setting: Off)

Selecting this option causes session creation details to be logged.

The detail indicates the service type, e.g. HTTP.

Session creation details are often used when tracking down problems.

blank checkbox Session termination (Default setting: Off)

Selecting this option causes termination of sessions to be logged.

This is not normally selected unless there are problems with your applications hanging.

An individual session can be tracked from creation and request to termination.

checkbox Request details (Default setting: On)

Session request detail will be stored. In HTTP, the requested URL will be recorded.

blank checkbox Debug (Default setting: Off)

Logs any debug messages that occur.

blank checkbox License violations (Default setting: Off)

Any violation of the license count will be recorded.

checkbox Session traffic (Default setting: On)

Traffic levels recorded for the session. In Bytes (sent to, received from, sent for, received for client, seconds).

Configuration events

checkbox Authorisation failures (Default setting: On)

If a user enters the wrong password, the event will be noted.

checkbox Errors (Default setting: On)

Records details of any errors.

checkbox Service start/stop (Default setting: On)

Notes when the service is started or stopped.

checkbox Configuration changes

Notes service/user configuration changes.

checkbox User login (Default setting: On)

Indicates when the user logs in.

checkbox User logout (Default setting: On)

Notes when a user logs out.

A text editor or the Logfile Server can be used to view these files.


DHCP overview

What is DHCP?

DHCP stands for 'Dynamic Host Configuration Protocol'. DHCP is a standard way of automatically configuring client computers to access the Internet (e.g. allocating IP numbers and DNS servers). You have probably had some experience with dynamic IP allocation already. When a modem makes a PPP connection to an ISP, an IP number is often dynamically allocated to the modem.

What does it do?

DHCP is a means for networked computers to get their TCP/IP networking settings from a central server. Importantly, DHCP assigns IP addresses and other TCP/IP configuration parameters automatically. WinGate DHCP is different from other DHCP servers, in that it can even figure out what IP addresses to allocate without the administrator having to predefine pools of addresses (scopes). It can also figure out how to set the clients' gateway and several other parameters too, which means that not even the administrator needs to be a TCP/IP expert to operate the WinGate DHCP server. Full manual override of all automatic settings is also available in order to allow administrators to cater for their specific requirements.

Why is this better?

DHCP eases both TCP/IP and WinGate configuration. Before DHCP, all the computers on a network had to have unique private static IP addresses assigned to them and DNS also required configuration. Existing WinGate users may remember that client computer TCP/IP configuration had 6 stages, for each computer. Many options on the TCP/IP set up can be problematic, and one wrong setting can prevent a client from getting the desired access. With DHCP you simply install TCP/IP and nothing else is required, no IP number, no messing with DNS settings! The DHCP client is installed as part of TCP/IP. If you already have TCP/IP installed, you simply select "Obtain an IP address using DHCP" (Windows NT / 2000), or "Obtain an IP address automatically" (Windows 95 / 98) in Settings/Control panel/Network/Network protocols - TCP/IP / IP Address. If you want the easiest network set up, use DHCP. DHCP is recommended as insurance against IP conflict and configuration errors.

How does it work?

When Windows starts on a client computer, the DHCP client that is built into Windows TCP/IP sends a broadcast packet on the network requesting an IP address. Any DHCP server that hears this request sends a response, an 'offer' of an IP address. This IP address is chosen from a range of acceptable IP addresses configured in the DHCP server. Each range of IP addresses is referred to as a scope. The client can then 'accept' the IP address. Any further configuration information is also forwarded to the client at that stage, including DNS server details. When a client has had an IP lease for half the lease time, it will request a new lease. It may receive the same or a different IP number. WinGate records information about each active lease, and also integrates these with the WinGate rules, so you now have more information about the computers using WinGate.

How about my static IP addresses?

You do not need to worry about computers on your network that cannot use DHCP. They can still use their existing IP address. WinGate checks to see if it can ping an IP address before it will allocate it. If it can ping an address, it knows the address is in use, and so it will not allocate it to any other computer. You can also set excluded IP addresses in each scope that you create, or that WinGate creates for you (in Settings/Control panel/Network/Network protocols - TCP/IP / IP Address.)

What are reservations?

Reservations are used if you want to guarantee that a specific computer will always be allocated a certain IP address, and that this address will not be allocated to any other computer. This is sometimes used where you have purpose-built applications that connect to specific hosts, which may themselves use DHCP to configure their networking. However, with WinGate's integration of DHCP with WinGate DNS, this will become largely redundant, as you are able to look up the IP addresses of computers by their computer name (NetBIOS name as opposed to their host name). Reservations are also used if you wish to specify specific TCP/IP settings on a computer-by- computer basis.

Changing to DHCP

If you have an existing network of statically assigned IP numbers, it is a simple job to change to a full DHCP network. The WinGate DHCP server is installed with default recommended settings. The WinGate server itself must have static IP addresses for its LAN cards. All other computers on your network can use DHCP. This is a fundamental requirement for all DHCP servers, not specific to WinGate. The IP addresses you allocate to your WinGate server LAN cards determine which addresses are allocated to computers on those networks. So, if you allocate 192.168.0.1 to one LAN card, all computers directly connected to that card (i.e. on the same subnet) will be allocated addresses between 192.168.0.2 and 192.168.0.254. If you have a multiple segment LAN, with routers between segments, these routers must run BOOTP relay agents (or DHCP relay agents - DHCP uses the BOOTP packet format so that DHCP packets can be forwarded by BOOTP relay agents). WinGate uses the IP address of the interface on a BOOTP forwarding agent that a request was made on to allocate addresses. Therefore, WinGate will always allocate IP addresses on the correct subnet. Network masks are taken from the RFC defining IP address ranges. Once the client computers are restarted, DHCP will take care of the IP's for you. Computers nearly always obtain the same IP they had previously.

How to move from manual to DHCP

For each client computer:

  1. In Start/Settings/Control panel/Networks/ Protocols /TCP-IP (for the LAN card), on the IP Address tab, change the selection from Specify an IP address to Obtain IP address automatically
  2. Click OK.
  3. Restart the computer. In the event of a conflict, simply restart the computer in question.

If you are currently using another DHCP server on your LAN, and wish to change over to the WinGate DHCP server, simply start the DHCP service in WinGate, and stop your other DHCP server. The client computers will attempt to renew their leases, and when they cannot communicate with their previous DHCP server, they will broadcast a request to all DHCP servers, at which stage WinGate will take over management of the lease.

DHCP information

Configuring DHCP is easy. WinGate automatically installs a DHCP service. The default is Fully automatic DHCP mode, where IP ranges, DNS and all settings are provided. If you prefer to have more control over the settings, Manual mode allows total control.

These are some terms relating to DHCP:

Term

Description

Subnet

A subnet is a group of computers that are directly connected via coax or a hub. A computer with two network adapters will be on 2 subnets.

Interface

An interface is any connection to a network. This may be a Network card, modem, ISDN card or other TCP/IP capable device that is installed in a computer.

Lease

The length of time for which a dynamically assigned IP can be used. Before the lease expires, the client must renew the lease with the DHCP server.

Reservation

A Reservation is used to specify that a specific computer will always be allocated a specific IP address.

Scope

A Scope is a range of IP addresses, and associated TCP/IP configuration options. A DHCP scope comprises a pool of available IP addresses in a contiguous subnet. Each scope is used to define parameters for each subnet or interface. Each scope has the following properties:

  • Each scope is associated with an interface. This interface is the interface in WinGate that the DHCP client requests will come in on.
  • A scope name / description.
  • A subnet mask used to determine the subnet related to a given IP address.
  • Lease time to be assigned to DHCP clients with dynamic addresses.

Exclusions

Excluded IP ranges allow the administrator to say "Don't allocate these IP addresses to any computer". An exclusion range must lie within the scope. In Auto mode, the IP of the WinGate server is automatically added as exclusion.

Option

A DHCP option specifies a parameter that will be configured in a DHCP client, for example the DNS server, or the default gateway. There are options in DHCP on three levels. There are Global options, Scope options, and Reservation options. Reservation options override Scope options, which override global options.

Even in Fully automatic mode you are still able to manually configure any scopes and extra options. This mode simply refers to what WinGate will do automatically to help you, so if you have specific requirements, it can be useful to start out using fully automatic mode, and then do your own modifications later on.

Disabling WinGate DHCP

You can use the WinGate DHCP Server, another DHCP server, or none at all - it is completely up to you (though we recommend using WinGate DHCP). The WinGate DHCP Server will be installed and started by default.

Click here for instructions on disabling WinGate DHCP.


DHCP Bindings

The DHCP Bindings configuration works rather differently to other services. The picture shows the bindings policy is to bind to an Internal adapter.

Close

The DHCP will not allow you to bind to any modem or non-static interface for security reasons.

In addition to this, localhost (127.0.0.1) cannot be bound to. In the example above, the DHCP server will only allocate IP numbers to computers whose request was received on 192.168.6.69

Note:

There must be a binding for all interfaces that you wish to use DHCP on.


DHCP Mode

The DHCP Mode configuration lists the different modes that DHCP will run in:

DHCP Mode screen

Close

  • Fully automatic

    This does everything for you. All settings are standard and will work in nearly all circumstances. DNS is set to the WinGate server itself. There are no Reservations. Scopes are created as required based on the IP of the WinGate server or DHCP relay agent. Fully Automatic mode copes with DHCP Relay agents and multiple subnets. The default gateway is configured as the WinGate server (if WinGate is running on a multi-homed host) or the IP address of a relay agent.

  • Semi automatic

    This allows configuration of what WinGate will and will not automatically do (think of it as "custom")

  • Manual

    Only use this mode if you understand DHCP and its options. Manual mode is useful for complex networks where there are several different computers with a range of requirements.


DHCP Settings

The DHCP Settings configuration shows the current DHCP configuration for your LAN.

Close

The DHCP Settings window will list the network interface on which the scope is being used. This is normally the network interface that connects the WinGate server to its LAN.

Below this is listed the scope range of IP addresses ) that will be issued to client workstations when they request an IP address.

Double clicking the Scope (light bulb) icon option will produce the Scope properties where you are able to configure the details of the scope.

Double clicking the Reservation icon will produce the Reservation properties where you are able to configure the reservation.

Double clicking on the Global options icon will allow you to configure DHCP options that will apply to all scopes, on all interfaces listed.

Scope options over ride Global options and are applied to the scope and all reservations under that scope.

Reservation options will over ride Scope options and are applied only to that particular reservation.

Releasing and Renewing a DHCP Lease

To release and renew an IP number, on the Client Computer for 95, 98 or ME:

  1. Click Start/ Run.
  2. Enter winipcfg and click OK.
  3. Make sure your network card (NIC) is selected (rather than the PPP adapter).
  4. Click renew.
  5. Click release.

For 2003/ XP/ 2000 / NT Workstation or Server:

  1. Open the Command Prompt
  2. Type ipconfig /release to release the old settings.

  3. Type ipconfig /renew to get the DHCP server to configure your client computer with the new settings.

    You may be prompted to restart your computer.

Note:

Reserving an address or changing a reservation does not force the client for whom the reservation is made to move to the reserved address. In this case, too, the client must issue a renewal request.


DHCP Scopes

Adding a scope

To add a new scope:

  1. Open GateKeeper
  2. Select the DHCP service from the System tab on the GateKeeper Control panel.

  3. Select the DHCP Settings configuration.

    Close | Close all images

  4. Right-click the interface on which you wish to add a scope.
  5. Choose New scope.
  6. Follow Changing Scope properties (below).

Changing Scope properties

You can change the properties of an existing scope. You can extend the address range of the scope, but you should not reduce it. You can however exclude any unwanted addresses from the range.

To define the properties of a DHCP scope:

  1. Select the DHCP settings configuration.
  2. Double click the scope you want to change.

  3. The Scope Properties configuration will be displayed.

    DHCP Scope Properties

    Close | Close all images

  4. Configure the Scope properties as required.

    • General

      The Description is a unique name for this scope. This will be displayed in the DHCP options window.

      checkbox Scope enabled

      Enables/disables allocation from this scope.

    • Allocate IP addresses in the range

      This is the range of IP addresses to allocate to clients. 192.168.0.* is the default, as is the Network Mask of 255.255.255.0. If you wish to use different options for the range or mask, see the advanced sections.

    • Lease Duration

      The default lease time is 3 days. This is a suitable time for most LANs. If you have a LAN with more computers than the size of your scope, you may wish to have the lease period short. This will enable the available IP's to be shared around.

    • Excluded addresses

      These are IP's within the scope range that you do not wish to allocate to client computers. In the example above, the IP address 192.168.0.100 and all the IP addresses from 220* 240 will not be allocated.

      To add an exclusion:

      1. In the Scope properties configuration, type the IP number you wish to exclude into the From field.
      2. To exclude a range, type in an end address into the To field.
      3. Click Add.

Removing a scope

When a subnet is no longer in use, or if you want to remove an existing scope, you can remove it from the DHCP service. It is recommended that you deactivate a scope until you know that no leases are current before deleting it.

To remove a scope:

(The scope should be deactivated until you are sure the scope is not in use.)

  1. On the scope list in the DHCP Settings window, select the scope you want to remove.
  2. Right click on the scope and select Delete from the scope menu.

Assigning DHCP configuration options

Besides the IP addressing information, other DHCP options to be passed to DHCP clients must be configured for each scope, or globally under the Global Options.

Options can be defined globally for all scopes, specifically for a selected scope, or for individual DHCP clients:

  • Active global option types always apply, unless overridden by scope or DHCP client settings.
  • Active option types for a scope apply to all computers in that scope, unless overridden for an individual DHCP client.

Only configure options if you know what effect if will have on DHCP.

Some Options are inter-related (see the DHCP Configurable Options List ).

To assign DHCP Options:

  1. In the DHCP Service/Settings configuration, double click the scope you want to configure, or click global to configure all, or click a specific reservation.

  2. Click Options.

    DHCP Scope Options

    Close | Close all images

  3. For options that you wish to configure, use the Add button to add options from the Available Options to the Options in use lists.
  4. Double click on one of the options listed an Options in use window to edit it.
  5. Enter the relevant information.
  6. Click OK.

Example:

To specify the DNS name servers to be used by DHCP clients, double click DNS Server and then type an IP address for a DNS server in the edit box and click add. The list should be in the order of preference, so that the first server in the list is the first server to be consulted.

To remove a configured option:

  1. Select the listed option from the Options in use window and click the Remove button.
  2. Click OK.

Note on WINS Server Option:

If you specify a WINS Server, you must also configure a NBT Node type.


DHCP reservations

With the WinGate DHCP service you can reserve a specific IP address for a client. Typically, you will need to do this if the client uses a IP address that needs to remain constant.

(Fully automatic mode will not allow reservations.)

Note:

  • If multiple DHCP servers are distributing addresses in the same scope, the client reservations on each DHCP server should be identical. Otherwise, the DHCP reserved client will receive different IP addresses, depending on the responding server.
  • You can change any information about a reserved client at any time.
  • Reserving an address does not automatically force a client who is currently using the address to move elsewhere. If you are reserving a new address for a client, or an address that is different from the client's current one, you should verify that the DHCP server has not already leased the address. If the address is already in use, the client that is using it must release the address by issuing a release request.

Adding a Client reservation

In WinGate DHCP, you can set reservations based on the name of the computer, or by MAC address. Using a computer name rather than the MAC address (hardware address) of the LAN card means you can retain your reservations even when you change hardware.

To add a reservation for a client computer:

  1. Select the DHCP Settings configuration.

  2. Right click the Scope where you wish to add the reservation.

    Close | Close all images

  3. Select New reservation.

  4. On the Reservation dialog type in information to identify the first reserved client.

    Dhcp Reservation dialog

    Close | Close all images

  5. IP Address specifies an address from the Scopes range. You can specify any unused IP address in the scope.
  6. Reserved for computer name / MAC address allows selection of the identifier for the client computer.
  7. Identifier specifies the Name or MAC address for the client computer, depending on the option chosen above. We recommend using the Name as this is easier and it is associated with the computer rather than simply the card.
  8. Click OK to add the reservation to the DHCP database. You can continue to add reservations without closing this dialog box.

Determining a client computer MAC address:

  • In NT / 2000: Type ipconfig /all at the command prompt on the client computer.
  • In 95 / 98 / ME: Type winipcfg then click the More >> button. Details are under Adapter address.

To change the reserved IP address

Reservation information can be changed any time. Changes will not be reflected in the client till the lease is renewed.


DHCP Options

Listed are the DHCP options configurable in the WinGate DHCP server. Most DHCP clients will ignore many of these options. Please only change options that you understand. This section is provided for reference as you will rarely need to change any of these options - DHCP is designed to be a "set and forget" service for WinGate users.

DHCP scope options

Close

Option

Description

Time offset

Specifies the Universal Coordinated Time (UCT) offset in seconds.

Router

Specifies a list of IP addresses for routers on the client's subnet.

Time server

Specifies a list of IP addresses for time servers available to the client.

Name servers

Specifies a list of IP addresses for name servers available to the client.

DNS servers

Specifies a list of IP addresses for DNS name servers available to the client.

Log servers

Specifies a list of IP addresses for MIT_LCS User Datagram Protocol (UDP) log servers available to the client.

Cookie servers

Specifies a list of IP addresses for RFC 865 cookie servers available to the client.

RCS Log servers

Specifies a list of IP addresses for RFC 1179 line-printer servers available to the client.

Impress servers

Specifies a list of IP addresses for Imagen Impress servers available to the client.

RLP servers

Specifies a list of RFC 887 Resource Location servers available to the client.

Host name

Specifies the host name of up to 63 characters for the client. The name must start with a letter, end with a letter or digit, and have as interior characters only letters, numbers, and hyphens. The name can be qualified with the local DNS domain name.

Boot file size

Specifies the size of the default boot image file for the client, in 512-octet blocks.

Merit dump file

Specifies the ASCII path name of a file where the client's core image is dumped if a crash occurs.

Domain name

Specifies the DNS domain name the client should use for DNS host name resolution.

Swap server

Specifies the IP address of the client's swap server.

Root path

Specifies the ASCII path name for the client's root disk.

Extensions path

Specifies a file retrievable via TFTP containing information interpreted the same as the vendor-extension field in the BOOTP response, except the file length is unconstrained and references to Tag 18 in the file are ignored.

IP layer forwarding

Enables or disables forwarding of IP packets for this client.

Non-local source routing

Enables or disables forwarding of datagrams with non-local source routes.

Policy filter masks

Specifies policy filters that consist of a list of pairs of IP addresses and masks specifying destination/mask pairs for filtering non-local source routes. Any source routed Datagram whose next-hop address does not match a filter will be discarded by the client.

Max Datagram reassembly size

Specifies the maximum size Datagram that the client can reassemble. The minimum value is 576.

Default time-to-live

Specifies the default time-to-live (TTL) that the client uses on outgoing datagrams. The value for the octet is a number between 1 and 255.

All subnets are local

Specifies whether the client assumes that all subnets of the client's Internet work use the same MTU as the local subnet where the client is connected .1 indicates that all subnets share the same MTU; 0 indicates that the client should assume some subnets may have smaller MTUs.

Broadcast address

Specifies the broadcast address used on the client's subnet.

Mask discovery

Specifies whether the client should use Internet Control Message Protocol (ICMP) for subnet mask discovery.

Is Mask supplier

Specifies whether the client should respond to subnet mask requests using ICMP.

Router discovery

Specifies whether the client should solicit routers using the router discovery method in RFC 1256.

Router solicitation address

Specifies the IP address to which the client submits router solicitation requests.

Trailer encapsulation

Specifies whether the client should negotiate use of trailers (RFC 983) when using the ARP protocol.

ARP cache timeout

Specifies the timeout in seconds for ARP cache entries.

Ethernet encapsulation

Specifies whether the client should use Ethernet v. 2 (RFC 894) or IEEE 802.3 (RFC 1042) encapsulation if the interface is Ethernet.

Default time-to-live

Specifies the default TTL the client should use when sending TCP segments. The minimum value of the octet is 1.

Keepalive interval

Specifies the interval in seconds the client TCP should wait before sending a keepalive message on a TCP connection.

Keepalive garbage

Specifies whether the client should send TCP keepalive messages with an octet of garbage data for compatibility with older implementations.

NIS domain name

Specifies the name of Network Information Service (NIS) domain as an ASCII string.

NIS servers

Specifies a list of IP addresses for NIS servers available to the client.

NTP servers

Specifies a list of IP addresses for Network Time Protocol (NTP) servers available to the client.

WINS/NBNS servers

Specifies a list of IP addresses for NetBIOS name servers (NBNS).

NetBIOS over TCP/IP NBDD

Specifies a list of IP addresses for NetBIOS datagram distribution servers (NBDD).

WINS/Netbt node type

Allows configurable NetBIOS over TCP/IP clients to be configured as described in RFC 1001/1002. Options are b-node, p-node, m-node, and h-node.

NetBIOS scope ID

Specifies a string that is the NetBIOS over TCP/IP Scope ID for the client, as specified in RFC 1001/1002.

X Window font server

Specifies a list of IP addresses for X Window font servers available to the client.

X Window system display

Specifies a list of IP addresses for X Window System Display Manager servers available to the client.


Disabling the WinGate DHCP service

Depending on your network scenario and requirements you may have to disable the DHCP service in WinGate.

To disable the WinGate DHCP service:

  1. Open GateKeeper.
  2. Open the DHCP service from the System tab of the GateKeeper Control Panel.

  3. Select the General screen.

    DHCP service properties

    Close

  4. Under the Start options select Service is disabled from the Service startup drop down menu.
  5. Click OK to close the DHCP service configuration.

The WinGate DHCP service is now disabled and will no longer be able to issue clients with IP address details.


GDP Service - Generic Discovery Protocol

The GDP service is a protocol developed by Qbik New Zealand for 'finding' or 'discovering' Internet connectivity servers (such as WinGate). It is used by both the WinGate Internet Client (WGIC) and GateKeeper for finding WinGate. Once installed, GDP can be left unattended. It is designed to be fully automatic, requiring no user intervention.

Close

The GDP service located on the System tab of the GateKeeper control panel, listens to the system port 368 for broadcast messages sent out by clients.

When the WinGate Internet Client (WGIC) is running on client computers, it broadcasts a 'discover' request on this port to locate WinGate servers.

GDP guidelines:

  • You only need one GDP service.
  • It must be on port 368.
  • GDP is required for the WRP clients to automatically find WinGate servers.
  • GDP should only be bound to your internal LAN network adapter/s.
  • Generic Discovery Protocol is sometimes called Gateway Discovery Protocol.


Winsock Redirector Service

The Winsock Redirector Service is located on the System tab of the GateKeeper control panel, runs on the WinGate server and implements the WRP (Winsock Redirection Protocol) to provide Internet access for clients running the WinGate Internet Client (WGIC).

Note:

Often the Winsock Redirector Service is referred to as WRP or the WRP Service.

Winsock Redirector Service

Close

Once the WinGate Internet Client is installed on your client computers, it communicates with the WinSock Redirector Service on the WinGate server, allowing Internet applications on the client machine to run as if they are directly connected to the Internet with no Internet software configuration needed.

The Winsock Redirector Service gives all your client applications the benefit of being directly connected to the Internet, while enjoying the benefits of a proxy server and the security of a firewall.

WRP allows your client applications to:

  • Make TCP connections (e.g. WWW browsing)
  • Accept TCP connections (e.g. like a WWW server running behind WinGate on a machine with WGIC installed)
  • Send UDP data (e.g. Streaming applications like Real Audio)
  • Accept UDP data (e.g. Like a RA server).

Winsock Redirector Service and client Internet applications

An Internet application on the client computer attempts to make a connection to a computer on the Internet. The WGIC on the client machine detects this and determines what kind of request it is. If it is a connection to a computer on the same network, the client lets the application make the connection directly.

If the client tries to connect to a computer on the Internet, (i.e. it is not on the same network) then the WGIC 'catches' the connection and sends it to the WinGate Winsock Redirector Service. WinGate then makes the connection as if it was the client computer.

Since Winsock Redirector Service catches and handles all client Internet requests, it allows you to configure all control and access to the Internet from the one service rather then individually for each separate proxy service in WinGate.

The Winsock Redirector Service listens for WGIC client connections on port 2080 by default.

Server applications

The Winsock Redirector Service can also listen on behalf of server applications running on the client machine where WGIC is installed, for incoming connections from the Internet.

e.g.

You may have a Web server running on a client machine that is running WinGate Internet Client. The Winsock Redirector Service can be configured to listen to incoming requests from the Internet and pass them on to the Web server machine.

Click here to read how WRP handles applications from a WGIC machine


Winsock Redirector Protocol FAQ

What is WRP?

Winsock Redirection Protocol is a specification for Winsock request redirection. It enables client computers to gain access to the Internet without proxies or a direct connection.

What is the Winsock Redirector Service ?

Winsock Redirection Protocol Service is the server in WinGate that provides WRP access. Like an FTP server provides FTP.

What is the WGIC ?

The WinGate Internet Client is the service that lets your client computers use the Winsock Redirector Service on the WinGate server. It is invisible, but configurable through its control panel icon.

What are the advantages of using WRP?

Firstly, it is very easy to use. No more client configuration is required; once installed, the WinGate client does everything for you. WinGate configuration is simple too. Most people only need 5 services, instead of about 15! Second, WRP is fast. Once installed, there is no more time wasted getting applications working.

What are the disadvantages?

As all connections are made from the WinGate server, on the ports requested by the client application, port conflicts may occur. See the section on Current compatibility.

Do I need to know lots about networking?

No. That is the bonus of the WinGate Winsock Redirector Service. In fact you don't even need to know that it is running. Once installed, the WinGate Internet Client will do all of the work for you.

How do I install WRP?

You must have the Winsock Redirector Service installed on the WinGate server (it is an ordinary WinGate System Service that is installed by default). Installing the WinGate Internet Client on client computers enables them to use this service. To see how to install the WinGate Internet Client read the installation section of this help file.

I have run the install, I can't see the WinGate Internet Client?

Don't worry, this is correct. The WGIC runs as a service similar to the way a mouse driver works: It's always ready, but you can't see it. It requires no configuration, but there is an icon added to the control panel.

Can I be sure my network is secure if I use WRP?

Yes. The Winsock Redirector Service is carefully designed to give you maximum security. The Winsock Redirector Service will only work for the computers on your own LAN. If you accidentally run a server on a client computer, it will not be accessible to the Internet unless you explicitly allow this.

How do I configure WRP to block ALL applications except the ones I choose?

Using the 'ban client application' setting (added in version 3.05 and later) you can achieve this.

Try changing the Winsock Redirector Service policies to:

  1. Default rights are ignored
  2. Add "Everyone" with ban list "Not client application name is empty". These two entries ban all applications for everyone. So:
  3. Add "Everyone" with ban list "Not client application name equals X" (e.g. where X is TELNET.EXE)
  4. Add "Everyone" with ban list "Not client application name equals Y" (e.g. where Y is NETSCAPE.EXE).

Now they can run the client with apps X and Y but no others. This provides centralized control over what applications WRP will and will not re-direct.

However, this is not a completely bullet proof solution (which is why we've never pursued such a scheme). Bear in mind that a rogue user can subvert this by changing the name of the .EXE you chose to ban (i.e. you ban netscape.exe but allow telnet.exe. Renaming the netscape.exe file as telnet.exe allows the user to evade this policy.

Is it easy to use?

Very easy. WRP is designed to run without any user intervention required.

Why should I use WRP?

WRP saves you time and money configuring your network. WRP is great for network administrators, as client applications now require no set up to use a firewall.

Will it work with my old applications?

Yes. The WRP client will allow any TCP or UDP application to run as if it was directly connected to the Internet.

Is it forwards compatible?

Yes. WRP will allow any TCP or UDP application to run as if it was directly connected to the Internet.

How do I set up applications to use it?

You don't! WRP works without any application configuration. No more proxy settings, no more mapped links or hosts files.

Can I have several versions of WinGate running?

Yes. Each WRP client can handle multiple WinGate engines on your network. The most appropriate WinGate will be used. If one WinGate is too busy, the client will use another.

What is GDP?

Generic Discovery Protocol. This protocol is an IANA registered Internet standard, with an assigned system port number: 368. GDP is used for finding or discovering Gateway computers on a network.

Is WRP a standard?

Yes. WRP uses GDP to discover WinGate installations. WRP is a protocol specification for Winsock redirection. Both WRP and GDP specifications were created and developed by Qbik New Zealand Ltd.

How compatible it is with my computers?

It is 100% compatible with any PC running Windows 95, 98, NT4, or higher.

What if I have Macintoshes on my network? What about other types of computers?

The WRP client is only available for Windows 95 98 and NT. Other PCs will have to use the WinGate Proxies or NAT Service (NAT was introduced in WinGate 4.0).

Will the people on my network need training?

No. No training is required because WRP is transparent, the computer user does not need to know anything about WRP or how they are getting Internet access.

Can I run multiple Winsock Redirector Services on my network?

Yes. Each WRP client can handle multiple WinGate engines on your network. The most appropriate WinGate server will be used. If one WinGate is busy, the client will use another (unless you specify otherwise).

Will it work with Intranet servers?

Yes. WRP does not affect connections to computers on your own LAN.

What does this mean for Internet software authors?

WRP is good news. Proxy support is no longer required. All TCP and UDP client and server applications will work. No firewall configuration will be needed to use the Internet.


WinSock Redirector Service - Central configuration

Using the functionality contained in the Central Config screen in the Winsock Redirector Service, it is possible to configure settings for every WGIC user on your network.

Consequently, there is no need to configure individual WGIC machines separately.

Winsock Redirector Service - Central Configuration

Close | Close all images

Click Add on this screen to produce the Edit WRP User Config dialog.

Edit WRP User Config dialog - Recipient tab

Close | Close all images

Then you may use the Recipient tab to select which users are subject to the settings that you may configure in the other tabs of the Edit WRP User Config (i.e. the General Settings and Application tabs)

Please Note:

Central Configuration is only available to WinGate 6 Enterprise Licenses.

©2009 Qbik New Zealand Limited


Edit WRP User Config - General tab

The General Settings tab on the Edit WRP User Config allows you to configure a how the Winsock Redirection Service central configuration should handle applications by default.

Close

Defaults

Default Mode:

  1. Local (Use other method)
  2. Mixed (LSP Authentication, other method)
  3. Global (Use LSP)
  4. Internet Denied (No Internet access)
  5. Application Denied (Not allowed to run)

The default mode will be used if the application cannot be found in the Application List (maintained in the Application Tab) or if the Application List is disabled.

Note:

Using a default mode that terminates all applications, and specifying only the applications you allow your users to run is a good way of preventing unauthorised programs being used on your network.

Click here to read more about the application modes in the Winsock Redirector Service

checkbox Track connections

Check this box to track all connections for each mode that you select.

checkbox Inform the user if Internet access is denied

Via a system message on the client side

checkbox Inform the user if an application will be terminated

Via a system message on the client side.

General

checkbox Check the central application list

For policies relating to each application

checkbox Check the clients application list

This is less secure than using the central application list.

checkbox Use WGIC for authentication only

This simply lets the server know who the client is; WGIC won't accept socket applications or do anything else.

Note:

LSP stands for 'Layered Service Provider'. An LSP is a system driver linked deep into the networking services of Windows. It has access to all data entering and leaving the computer, as well as the ability to edit this data. Some LSPs are necessary to allow Windows to connect you to other computers, including the Internet.


Edit WRP User Config - Applications tab

The Application tab in the Edit WRP User Config allows you to set how client applications will run when they make a request to the Winsock Redirector Service in GateKeeper from WGIC on the client machine.

Edit WRP User Config - Applications tab

Close | Close all images

Click on the Add button to produce the Edit Application dialog box.

Edit Application dialog

Close | Close all images

This is where you configure settings for each WGIC user, per application.

Application:

The name of the application you are configuring WGIC options for. This will always be an .exe. Bear in mind that you enter the application name only - do not specify the path.

Mode:

Select from:

  • Mixed (LSP Authentication, other method)
  • Global (Use LSP)
  • Internet Denied (No Internet access)
  • Application Denied (Not allowed to run)
  • Track connections for this application - check this box to track all connections for the application.
  • Inform the user if Internet access is denied - via a system message.
  • Inform the user if an application will be terminated - via a system message.

Click here to read more about the application modes in the Winsock Redirector Service

Please Note:

Central Configuration is only available to WinGate 6 Enterprise Licenses.

©2009 Qbik New Zealand Limited


Winsock Redirector Service - Application Modes

The WinSock Redirection Protocol (WRP) works when applications on the client machine which is running the WinGate Internet Client (WGIC), are intercepted and handled by the Winsock Redirector Service in WinGate. To assist the Winsock Redirector Service in determining how it should handle a WinSock application requests, the applications on the client can be set to run in one of three different modes that WRP will recognise.

You can configure the application access mode from the WGIC applet on the client machine, or if you are running a WinGate Enterprise license, from the Central Configuration in the Winsock Redirector Service.

WRP Application Modes

  • Local Access Mode

    When you set a client application to Local Access mode in the WGIC, you are effectively disabling the Winsock Redirector Service in WinGate from handling the application requests for this program.

    Applications in local access mode will be ignored by the WGIC and so must have an alternative connection method to complete their requests. This makes Local access mode ideal for client applications that are having issues running through WGIC.

    In many cases, you may wish to use the speed and simplicity of WinGate NAT for client applications (those that request outgoing Internet connections only). Any applications that you want to use NAT must be changed to run in Local Access Mode on the User Application tab.

    Note:

    The WinGate NAT/ENS must be enabled on the WinGate server for it to work.

    In Local Access Mode, an application will use the NAT (so long as the TCP/IP default gateway setting on the client points to the WinGate computer, and the application is not configured to use proxies). Remember that the NAT only provides connectivity for client applications (not server applications).

  • Mixed Access Mode

    Mixed Access Mode is a safe but functional mode for Server applications. (e.g. web server, ftp server).

    This allows client applications to make any outgoing connections with WRP, but the server application on the client machine will only allow incoming connections from computers on the same network. It is most appropriate for server applications like Intranet Web or FTP servers. It is called mixed because it provides an application with a safe mixture of global and local connectivity.

    Mixed Access Mode is automatically allocated to any server applications that attempt to ‘listen’ to a system port (anything below 1024). This is a safety mechanism of the WGIC, as it requires you to explicitly set the application to Global Access Mode before it is visible to anyone on the Internet.

  • Global Access Mode

    Global access mode is used when there is a server application running on the WGIC machine behind the WinGate server that needs to be able to recieve requests from the Internet (such as a Web or FTP server). It effectively removes any safety restrictions that the WGIC may impose on the application.

    Typically you will need to do this for Web Servers (they usually listen on port 80) and FTP servers (they usually listen on port 21).

    Click here for steps to configure the Winsock Redirector Service to support a Server application on a client machine


Winsock Redirector Service - Configuring Server application support

To configure a server application in Global Access mode on a WGIC machine to receive requests from the Internet through the Winsock Redirector Service in WinGate:

  1. Configure the firewall on the WinGate server:

    1. Open GateKeeper.
    2. Select Extended Network Services from the System tab of the GateKeeper Control Panel.
    3. Open the ENS Port security configuration screen.
    4. Click the Add button.( This will bring up the Port Range Configuration dialog)

    In the Port Range Configuration:

    1. Select the type of connection that will be affected by the security filter (Connections from the Internet), and the appropriate protocol (either TCP or UDP).
    2. Specify the appropriate port (port) that is influenced with this filter, and a description that will easily identify its purpose. This port will be the same as what the server application is listening for incoming connections on (e.g. FTP server usually configured to 21).
    3. In the Action to take section (when a packet uses this port) section select Allow radio button.
    4. Click OK to save changes and exit.

  2. Configure the WGIC machine:

    1. Open the WGIC applet.
    2. Select the User Application tab.
    3. Click the Add button to locate and select the executable of the Server application.
    4. On the Application Scope dialog that appears, press the Browse button to locate and select the executable for the desired server application.
    5. Select Global Access mode radio button.
    6. Click OK to save and exit.


Notes for Winsock developers

This topic contains some suggested guidelines for developers of WinSock 2 applications.

By following these guidelines, developers will help to ensure that any software they write will interact with the WinGate Winsock Redirection Protocol (WRP).

  1. Avoid at all costs implementing protocols where the client explicitly tells the server what its IP address or port is for any connection or transfer of data back to the client.

    This is for the following reasons:

    • A client cannot be expected to even know it's real IP address on a NAT system, and there may not even be a mechanism to discover it.
    • The server can always use getpeername() to find out where the client is communicating from, so transmitting the information is often redundant (and can be misleading).
  2. Avoid at all costs using fixed port numbers in the client application. If the client needs to accept a connection, or receive data on a port number, this number should be allocated by the operating system (by calling bind() with a port number of zero), and the resultant port number transmitted to the other end. Take care also when doing this, as it may break some NAT systems. The best way is to have any connections required initiated by the client.

  3. Consider that any computer can be multi-homed. So, calling gethostbyname() on the result of gethostname() and using the first returned IP address will break many applications. If you must know your IP address, obtain it in terms of the interface on the local computer that will see the other host that is the other interested party in the communication.

    You can do this by either:

    • If you have a TCP connection open to the other party, call getsockname() on that socket to retrieve your IP address.
    • Or else, if you have no connection, make a dummy connection to a known service on the other party, and then call getsockname() on the connected socket.
    • Or if you cannot know about any specific service to connect to, bind a dummy socket to each known interface, and try a connection to the other party on a random port. The connection will fail quickly with WSAENETUNREACHABLE if you are trying the wrong interface. You will get either a successful connection, or a failure of connection refused you are on the right interface.
    • Or use SNMP to enumerate the route table on your computer, and work out the interface IP from that.
    • Or use Winsock 2 calls to determine the correct interface.

Notes:

  • When using WRP and the WinGate Internet Client, or a socks client and server, ALL client computers will immediately become multi-homed. For this reason guideline three becomes particularly important.
  • Some circuit-level proxies hook calls to getsockname() and getpeername(), and provide the interface on the server. Some do not. WRP/WGIC does.


DNS Service

The domain name system (DNS) is the way that Internet domain names are located and translated into IP addresses. A domain name is a meaningful and easy-to-remember "handle" for an Internet address.

While this generally requires little configuration, there are some cases where these may require some configuration. You should not enable the DNS Service in WinGate if you are already running a DNS server on the same computer - this could cause problems with your other DNS server.

The DNS Service properties can be opened from the System tab of the GateKeeper Control Panel.

DNS Service - General configuration

Close

checkbox Allow Request to initiate dialer

Check this box if you want a DNS request to initiate the dialer in WinGate.

Note:

  • If you already have DNS on your internal network, running in an Active Directory then you should read the section on Configuring DNS for WinGate in an Active Directory.
  • If you have a preferred DNS server to be used by WinGate, this can be listed in the DNS/WINS Resolver(found on the System tab in GateKeeper Control Panel.)
  • One of the quirks of the SOCKS4 protocol (fixed in SOCKS5) is that a request for a connection is made in the form of a request for connection to an IP number. This means that a SOCKS4 client needs to be able to look up addresses in order to supply this IP number to the SOCKS4 server.

See also:

  • Disabling the WinGate DNS Service
  • DNS Options


DNS options

DNS is essential for providing name lookup ability for the computers on your network. While it is recommended that you use the DNS in WinGate, there are other options. Various methods are detailed below, with their pros and cons.

  • WinGate DNS server

    This default method is the simplest, and the most powerful. The WinGate DNS server automatically recognises the name wingate. (with the period included) and will return the IP of the WinGate server. This eliminates the need for entries in hosts files. This method is not suitable if you want to have external name resolution for your site, i.e. if you have a domain name, you will need to run a third party DNS Server.

  • Mapped Link method

    This method is detailed in Adding a Mapped Link. The UDP Mapped link on port 53 allows all DNS requests to be mapped to an external DNS server. This is usually that of your ISP. This gives you access to a full DNS implementation, without having to run a third party server. This method is not suitable if you want to have external name resolution for your site, i.e. if you have a domain name, you will need to run a third party DNS Server. This does not provide name lookup for the name ‘wingate.' Clients can use hosts files if they wish to refer to the name wingate. .

  • Third Party DNS Server

    Running a stand-alone DNS server such as Bind is necessary if you host a domain name for your server. In this case, clients will receive their DNS service from the third party server. This does not provide name lookup for the name wingate. . Clients can use hosts files if they wish to refer to the name wingate..

Note:

Getting DNS working on your client computers can be tricky. We strongly recommend using the WinGate DNS and DHCP servers to simplify this process.


Disabling the WinGate DNS Service

You can use the WinGate DNS Server, or a UDP Mapped Link on port 53 for DNS. The WinGate DNS Server will be installed and started by default.

To disable the WinGate DNS Service:

  1. Open GateKeeper.

  2. Open the General Configuration of the DNS Service.

    DNS General screen

    Close

  3. From the Service startup drop down menu select Service is disabled.
  4. Click OK.

The WinGate DNS service is now disabled.


Remote Control Service

WinGate is completely controlled and configured using the administration tool called GateKeeper. GateKeeper communicates over an encrypted TCP/IP link with the WinGate engine for all configuration, monitoring, and control.

The service that provides this access in WinGate is the Remote Control Service (RCS). The service itself is installed and started when WinGate is installed.

(If for any reason the service is removed or becomes corrupted, WinGate will reinstall the service with default settings.)

Remote Control Service(RCS)

Close | Close all images

The RCS has various configuration tabs, though few changes will be necessary. The default service port is 808. This is the port on which the RCS listens so that GateKeeper can connect.

The RCS is used by any client that wishes to authenticate with WinGate, including GateKeeper, the Java Client Authentication (via a Web browser) or any third-party designed applications that use a Qbik-provided DLL for authentication.

Remote Control sessions

The Remote Control Service allows administrators to be able to use GateKeeper to log in remotely and configure WinGate. For security, the Remote Control Service is not bound to any network interface by default. However it will be automatically bound to the localhost address(127.0.0.1) since it is required to allow you to login to GateKeeper on the WinGate server itself.

For remote access to GateKeeper, the interface that you will connect to WinGate on (usually a LAN interface) needs to be bound to the remote control service before you are able to logon.

Click here to see an example binding configuration for the Remote Control Service

Remote Control Service - Bindings configuration

Close | Close all images

Here the remote control service has been bound the service to any Internal LAN interface which connections will be accepted on (allowing for remote GateKeeper logon) as this is not possible when it is only bound to (localhost 127.0.0.1 (localhost).

Click here for instructions on accessing GateKeeper remotely

Please note:

Remote Access to GateKeeper is available only if you are running a WinGate Pro or Enterprise license (regardless of version).

©2009 Qbik New Zealand Limited


Caching overview

Caching

What is caching?

Caching refers to storing commonly used data in a place where it can be quickly and conveniently retrieved when needed. WinGate provides caching of Internet material including graphics, HTML documents or other files if you are using the WWW Proxy Service.

If you are using the WinGate Internet Client or WinGate NAT then you will not benefit from caching of material downloaded from the web unless you have enabled transparent redirection in the Sessions configuration of the WWW Proxy Service.

This can dramatically improve the performance of web surfing by storing common access data on the local disk of the WinGate server. This is because you reduce the frequency that data must be downloaded from a computer somewhere on the Internet (because the same data is stored locally). You can always force your web browser to download the latest data by clicking Reload (Netscape) or Refresh (Internet Explorer).

What will WinGate cache?

A good feature of WinGate caching is that it is shared amongst all users of the WWW Proxy Service on your network. This is convenient in that the other users on your network are often likely to look at similar sites on the WWW as yourself (some of the time at least). This means that much of the Internet content you access will be held in the WinGate server cache. Consequently, you will not necessarily have to download it from a computer on the WWW (which is much more time consuming and expensive).

Click here to see the Caching Properties found on the System tab of the GateKeeper Control Panel.

Close

Cache Options

checkbox Enable cache lookups

Check this if you want to be able to get cached files from the local cache. If this is not selected, every document requested will be down loaded from the Internet.
The only reason to turn this off may be if you are having problems with a document that you think may have been updated.

checkbox Enable additions to the cache

Self explanatory. With this option checked, any file that is downloaded from the Internet through the WWW proxy will be saved in the cache directory. This is definable depending on the What to cache options.

checkbox Limit cache size to

The default is 200 megabytes.

Enable this check box to limit the total cache size. When the cache reaches your specified limit it will remove the least used 20% (to allow space for caching newer content).

Cache size guidelines:

These indicate the minimum recommended cache size:

  • 1-5 users, with 56k modem: 30 Mb
  • Up to 10 users, modem or ISDN: 40 Mb
  • More than 10 users with fast connection: 50 Mb

Useful hints:

  • Remember that caches improve in efficiency the higher the data through put. If your cache is small, increasing your cache size by a third can make them 100% more efficient.
  • With What to cache/purge options, you can dramatically cut bandwidth and speed your access.

checkbox Purge cache when full

Choosing this option will allow clearing of unwanted files (specified in What to purge) when the cache gets above the specified maximum. Please note that Purging is the clearing of files only until the maximum cache size is reached. Purging does not mean deleting all contents from the cache.

Re-checking

Number of days before rechecking HTML files

This setting means that if a file has been requested from the cache in the last number of days " " (that is set in this option), then do not check with the Internet server to see if it is still current.

Rechecking other files

As with HTML files. Graphics or FTP files don’t tend to change very often, and usually have discrete names. You may wish to set a higher refresh interval.

Rebuild Index

Check this button to make WinGate read the cache index file, and remove entries for files that have been deleted from the directory.
Use this if you have done a manual deletion of files, and you want to update the file.

Note:

WinGate will only cache HTTP requests (i.e. not FTP URLs) that use the "GET" method. WinGate will not cache any request that contains a query string (e.g. the response to any form submission). You can also create your own detailed rules to specify what WinGate will and will not store in the cache.

Note for users of Windows with NTFS formatted drives:

The cache directory can get very large. Most files are less than 5K in size, and it is not uncommon to have more than 10000 files in the cache. It is worthwhile running the cache on a drive with NTFS, as this will save you space and increase speed on the drive.

See also:

Caching - What to Cache

Caching - What to Purge


Caching - What to cache

The What to cache configuration in the Cache Properties allows you to set what should be cached by WinGate.

What to Cache configuration

Close | Close all images

The What to cache configuration allows you to set WinGate to either Cache everything or Specify which requests will be cached through the use of filters.

To create a filter of what should be cached:

  1. Open GateKeeper.
  2. Select the Cache Properties from the System tab.
  3. Select the What to cache configuration.
  4. Select the Specify which requests will be cached radio button.
  5. Click the Add Filter button (A new filter will appear in the window).
  6. Click the Add Criterion button to configure the details of filter.

  7. On the Criterion dialog select the This criterion is met if button to configure the circumstance where this filter will cause WinGate to cache the request.

    Or alternatively select the This criterion is NOT met if radio button to specify circumstance that will cause WinGate not to cache.

    Close | Close all images

  8. Click OK to add the criterion to the filter. (The criterion now appears in the What to cache window below the Filter entry)

    The new cache filters

    Close | Close all images

  9. Once you have set your filters, click OK to exit the Cache configuration.

Understanding Caching

To explain how the Caching works, we have to understand AND, OR and NOT, and how they are used to construct logical rules for use with WinGate.

  • AND

    If criteria are joined with an AND, then they must all evaluate to true for the rule to apply.

  • OR

    If criteria are joined with an OR, then only one of the criteria must evaluate to true for the rule to apply.

  • NOT

    This means that a rule will apply if the criteria does NOT evaluate to true.

For caching, all Filters are joined with an OR, while all Criterion listed in a single filter are joined with an AND (that is, they must all be true for the filter to apply).

So, if a request matches all the criteria of any of the filters then it will be cached. Otherwise, it will not be cached.

Note:

An easy trap to fall into occurs when you want to say: "Don’t cache data for Mary or Bob".

You may think that to implement this you would create two filters (one filter with a criterion Not User: Username equals mary, and another filter with a criterion Not User: Username equals bob).

However, this would not work as expected, because user Bob would be filtered out by the first filter, since his name is Bob. On the other hand, because his username is not Mary, he will pass through the second filter.

Conversely, since Mary's name is not Bob, she would be denied on filter one, but would pass through on the second filter.

What "don’t cache files for mary, or bob" really means is "cache files for NEITHER Mary NOR Bob".

To make this rule work, both of these criteria must hold so we place them in the same filter:

  1. Don’t cache the file if Bob requests it.
  2. Don’t cache the file if Mary requests it.

Show Example

Close | Close all images

In summary the logic is:

Cache files that are NOT requested by Bob AND NOT requested by Mary. This would result in a single filter with 2 criteria as demonstrated in the picture above.

Note on Negative Rules:

  • Negative rules (i.e. caching dependant on something not being met) become complex. The previous example shows that an entry may be denied in one filter, but allowed (either explicitly, or implicitly by not being denied) in another.
  • If you want multiple filters, but disallow some specific criterion, make sure you include this disallowed criterion in every filter. This applies to all rules in WinGate (including rules for caching and service access).


Caching - What to purge

When the cache directory gets to the set size limit, WinGate can initiate a purge, deleting unwanted or little used files.

This can be configured on the What to purge screen in the Cache properties configuration.

What to Purge

Close

By default there three filters already configured for purging the cache:

  1. Purge Large files

    While most of the files in the cache are small graphics, most of the space is taken up by a few large files. You could add a criterion to this filter for "not recently used", or for the hit count.

  2. Purge Unused cache files

    This will purge unused files from the cache. The first time a file is accessed, its hit count is 0. Every time the cached copy is retrieved, the hit-count is incremented.

  3. Purge Zero Length Files

    Purging zero length files is a very sensible idea. Sometimes there is a problem downloading a file, and no useful data is obtained. Deleting files with a length of 0 ensures that such files are not wasting directory space.

To explain how the caching works we have to understand AND, OR and NOT, and how they are used to construct logical rules for use with WinGate.

  • AND

    If criteria are joined with an AND, then they must all evaluate to true for the rule to apply.

  • OR

    If criteria are joined with an OR, then only one of the criteria must evaluate to true for the rule to apply.

  • NOT

    This means that a rule will apply if the criteria does NOT evaluate to true.

For purging all filters are joined with an OR while all criteria comprising a single filter are joined with an AND (that is they must all be true for the filter to apply). So if a cached file matches all the criteria of any of the filters then it will be purged.

Otherwise, it will be left in the cache.

You can think of these filters as a profile for a file that will be deleted. By adding filters, you are adding types of files that you want to purge. By adding criteria to a filter, you are further specifying the conditions under which this profile applies.

Note on Negative Rules:

Negative rules (i.e. purging depending on something not being met) become complex.

An entry may be denied in one filter, but allowed (either explicitly, or implicitly by not being denied) in another. If you want multiple filters, but disallow some specific criterion, make sure you include this disallowed criterion in each filter.

Click here to read more about setting filters in WinGate


Scheduler overview

An important feature of WinGate is the Scheduler. This feature allows you to automate many WinGate procedures.

Close

What is it?

The Scheduler is part of WinGate that does work for you at predefined times or intervals. It can do many WinGate functions, as well as running command line programs. The timing is configurable from minutes to months.

What does it do for me?

The scheduler can automate WinGate operations, such as backing up your log files, purging cache files, starting the dialer, and starting and stopping the WinGate engine. Also, WinGate can run external programs, including batch files. Entire system backups, uploads and downloads and many other procedures can be run at predefined times over any interval.

Do I need it? Will I use it?

This is completely up to you. Scheduling simply allows you to save time by doing an operation once, and being able to have it done automatically thereafter. Many people need to do a regular back up of their WinGate log files to prevent them getting too large. If you schedule a weekly backup, log files will never reach an unmanageable size. It is usually easier to set up a schedule for a job than doing the job itself! You don’t have to use the scheduler, but it is generally easier, safer, and less time consuming.

How do I use it?

Basically you create an event which is what action will be performed at a certain time or interval. Setting an event is simple and outlined in the Scheduler - Events section. A description of the actions that the WinGate scheduler can perform are listed in the Scheduler - Actions section.


Scheduler - Events

When using Scheduler it made up of events (occurrences) and what action happens at that event.

Events

An event can be thought of as "When the action happens". These can be scheduled or actioned either for a single event or a regular occurrence.

Regular occurrences can be hourly, daily, weekly, or monthly, at any time of day.

Adding Events

To add an Event to the Scheduler in WinGate:

  1. Open GateKeeper.

  2. Select the Scheduler Properties from the System tab on the GateKeeper Control Panel.

    Close | Close all images

  3. Select the Events configuration and click the Add button to open the Scheduled Event Properties dialog.

    Scheduled Event properties

    Close | Close all images

  4. Type a description of the event into the Description box.
  5. Tick the Event enabled checkbox to enable the event.
  6. Select either a Regular occurrence or Single occurrence radio button to determine when and how often the event will occur.
  7. Under the Actions section click the Add button to add an appropriate action that will take place when the scheduled event takes place.
  8. Click OK to exit the Scheduled Event Properties.
  9. Check on the Scheduler Properties that the event has been added and is now listed in the Events Window.

Click here to read about the Action events available with the WinGate Scheduler


Scheduler - Actions

After configuring an action for an event, the action will be listed in the Action window in the Scheduled event properties.

Scheduler Event properties

Close

When an event has more then one action that will take place, the actions are preformed in the order they are listed in the window.
You can prioritise the order of actions with the Up and Down buttons to the side of the window.

The following actions can be scheduled in an event:

Action

Options

Description

Stop Service

Any WinGate service

Stops the specified WinGate service

Start Service

Any WinGate service

Starts the specified WinGate service

Stop all services

None

Stops all WinGate services except the Remote control service

Start all services

None

Starts all WinGate services

Dial profile

Any WinGate dialer profile

Dials the selected dialer profile

Hang-up profile

Any WinGate dialer profile

Resets the selected dialer profile

Roll over log files

None

Starts new empty logs with the name format ..log

Roll over audit files

None

Starts new empty logs with the name format ..log

Export user accounts

Filename for the details to be exported to, Append

Exports the user account details in a tab-delimited form.

Reset user account

Reset user account

Resets a specific user account.

Reset all user accounts

None

Resets all user accounts.
This action, for all users:

  • Resets all Accounting quantity values to zero. That is, client/server bytes sent/received and seconds online.
  • Sets the opening balance to the previous closing balance.

The same actions are carried out for a single user if the Reset user account option is chosen.

Purge cache

None

Initiates a cache purge, as if you had hit the ‘Purge now’ button on the caching options

Terminate all sessions

None

Kills all current WinGate sessions

Execute command line

Command line

Run hidden This option allows a command line to be executed and whether or not to have it visible. This action can run command line programs on the WinGate server, at the specified time. If you wish to run several programs for this event, you can execute a batch file.

Send Message to Clients

GateKeeper Login Session Only

Puts message on remote GateKeeeper Screens

Reminder

Input appropriate reminder

Makes a reminder message appear in GateKeeper

Enable User

None

Enables selected user (if disabled)

Disable User

None

Disables selected user (if enabled)

Backup the WinGate registry

None

Will backup the WinGate registry to a registry file

Connect a VPN

None

Initiate connection to selected VPN

Disconnect a VPN

None

Disconnect from selected VPN

Force Mail queue

None

Will send all mail immediately

Reset Mail try counts

None

Resets the try counts on all currently undelivered mail

Run update for Plugins

None

Initiates updater executable for selected Plug-in if capable


Extended Network Services

Extended Network Support provides powerful Internet sharing capabilities to users on your WinGate network. Built around a virtual device driver, the WinGate network extensions enable packet-level access to information on the network, which allows WinGate to provide the following set of powerful new features:

NAT

This is the NAT (Network Address Translation) engine, which enables any networked computers to have direct access to an Internet connection on your WinGate server. It requires no manual proxy configuration or client software, and it can support virtually any operating system with unparalleled speed.

Support for Multiple Sub-networks (router)

This component allows you to share drives, files and other resources between computers that are connected but on different sub-networks. If WinGate has an interface connected to each subnet, then it will "route" both TCP and UDP data between them. * Note that disabling this option will hide the "Routing" tab.

Security Firewall Protection

This packet-filtering technology implements firewall and security for the WinGate server. Packet filtering provides powerful protection from attack (including denial of service (DOS), ping of death, port scanners, Trojans and many known Windows backdoors).

Please Note:

ENS is only available only if you are running WinGate with a version 4 or later key.


Extended Network Services - General

The ENS General configuration allows you to set options for the operation of the Extended Network driver of WinGate's Extended Network Services (ENS).

ENS - General configuration

Close

Status:

This shows whether the ENS driver is installed and active. Clicking on the (...) button to the right of this, will allow administrators to set whether the ENS driver should be loaded when the system starts or not.

checkbox Enable Extended Network Driver

If this box is is not ticked, NAT, VPN and other Extended Network Services will no longer be available.

checkbox General Purpose Internet sharing (NAT)

Tick this box to allow WinGate ENS to provide NAT (Network Address Translation) for clients.

checkbox Support for multiple subnetworks (router)

This option enables WinGate to act as a router and send data between dissimilar subnet address ranges. WinGate will need to have an interface to each subnet.

Disabling this option will hide the Routing screen in ENS.

checkbox Enable Bandwidth control

Ticking this box will enable the Bandwidth control configuration

checkbox Monitor for dead gateways

Ticking this option will make WinGate monitor each gateway IP address that has been assigned to the network interfaces on the WinGate server. If a gateway is found to be dead then it will be marked and not be able to be used as an external connection by WinGate.

If this option is not turned on then WinGate will deem that all network interfaces on the WinGate server that have a gateway IP address set will be available.

For more on how WinGate uses this feature see the section on the Gateways configuration in each user service in WinGate.

Firewall

Disable the WinGate Firewall

This setting disables the WinGate firewall completely. The WinGate server is no longer protected.

Low

Allows servers to run behind firewall. Allows Telnet, WWW, FTP, SMTP, NNTP, POP3 servers. Allows TCP & UDP 1024-4096. Allows TCP & UDP on internal interfaces

Medium

For games and Internet applications. Allows TCP & UDP 1024-4096. Allows TCP & UDP on internal interfaces.

High

Denies all connections from the outside. Allows TCP & UDP on internal interfaces.

Custom

For advanced users. This lets you add custom configuration options on top of the low, medium or high modes through the Port Security configuration.

checkbox Protect my system before WinGate has started

This option will deny all incoming network traffic from anywhere to the WinGate PC until after the WinGate Engine has started. This means network drives/connections/access on the WinGate server will not be available until the WinGate Engine is running.


WinGate firewall

WinGate is distributed with a comprehensive firewall system based around the use of its Extended Network driver. Since the ENS driver is a network layer driver it enables the WinGate firewall from this location, and so is able to protect every service, application and file above it and integrate transparently with any desktop environment.

All TCP and UDP network data is scrutinized well before it is able to reach the protocol stack, let alone your applications and data.

The main features are:

  • Extended Security Options

    These provide baseline security and protection and can be turned on or off individually (default port security based on network interface usage). Built-in default functionality is always on and protects your computer against popular attack strategies.

    (Click here to read more about the Port Security configuration)

  • Advanced Packet-Filtering

    Packets can be filtered by protocol, interface and port and either allowed, denied or redirected to another computer.

    (Click here to read about port security)

  • Intrusion Logging

    You are instantly alerted to any intrusion attempts or suspicious activity with a WinGate system log message and real-time display on the firewall tab in GateKeeper.

    (Click here to read more about the Firewall tab)

WinGate firewall FAQ

How does the WinGate firewall distinguish whether traffic is safe or not?

WinGate will always classify what type of network each network interface it has connects to.

  1. Internal protected network

    If the network interface has a private class IP address, then WinGate will consider the interface as being safe. e.g. this adapter connects to the LAN.

  2. External untrusted network

    If the network interface has a public IP address then WinGate will see it as an Internet connection as it considers the Internet (an untrusted network).

  3. External secure network

    This classification is for interfaces that are connected to a DMZ (Demilitarized Zone).

    Please Note:

    DMZ support is only available only to WinGate 6 Pro and Enterprise licenses.

From installation the WinGate firewall is protects your network by analysing any data connections that are made to any of these defined network interfaces.

Depending on the details and orientation of the connection being made, and the defined usage of the network interface, the WinGate firewall will implement one of several Connection security tables.

Connection | Protocol | Default Action
Connections from the Internet (External network connection to Internal) | TCP | Deny
LAN connections to the WinGate PC (Internal to Internal) | TCP | Allow
LAN connections to the Internet (Internal to External) | TCP | Allow

By default the WinGate firewall denies all connections from the Internet and allows outgoing LAN connections to the Internet (connections).

How can I see what outside intrusion attempts are being made against the WinGate firewall ?

You can see this realtime activity on the Firewall tab in GateKeeper, which provides comprehensive details about the nature of the attack.

Do I need to configure my clients applications to be able to access the Internet through the WinGate firewall ?

No by default all LAN connections to the Internet are deemed safe by WinGate since the clients are connecting through WinGate on an adapter marked as Internal and so trusted.

What about if we have Application Servers running on our LAN (such as a Web or FTP server) behind WinGate and these need to accessed from the Internet?

Since almost all connections from the Internet are blocked by default, WinGate's Port Security configuration allows you to open the appropriate ports in the WinGate firewall (for connections from the Internet) and redirect this traffic to the appropriate Application server on the LAN.

Will WinGate work if there is another third party firewall running on the WinGate server ?

For easy security and management of the network connections on the WinGate server, it is not recommended that there be two firewalls installed on the same machine as WinGate, as this can lead to ports being blocked by one firewall and disallowed by another, and vice versa. Since the WinGate servers main job will to provide security and control of the Internet connection, we recommend that you leave the WinGate firewall active so all port security can be handled by WinGate.

Will the LAN clients still be able to access the Internet through WinGate if the clients are running a firewall on their workstation ?

This scenario should work fine as the all client and WinGate traffic is on the LAN and so considered trusted. When in doubt check the third party firewall documentation for this type of scenario.

©2008 Qbik New Zealand Ltd


Extended Network Services - Bandwidth control

Bandwidth control allows you to limit or prioritise traffic flows through gateway machines.

Traditionally, bandwidth control is organized as a queuing discipline that delays or drops packets originated from the certain client or destined to the specified consumer, when the amount of traffic being pumped through reaches a well specified threshold.

Bandwidth control can be implemented on different levels:

  1. Application level

    Application level throttling works on the application protocols level, such as HTTP for Web browsing or SMTP for mail delivery. Throttling on this level does not take into account the lower-level protocols service information (like packets headers) nor does it count retries/broadcasts, etc. - things that multiply the amount of data being delivered.

  2. Packet level

    Packet level throttling is more flexible but far more complex to implement and control. Packet level throttling rules are identified by sender/receiver IP addresses, port numbers, protocol types, etc. Any retries or packet multiplications are taken into account by default. However, throttling on this level often delivers abrupt changes in traffic patterns which can be smoothed down a little bit by changing packet characteristics.

WinGate bandwidth control utilises the Packet Level approach. The driver examines all packets it intercepts and makes a decision whether the packet is to be delayed/queued or delivered immediately.

How to activate Bandwidth control

WinGate bandwidth control is activated by ticking the Enable Bandwidth control checkbox on the ENS General properties page.

ENS General configuration

Close | Close all images

Once ticked the Bandwidth control configuration will appear:

  1. Scheduling

    The Bandwidth Scheduling configuration is where you can set how bandwidth is handled when there has been more then one rule placed on particular traffic.

    Bandwidth Scheduling screen

    Close | Close all images

  2. Restrictions

    From the Bandwidth Restrictions configuration you can create restriction rules for certain traffic and prioritise how the restriction is handled against other bandwidth rules that may have been created.

    Bandwidth Restriction screen

    Close | Close all images

  3. Click Add to add a new restriction. This will bring up the Restriction properties.

    Restriction properties screen

    Close | Close all images

    Name

    Enter a name for the restriction.

    Priority Group

    This sets how this restriction will be handled (what priority it will be given in relation to other bandwidth rules).

    Restriction

    This is the actual restriction rule which can be:

    • Percentage of available

      Percentage of available bandwidth.

    • Kilobits

      Restrict by actual Kilobits.

    • Unrestricted

      This will only prioritise traffic.

  4. Rules

    The Bandwidth Rules screen is where you create the rules that will apply the bandwidth restriction.

    Bandwidth Rules screen

    Close | Close all images

  5. Click Add to create a new rule. This will bring up the Rule properties .

    • General

      On the General tab you can select various general options for the rule.

      Rule properties - General tab

      Close | Close all images

      Protocol

      You can configure bandwidth throttling rules based on either TCP or UDP or both.

      Various options, such as controlling of maximum TCP window size, including Induced traffic (secondary traffic in the TCP/UDP connections e.g. FTP Control channels) are available.

      Apply Restriction

      This implements the restriction rule configured under the restriction tab.

      Allow restriction for reverse traffic

      Allows you to specify a restriction for Reverse traffic.

    • Source / Destination

      Rule properties - Source/Destination tab

      Close | Close all images

      Here you can define the source and destination IP address to be affected by the bandwidth rule.

    • Time Frame

      Here you can set the time and duration of the Bandwidth rule within various time options.

      Rule properties - Time Frame tab

      Close | Close all images

Please Note:

Bandwidth control is available only to WinGate 6 Pro and Enterprise licenses

©2009 Qbik New Zealand Limited


Extended Network Services - Firewall

The WinGate security firewall protection is a packet-level firewall solution that goes well beyond the proxy-firewall support in previous versions. This feature provides complete protection of your gateway PC (and the rest of your LAN) from network attacks. Security is applied where it counts - beneath the operating system at the network layer.

From this location, it is able to protect every service, application and file above it, and integrate transparently with any desktop environment. All TCP and UDP network data is scrutinized well before it is able to reach the protocol stack, let alone your applications and data.

The main features of the WinGate firewall are:

  • Extended security options

    These provide baseline security and protection and can be turned on or off individually. Built-in default functionality is always on and protects your computer against popular attack strategies.

  • Advanced packet filtering

    Packets can be filtered by protocol, interface and port and either allowed, denied or redirected to another computer (see Port Security)

  • Intrusion logging

    You are instantly alerted to any intrusion attempts or suspicious activity with a WinGate system log message (see Port Security).

The Firewall configuration in the Extended Network Services properties, allows you to set various options for the WinGate firewall.

ENS - Firewall configuration

Close

Enhanced Security Options

checkbox Disable network name broadcasts to the Internet

Selecting this option will disable NetBIOS name broadcast (usually sent around the LAN) being broadcast over the external interface (and the Internet) of the WinGate PC.

checkbox Allow users to ping this machine locally

This allows users on the LAN to ping the WinGate server (useful for testing client connectivity).

checkbox Allow users to ping this machine from the Internet

Not checked by default this setting will allow/disallow remote Internet locations to ping the external interface of the WinGate server.

checkbox Discard spoofed packets

If this option is enabled, WinGate will check to ensure that the source IP address in the packet header is really the computer that made the request. If it is not, the packet will be discarded.


Extended Network Services - Routing

The Routing configuration in the Extended Network configuration provides control over the way WinGate will handle routing.

ENS - Routing configuration

Close

checkbox Relay UDP broadcast packets

This option specifies whether or not you want the WinGate server to route UDP broadcast messages between subnets. If this is disabled then network browsing between subnets will not work (as computers on different subnets will not know anything about each other).

Typically UDP broadcasts are used for:

  • Telling other computers on the subnet about your computer at boot-time (like NETBIOS name, IP address, OS, and any important services running).
  • Finding out about other computers on your network (e.g. who is the PDC or who is running a DHCP server).

We recommend you have this option turned ON.

checkbox Indicate UDP traffic (Ports < 1024)

The default behaviour for the WinGate NAT is to notify the WinGate Engine of any UDP traffic below port 1024 as soon as it occurs. UDP traffic above port 1024 is only shown if it remains active for a longer time frame. (20 seconds with at least 10 seconds since the last activity)

On systems that have extensive UDP traffic over NAT (Such as a DNS redirect) the volume of traffic could cause an increase in memory usage. This switch allows you to control the display of UDP sessions instigated on port 1024 and lower.

When this option is ticked ALL UDP traffic will only be indicated if it is being Transparently Redirected or if it remains active for a longer time frame.

checkbox Enable support for multiple default routes

When a dialup connection is made, another default gateway is added to the router. This default gateway is assigned a higher priority to the normal one and will cause problems with routing between subnets. This is because packets addressed to the other subnet will be sent to the higher priority default gateway (which is the dialup adapter connected to the Internet).

When this option is enabled WinGate will intercept any packets addressed to private IP’s and re-route them to the original default gateway (this way they will reach the destination subnet successfully). Consequently, if this option is disabled, routing between subnets may not work when the gateway computer is online via DUN.

Clicking the Advanced button brings up the Advanced Broadcast Port configuration, which allows you to specify which UDP ports are required for the purpose of allowing and assisting UDP broadcast across the LAN.


Extended Network Services - IP Blackhole

The IP Blackhole configuration in the Extended Network Services enables you to ban particular IPs from entering your network.

ENS - IP Blackhole configuration

Close

checkbox Enable IP Blackhole list

Check this setting to enable WinGate to use the Blackhole list. Unchecking this option disables WinGate checking/using the IP blackhole list which means that IP addresses on your blackhole list may still be allowed onto your network.

You can enter banned IP addresses into GateKeeper in one of two ways:

  1. By clicking Add in the IP Blackhole configuration, then typing the IP you want to ban and clicking OK.

    You may then also Delete IPs as and when required.

    Ban a range of IP addresses

    You may also add entire ranges of IP addresses to your ban list. In the screenshot of the IP Blackhole configuration for example, the 1st IP on the list has a ‘0’ on the end – as does its mask. This means that all machines on the same subnet as this IP, are now also banned from your network.

    Note:

    Ensure the Enable IP Blackhole list checkbox is ticked to make the driver check for these IPs. Failure to do so will mean that these IPs will still be allowed onto your network.

  2. By locating the IP address you want to ban in GateKeeper.

    This can be done by right clicking on an IP address as it appears in the Activity, History, or Firewall tabs, and selecting Blackhole IP .... from the menu. This will add the IP address to the banned list which resides on the IP Blackhole screen.

Note:

You should be careful not to ban any of your network’s own IPs.


Extended Network Services - Port Security

This ENS Port Security configuration enables you to view and configure the port security features of the WinGate firewall.

Port Security screen

Close | Close all images

WinGate Port Security

The WinGate firewall determines which ports for traffic should be opened, closed or redirected etc, based on the following:

  1. Which network interface it receives the data connection on
  2. The details in the packet addressing
  3. What usage WinGate has classified for that network interface

Interface usage

Network interfaces on the WinGate server are classified by WinGate (or configured manually) into three different uses:

  1. Internal - The network interface is connected to a local trusted network.
  2. External - The network interface is connected to an External untrusted network (such as the Internet)
  3. External (trusted) - This network interface is connected to a secure External network or DMZ

Please Note:

DMZ support is only available in WinGate Pro or Enterprise licences

(Click here to read more about how WinGate uses network interfaces)

Firewall connections

When handling traffic, the WinGate firewall defines 5 different types of connections that it will recognise (based on the networking factors described above)

Connection type

Description

Firewall default action

Connections from the Internet

If packet is received on a network interface where its usage is marked as External on the WinGate server, and it's not a previously known connection, then this is considered to be a connection from the Internet. This option is used most commonly for inbound connections from the Internet.

The default action of the WinGate firewall is to deny all traffic when it receives this type of connection.

LAN connections to the WinGate PC

This type of connection occurs when packets are received on a network interface marked as Internal (Trusted network) on the WinGate server, and their destination is the local WinGate machine IP address.

The default action is for the firewall to allow these packets.

LAN connections to the Internet

This type of connection happens when packets are received on a network interface marked as Internal or DMZ on the WinGate server, which are NOT destined for WinGate, but where their matching route implies that the packet would need to be forwarded out an interface marked as External or DMZ - e.g. Normal NAT, Internet requests.

This is the most common connection for clients making ordinary outgoing Internet requests, such as HTTP,FTP etc and the default action for the WinGate firewall is to allow these connections.

This is the most common connection for clients making ordinary outgoing Internet requests, such as HTTP,FTP etc and the default action for the WinGate firewall is to allow these connections.

Connections from the Internet to DMZ computers

This type of connection happens when packets are received on a network interface marked as External on the WinGate Server, and their destination is to an adapter marked as a DMZ adapter.

The default action for this type of connection is to deny these types of connections

Connections from DMZ to the WinGate PC

This type of connection occurs when the packets sent by machines connected to the DMZ are received by the WinGate DMZ adapter but where their destination is WinGate IP address (LAN).

The default action is to allow these types of connections

These connection type categories make viewing and adding port security filters an easy process in the WinGate firewall. Specific port security filters can be configured on each of these connection types as required. The WinGate firewall default action for each connection type are designed to give a balance between functionality and strong security.

  • It provides maximum protection from attacks originating from the Internet (by denying all LAN-bound packets arriving on the external interface)
  • It provides maximum flexibility for Internet users on your LAN (by allowing all Internet-bound packets from your LAN out)
  • You can also ban particular IPs using WinGate's IP ban list.

Viewing current Port Security filters

To view the current port security filters that have been configured for each connection type:

  1. Open GateKeeper.
  2. Select Extended Network Services from the System tab on the GateKeeper Control Panel.

  3. Select the Port Security configuration

    ENS - Port Security configuration

    Close | Close all images

  4. Select the type of connection that you want to check the security for on from the drop down menu.
  5. Select the protocol type, which will by either TCP or UDP.
  6. The current port security filters will be displayed in the Port Security window.

Security Filters

Security filters provide you with a way of adding more control and flexibility to the firewall without compromising security. Security filters allow the firewall administrator to:

  • Create holes in the firewall to allow users on the Internet to access servers running on your LAN. Note that when you bind a WinGate Service to an interface / port combination that is blocked by the firewall, WinGate will offer to create a "hole" (we recommend allowing WinGate to do this for you). Of course when you unbind or delete the service the "hole" will be automatically blocked again by the firewall.
  • Deny packets on single ports or port ranges (this closes the ports - by default any unused ports will be hidden)
  • Redirect packets to another computer, either behind or outside the firewall.

Clicking the Add button allows you to create a new port security filter for the chosen firewall connection type. This provides more control over specific ports in the firewall.

You can edit the existing port security filters on a particular connection type, by highlighting a particular filter in the Port Security window and clicking the Edit button.

WinGate allows you to Allow, Deny or Redirect any packets that meet specific criteria.

Click here for instructions on using the Port Configuration dialog to create Security filters

©2008 Qbik New Zealand Ltd


Extended Network Services - Port Range Configuration

You can create security filters for traffic travelling across the network connections (interfaces) in WinGate.

All outbound client requests to the Internet will be managed by WinGate automatically without needing to configure any security filters. WinGate will open and close the appropriate ports for the duration of the connection.

However when a remote Internet user/machine makes an inbound request (e.g. to a web server running on or behind WinGate) then you will need to allow this request through the WinGate firewall, by creating the appropriate port security filter, since all inbound connections are blocked by default.

Security filters can be created by clicking the Add button on the ENS Port Security configuration which will open the Port Range Configuration dialog.

Port Range Configuration

Close | Close all images

Port range specification

checkbox Internet computers to the WinGate PC

If packet is received on an interface marked as External on the WinGate server, and it's not a previously known connection this table applies. This option is used most commonly for inbound connections from the Internet.

checkbox Internet computers to DMZ

Packets that are received on an interface marked as External on the WinGate Server, and their destination is to an adapter marked as a DMZ adapter.

checkbox Local computers to the WinGate PC

Packets that are received on an interface marked as Internal on the WinGate server, and destination is the local WinGate machine IP address.

checkbox Local computers to the Internet

Packets received on an interface marked as Internal or DMZ on the WinGate server, which is NOT destined for WinGate, but where the matching route implies that the packet would need to be forwarded out an interface marked as External or DMZ - e.g. Normal NAT.

checkbox DMZ computers to the WinGate PC

Packets that are received on an interface marked as DMZ by WinGate, where the destination address is the WinGate LAN interface.

checkbox TCP or UDP

Select whether this filter will apply to either TCP or UDP traffic(or both)

checkbox Ports

The port on which the packet is attempting a connection (specify a single port or a range of ports)

Actions

Allow packet

The packet is "allowed" to pass through the WinGate firewall to the TCP/IP protocol stack.

Drop packet

The packet is dropped at the front door of your network - this action renders the port closed/disabled

Redirect

The packet can be redirected to another computer or port - this is much like a traditional WinGate mapped link only it occurs at a much lower-level

Options

checkbox Use SYN cookies

This allows WinGate to control a session of packets before they are allowed to even enter the port by keeping track of valid Ack requests from a host on the Internet, so that bogus packets (which can be used in a Network attack called a SynFlood type of attack) will have less chance to penetrate WinGate’s defences.

This option is not ticked by default to allow for maximum application session compatibility and should only be implemented by administrators who are experienced with TCP session mechanisms.

checkbox Notify on access

With this option ticked, when the specified range is accessed, there will be notification on the Firewall tab in GateKeeper.

checkbox Cloak connection failures

This option is ticked by default. What this means in simple terms is that when a would be attacker is scanning the WinGate server to find vunerable ports, WinGate will disguise the port’s status by so it will be overlooked by the port scanner.

Note on port cloaking :

When a port (or range of ports) is open, WinGate will allow any packets directed to such a port to be further processed by the TCP/IP protocol stack which will then pass it on to the OS or application if everything checks out. Even if nothing is listening on that port, the OS will normally respond to a connection request no matter what; basically, if there is nothing listening, it will send back a TCP RST packet (connection refused).

If the OS responds with a TCP RST packet and you have Cloak connection failures selected, then WinGate will intercept the TCP RST packet and discard it.

This means that if you open up a range of ports but no application is listening (e.g. web or mail server) then there will be NO response (as opposed to the OS explicitly telling the client that nothing is listening here via the TCP RST packet). Port scanners will not see or hear anything from that port.

If there is something listening however, then you would be able to connect to it, since you have that port range opened up.

Use default timeouts

Use the standard default time out values as these generally never need to be altered. Setting packets to never time out is considered dangerous and not recommended.

Note:

WinGate can set up required "holes" automatically when you bind a WinGate service to an interface/port combination that is usually blocked by the firewall. WinGate will offer to create a "hole" (we recommend allowing WinGate to do this for you). Of course, when you unbind or delete the service the "hole" will be automatically blocked again by the firewall.

Configuring security filters:

  1. Open GateKeeper.
  2. Select Extended Network Services from the System tab of the GateKeeper Control Panel.
  3. Open the ENS Port security screen.

  4. Click the Add button to bring up the Port Range Configuration dialog.

    Port Range Configuration

    Close| Close all images

In the Port Range Configuration:

  1. In the Port range specification section enter a description for this filter that will easily identify its purpose.
  2. Select the type of connection that will be affected by the security filter.
  3. Select the appropriate protocol (either TCP or UDP) that this filter will cover.
  4. Specify the appropriate ports (port range) that is influenced with this filter, and enter a description.

  5. Under the Action section, select an action to take when a packet uses this port.

    You can choose: Allow, Drop, or Redirect Packet to IP address (for example a Web server running behind WinGate)

  6. Click OK , the newly created filter should now appear in the ENS Port security configuration screen.


Auto Port Range Configuration

When an interface is bound to a service in WinGate, the appropriate ports are configured automatically (by default) in the WinGate firewall for each particular service (such as TCP Port 80 for the WWW service, TCP Port 21 for FTP etc). You can see what auto ports there are through the port security dialog in the ENS configuration.

To reach the Auto Port Range configuration:

  1. Open the ENS configuration in GateKeeper.

  2. Select the Port Security configuration and select LAN connections to the WinGate PC, from the drop down menu at the top of the window.

    ENS - Port Security configuration

    Close | Close all images

  3. Double click on the desired entry to bring up the Auto Port Range Configuration.

    Auto Port Range Configuration

    Close | Close all images

The Auto Port Range Configuration displays details about the Auto port and the options that have been may have been set on the particular range. These options can be configured in the binding policy when the auto port is created from binding an adapter to a proxy service.

Note:

For detailed explanation on these options see either the Bindings or Creating Port Security filters sections.


Advanced Broadcast Ports

The Advanced Broadcast Port configuration can be accessed by clicking the Advanced button on the Routing configuration in the ENS properties in GateKeeper.

Advanced Broadcast Port configuration

Close

It is possible in WinGate to specify which UDP ports are required for the purpose of allowing and assisting UDP broadcast across the LAN. By default UDP ports 137 and 138 are listed and enabled to help with NetBIOS functionality. (i.e. NetBIOS broadcasts used in Windows browsing services).

Commonly used to assist with UDP broadcasting across extended networks in the WinGate VPN, the Advanced Broadcast configuration can be used for such purposes as DHCP, and LAN based gaming (that uses UDP broadcasts to advertise hosted games) as required.

To add a UDP broadcast port:

  1. Open the Routing section of the ENS configuration in GateKeeper.
  2. Click on the Advanced button. The Advanced Broadcast Port configuration should appear.
  3. Click Add to bring up the UDP edit dialog.
  4. Enter the required port and a description.
  5. Make sure there is a tick in the Enabled check box, then click OK.

The newly entered port should now appear in the Advanced Broadcast Port screen.


DNS/WINS Resolver Configuration - DNS

With the DNS/WINS resolver DNS configuration, you can define specific servers that WinGate will use to resolve domain names (DNS). WinGate will always attempt to use the DNS server(s) listed here first before trying any other DNS servers.

DNS/WINS Resolver - DNS configuration

Close

Use the Add and Delete buttons to select these servers.

checkbox Lookup names in the system HOSTS file

Check this box if you want to resolve IP addresses to DNS names through a host file which is stored in a certain directory on your machine – in this example they are being kept in C:\WINDOWS\Hosts. Click the Edit button to bring up your Windows Explorer if you wish to change where the Hosts file is kept.


DNS/WINS Resolver - WINS

The DNS/WINS resolver WINS configuration allows you to let WinGate use the LMHOSTS file, so NetBIOS names can be resolved to IP addresses.

DNS/WINS Resolver - WINS configuration

Close

checkbox Lookup names in the system LMHOSTS file

Check this box to resolve NetBIOS names to IP addresses through a host file which is stored in a certain directory on your machine – in this example they are being kept in C:\WINDOWS\LMhosts.

Click the Edit button to bring up your Windows Explorer if you wish to change this.

checkbox Enable periodic network enumeration

Selecting this checkbox enables a periodic search for NetBIOS information. Once ticked this search will occur every 10 minutes.

Note:

As is normal with Operating system NetBIOS operation, an initial search occurs at boot time regardless of the Enable periodic network enumeration checkbox setting.

NetBIOS information is also accumulated during normal system operation.


DNS/WINS Resolver - Cache

The DNS/WINS Resolver Cache configuration allows you to configure the options on how the DNS\WINS resolver should cache DNS information.

DNS/WINS Resolver - Cache configuration

Close

Configuration

checkbox Enable lookup of cached resources

Check this box to enable DNS caching.

Maximum memory usage

This determines how much DNS information can be cached before it gets purged. This amount defaults to 10000 KB (or 10 MB).

Purge

Empties the cache to the limits specified by Maximum Memory Usage.

Empty

Empties the entire DNS cache.

Status Review

Memory usage

This denotes the amount of memory being used by the DNS cache.

Cache hits

This denotes the exact number of DNS requests being served by the cache.

Full conditions

The number of times that the DNS cache has been full during this session.

Since resolver start

The time and date that this DNS Resolver session started.


DNS/WINS Resolver - Advanced

The DNS/WINS Resolver Advanced configuration allows you to set advanced options for the DNS/WINS resolver.

DNS/WINS Resolver - Advanced configuration

Close

checkbox Add DHCP domain to single label names

Check this box if you want to create email addresses with one single name e.g. @mail, or if your ISP has allocated your server a default DNS domain via DHCP – this will be the case for ATT&T cable modem installations.


Server Certificate Manager

From version 6.1, WinGate manages X509 Certificates in one centralized location called Server Certificate Manager, which is located on the System tab of the GateKeeper Control Panel.

Server Certificate Manager

Close

There are two places you will normally use certificates:

  1. Bindings that will use TLS or SSL connections such as the WinGate Mail Server.
  2. The WinGate VPN.

These certificates are used to ensure the identity of your WinGate computer to third parties connecting in to it.

In the VPN case it uniquely identifies the VPN Host and clients can verify this by requiring a certificate fingerprint match before it will connect to the server. This helps protect you against man-in-the-middle attacks.

For the WinGate Mail Server it identifies the computer to any mail client that connects securely to your mail server. The name used in the Certificate must match the name that people will connect to for most email clients to consider it valid.

If you are upgrading from a previous version of WinGate and you had existing certificates for any hosted VPNs or for your mail server the certificates will be migrated automatically.

Clicking the Add button will open the Certificate dialog where you can create a new certificate.

Click here for instructions on creating server certificates.

Note:

SSL support on bindings is only available with a WinGate Enterprise license.

©2009 Qbik New Zealand Limited


Creating Server certificates

To create a certificate:

  1. Open GateKeeper.
  2. Select the Server Certificates Manager on the System tab in the GateKeeper Control Panel.

  3. Click the Add button. This opens a Certificate general information screen.

    Certificate details screen

    Close | Close all images

  4. Enter the Name for the certificate in the top edit control. This is the user-friendly name that you will use to remember this certificate by.

  5. Click the Generate button. This button will only be available once you have entered at least one character in Name box. This will open the Details of the Certificate dialog.

    Details of the Certificate dialog

    Close | Close all images

  6. Fill in your required details on the Details of the Certificate dialog. Only the Name field is compulsory, however the other details make identifying the purpose of the certificate much easier

  7. Next determine if you want the certificate to be encrypted. If you encrypt the certificate, it will be stored on your computer in an encrypted form. This does not affect the way in which WinGate will use the certificate. Ticking the Encrypt Certificate (Optional) checkbox will open the Encryption Options dialog:

    Close | Close all images

    • Encryption

      There are two different encryption schemes offered.

      1. DES in CBC mode
      2. 3DES in EDE CBC mode

      If you chose to encrypt the certificate, you must specify the type of encryption you wish to use. Either of these two schemes can be chosen.

    • Options

      The exponent option lets you set what type of exponent will be used in the calculation of the encryption.

      The two options from this drop-down box are:

      1. Use 65537 for the exponent
      2. Use 3 for the exponent

      You should note that there is a trade-off between security and speed. A smaller exponent (in this case 3) means a faster, but less secure, operation.

    • Size

      This refers to the size of the private key, expressed in bits.

    • Passphrase

      The passphrase is used to decrypt the private key from persistent storage. The longer the passphrase is, the more securely it will be stored. The Passphrase and Confirm fields must match.

  8. Click Next on the Encryption Options screen. This will open the Confirm Details dialog which shows you the final details of the certificate you are about to generate. All the fields you have filled in will be displayed.

    Close | Close all images

  9. If you are sure that everything is correct, click Finish to be returned to the Certificate General information screen.
  10. At this point, the request has not been sent to WinGate for processing. If you want the request submitted to WinGate you must click OK.
  11. Check to see that the newly generated certificate shows up after a few seconds in the list of Server Certificates Manager. You can then use that certificate to identify your VPN, Mail Server or as required for your SSL bindings.

Please Note:

SSL support on bindings is only available with a WinGate Enterprise license (from version 6.1).

©2009 Qbik New Zealand Limited


Adding user services

Adding new proxy service in GateKeeper is a simple procedure. It can be useful for providing an alternative proxy for special purposes, or simply greater control over users and groups when they access the Internet through the proxy. Each new proxy service you create must have a unique name and Service port number.

All services are displayed and configured from a standard dialog.

To add a user service in WinGate:

  1. Open GateKeeper.
  2. Select the Services tab in the GateKeeper Control Panel.

  3. Right click anywhere on the Services tab and from the menu select New service - and the type of service you wish to add.

    Close

  4. On the new service configuration that appears, type in a unique name for the service and a description.
  5. Choose the Service port for the service to run on, or if its not being used already accept the default.
  6. Click OK.

The service is now configured and ready to accept client requests. Remember that the new proxy service must be using a unique Name and Service port to listen for client requests. If the service attempts to use the same Service port that is being used by another Proxy service, including being intercepted by transparent proxy, then it will be stopped automatically (or refuse to start) and display the Service error icon (below).

Service icons

  • Active service icon Active Service

    This icon is displayed next to all the services (System and User) in the System/Services tab on the GateKeeper Control Panel. This icon indicates that a service (for example HTTP, FTP or DNS) is running.

  • Stopped service icon Stopped Service

    The cross indicates that a service is not running.

  • Service error icon Service Error

    The service error icon is displayed if a service could not be started. This usually means a port conflict, i.e. two services attempting to bind and run on the same port.


Transparent proxy - transparent redirection

The Transparent proxy feature in WinGate allows a WinGate Proxy service to intercept ANY client connections that are made to the configured port(s) it is set to listen on, regardless of the type of client connection method is used. Usually the proxy servers only receive requests from clients who have their application set to use the proxy (Application proxy method), but by using the Transparent proxy feature, the Proxy service is able to intercept any type of client connection method (NAT,WGIC, or Application proxy) that is making a request on the designated port(s).

For example setting the Transparent proxy in the WWW Proxy server to intercept all traffic on port 80, means that NAT and WGIC clients who make WWW requests on port 80 to the Internet, will be forced through the WWW Proxy and subjected to the policies and settings in the WWW Proxy server. This is especially useful if the optional data scanning plugins (Kaspersky Antivirus for WinGate etc) have been installed in the WWW Proxy and you wish to have ALL client HTTP traffic scanned.

Transparent proxy (also referred to as Transparent redirection or Intercepts) is currently available in the Sessions configuration for the following WinGate Proxy Servers:

  • FTP
  • Logfile Server
  • RTSP
  • Telnet
  • WWW
  • POP3
  • SMTP
  • TCP and UDP mapped links

To utilize the Transparent proxy:

  1. Open GateKeeper.
  2. Open the particular service you wish to enable transparent redirection on (in this example its the WWW Proxy server) in the Services tab in GateKeeper).

  3. Open the Sessions configuration for the service.

    Close | Close all images

  4. Under the Transparent proxy option, tick the Intercept connections made via ENS, the WinGate Client, or SOCKS server on the following ports

  5. Click the Add button. This will bring up the Edit Service Intercept Port dialog.

    Edit Service Intercept port dialog

    Close | Close all images

  6. Make sure the Intercept enabled checkbox is ticked, and the appropriate port is listed (will usually be the same port as the service).
  7. Click OK to return to the Sessions screen.
  8. Check to see that the Transparent proxy window on the Sessions screen now contains the port to be intercepted.
  9. Click OK to apply your changes and exit the Sessions screen. You can re-open the Session screen in the service to see that the port is listed as Started.

Key benefits:

  • Utilize PureSight for WinGate plug-in - This effective content filtering plug-in utilizes a primary Internet filter technology, which previews the content of a website, determines if it is inappropriate, and blocks the site if necessary. The PureSight for WinGate content filtering solution works in conjunction with the WWW proxy server in GateKeeper, therefore, if client computers are connecting via WGIC or NAT, it is essential that Transparent redirection be enabled in the WWW proxy server.
  • Utilize AntiVirus plug-in for WinGate - Due to the steady increase of security threats, protecting against malicious viruses requires a solution that controls all possible virus entry points. Kaspersky AntiVirus for WinGate from AntiVirus industry leader Kaspersky Labs is that solution. The antivirus plug-in runs on the proxy level; therefore, if client computers are connecting via WGIC or NAT, it is essential that transparent redirection be enabled.
  • Simplify administration of policies - When Transparent redirection is enabled in the WWW service, this allows administrators to enable Java client authentication, which then forces all initial web requests made by WinGate client computers to login using Java client authentication, regardless of what WinGate client connection method is being used. Consequently, web restriction policies for all WinGate users and groups can be created and enforced from the centralized location of the WWW proxy server.


FTP Proxy server

The FTP Proxy server allows use of FTP client applications that support the username@hostname method of firewall traversal.

Examples of this are WS_FTP, and CuteFTP, as well as command-line FTP clients.

Port 21 is normally used for FTP.

FTP Proxy Server

Close

When using the FTP Server with plugins there are two additional options that help protect your network against unwanted or harmful content.

It is recommended that you choose the option most suited to your typical usage scenario.

checkbox Disable FTP restarts

You have the option of blocking the REST command so downloads cannot be resumed at the point of where it has been blocked by an appropriate data scanning plug in. Checking this stops disrupted FTP downloads being restarted by client FTP Applications

checkbox Pad out blocked files (recommended)

This assists helping to stop client FTP applications from timing out as data is scanned by plugins through WinGate. You can choose to continue feeding the FTP client data up unto the size it was expecting. This data will be zeroed, so any file retrieved after this blocking will be invalid and unusable.


Adding an FTP Proxy server

It is simple to add an FTP Proxy in WinGate. FTP uses port 21 (default).

If this is the second FTP Proxy server you are creating, or already have an FTP server installed on the machine using port 21, then remember to set the new Service port to something other then 21 to avoid port conflict (since this will already be used by the default FTP Proxy or the FTP server).

To add an FTP Proxy:

  1. Open GateKeeper.
  2. Select the Services tab on the GateKeeper Control Panel.

  3. Right click anywhere on the Services tab and select New Service - FTP Service.

    New FTP Service

    Close | Close all images

  4. On the General configuration of the new FTP service properties, enter the port number clients will be connecting to the FTP Proxy on in the Service port field. This is usually 21 unless you have a FTP server running on that port. In that case you will need another unused port to use.

    FTP Proxy - General configuration

    Close | Close all images

  5. Click OK.

You may also run an FTP server on your network and have it accessible through WinGate from the Internet or your local LAN as though WinGate were an FTP server.

  1. Click on the Server Requests configuration in the FTP Proxy server properties.

    FTP Proxy - Server requests configuration

    Close | Close all images

  2. Enter the address and port number of the computer that your FTP server is running on.


Real Audio Proxy server

WinGate also has a Real Audio proxy in its user services.

Close | Close all images

Port 1090 is the standard port for RealAudio.

Note:

The RealAudio Proxy supports the PNA protocol only used by older versions of RealNetworks’ RealPlayer client. You may still want to use this service, but it has been superseded by the RTSP Proxy. We suggest you use the RTSP, rather than the RealAudio Proxy.

To add a RealAudio Proxy:

  1. Open GateKeeper.
  2. Select the Services tab on the GateKeeper Control Panel.

  3. Right click anywhere on the Services tab and select New Service - RealAudio Proxy Service.

    New FTP Service

    Close | Close all images

  4. On the General configuration of the new RealAudio service, enter the port number clients will be connecting to the RealAudio Proxy on in the Service port field. This is usually 1090. If this is already in use, you will need another unused port to use.

    Real Audio - General configuration

    Close | Close all images

  5. Click OK.

You should note that the RealAudio player defaults to port 1080 for their proxy configuration. This is normally used by the WinGate SOCKS service, and so you should make sure when configuring your RealAudio player, that you specify the port number you have chosen for the RealAudio Proxy service in WinGate.

©2008 Qbik New Zealand Ltd


Logfile Server

For easy viewing of user audits and service log files, WinGate has a Logfile Server, which is installed by default.

Close

This is actually a WWW proxy service running on port 8010 that is configured to serve audit and log files to a web browser.

To use this service you will need to make sure that your client web browser is configured properly. This means not using a proxy for the WinGate server computer since it is served from within your network (not on the Internet).

Add this line to your Don’t use proxies for section in your browser set up:

(Example) 192.168.1.1: 8010 (substituting "192.168.0.1" for the private IP address of your WinGate server)

Viewing the WinGate log files from a web browser

Simply cut and paste the following into your browser address field:

http://192.168.0.1:8010 (substituting "192.168.0.1" for the private IP address of your WinGate server)

An editable file, index.htm is served from the WinGate install directory. Four links are available:

  1. Service Logs
  2. User Audits
  3. WinGate Info page
  4. GateKeeper.exe

Selecting either of the first two will take you to the logs or audit directories. The third opens the WinGateInfo.htm which is also available under the WinGate entry, on the start menu in Windows.

The fourth allows you to download GateKeeper if it is required on a workstation. It is advisable to limit access to this server to Administrators (or else users may download GateKeeper and attempt to modify settings).


POP3 Proxy server

A POP3 Proxy server may be required if you want to be able to check a remote mail account.

POP3 Proxy server

Close | Close all images

The proxy is configurable to connect to different ports, with 110 as the default. In the POP3 proxy properties, a delimiter can be specified. This is usually the # symbol. The delimiter is used by WinGate as shown below.

To use the POP3 Proxy:

In your email client program on the client workstation, change the setting for your POP3 server to the LAN IP address of the WinGate server, and change your POP3 username to the following:

POP3 username + delimiter + POP3 server.

e.g.

Email username is marybob, and the mail server is mail.qbik.com.

Using Netscape, MS Mail, or Pegasus mail, the user name in the email program should be changed to marybob#mail.qbik.com, and the mail servers (SMTP and POP3) to IP address of the WinGate server.

Username: Marybob#mail.qbik.com

POP3 : 192.168.6.1

SMTP : 192.168.6.1

Note:

Marybob#mail.qbik.com@wingate will be used as the default return address unless you specify the correct one.

ENSURE that your return address is your actual email address.

Note:

If you are using WinGate Mail server, the POP3 server (found on the System tab of the GateKeeper Control Panel) provides proxy capability.

If you are using the WinGate Mail Server, then connections to Port 110 for local mail will be redirected by the proxy to POP3 server of Port 8110 so long as the Handover to Internal Mail Server radio button is selected on the Server Requests configuration of the POP3 Proxy service.

POP3 Proxy - Server Requests configuration

Close | Close all images


RTSP Proxy server

RTSP Streaming Media Proxy

RTSP (Real Time Streaming Protocol) is used to transfer data with real-time properties, like audio and video data. RealPlayer and Quicktime can be configured to use the RTSP proxy.

RTSP Proxy server

Close

The RTSP proxy manages the data transfer across the UDP sockets better than the NAT. The NAT tends to use a TCP connection to stream all data. In the case of real time data this means that more data than necessary is being transmitted.

The proxy manages the UDP connections better simply because it has a better understanding of the RTSP protocol and provides better performance as a result.

Configuring RealPlayer on client machines:

  1. Go to View->Preferences->Proxy.
  2. Check the box Use RTSP Proxy and add the address of the WinGate server (in this example it’s 192.168.0.4) and the port number that the RTSP Proxy service is listening on. In general this will be 554. If unsure ask your network administrator.

RealAudio and RealPlayer are registered trademarks of RealNetworks, Inc.

Configuring QuickTime on client machines:

  1. Go to Edit->Preferences->QuickTime Preferences and from the list box choose Streaming Proxy.
  2. Input the address of the WinGate server (in this example it’s 192.168.0.4) and the port number that the RTSP Proxy Service is running on. The default is 554.

QuickTime is a trademark of Apple Computer, Inc., registered in the U.S. and other countries.


SOCKS Proxy server

The SOCKS Proxy server in WinGate provides SOCKS and AutoSOCKS client connectivity for WinGate clients on the LAN.

Socks Proxy server

Close

SOCKS is an Internet standard for basic connectivity through a firewall.

Many Internet products that have the capability to connect through a firewall, support the SOCKS standard. These include applications such as most WWW browsers, some FTP client applications, some IRC applications etc. Client software supporting this standard can generally operate transparently, meaning they appear to be directly connected to the Internet.

In addition there is software available to SOCKSify applications automatically, so that even if the client software does not itself support SOCKS, then all its connectivity requirements can still be satisfied using the SOCKS protocol. This type of software is known as an AutoSOCKS client, and there are a number of different vendors that provide such software.

For users with an AutoSOCKS client, the SOCKS proxy gives you all the proxy access without the need for any other WinGate proxies. You may still choose to run the other WinGate services if you have servers such as Mail, FTP or WWW or if you require logging.

The port number for a SOCKS server is normally 1080.

Versions

There are currently two versions of the SOCKS standard in common use on the Internet. These are SOCKS version 4, and 5. SOCKS 5 adds some important functionality over SOCKS 4, which includes support for SOCKS client authentication, and also support for UDP.

WinGate SOCKS server supports both SOCKS4 and SOCKS5.


Adding a SOCKS Proxy Server

To add a SOCKS 5 proxy server:

  1. Open GateKeeper.
  2. Select the Services tab on the GateKeeper Control Panel.

  3. Right click anywhere on the Services tab and select New service - SOCKS Service

    New service - SOCKS Service

    Close | Close all images

  4. You will be presented with a new SOCKS Proxy Server configuration.

    SOCKS Proxy Server

    Close | Close all images

  5. Type in a name and description for the service, or use the default.
  6. Type in the port to use, or accept the default.

Note:

All services must have distinct names.

You can choose to accept the defaults for the SOCKS Advanced options, or configure them yourself.


SOCKS Advanced

The SOCKS Proxy server has a unique configuration called SOCKS Advanced

Socks Advanced configuration

Close

SOCKS Requests

checkbox Perform reverse name lookups for IP requests

Selecting this option will cause WinGate to convert IP numbers used in requests to Domain names. This option improves cache usage as if that name exists in the cache then it can be used directly rather than reloaded.

checkbox Use RFC1929(Cleartext) authentication for SOCKS5

  • Some SOCKS5 clients can use RFC1929 (an Internet standard) authentication. This uses a username and password transmitted as clear text. When a user connects to WinGate, WinGate evaluates the client’s current level of authentication (Unknown, Assumed or Authenticated), depending on what it already knows about the client.
  • If the user is unknown, and you have the option "Use RFC1929…." enabled, then WinGate will require the user to use this method to raise it’s security level to Assumed. Otherwise, the client will not be required to use this method. There is a special case here.
  • If a user is assumed to be someone that has no rights to use the SOCKS server, then WinGate will still allow the user to authenticate (using RFC1929). Provided that the user then authenticates as someone with rights to use the SOCKS server, then they will be granted access.
  • RFC1929 is not very secure, and we recommend that you do not use this method if you are authenticating across an untrusted network, such as the Internet. Because this method is not secure, a user that has used this method will raise their security level only to assumed, not authenticated.

Client software that uses SOCKS4, requires DNS to be available on your LAN. You can have the WinGate DHCP service configure this for your clients automatically. For SOCKS5, you probably will not require DNS on your LAN. SOCKS5 is supported by a number of products; WWW Browsers and other specific client applications often use SOCKS4.

In WinGate, the SOCKS Server is able to recognize, and hand over HTTP requests to the WWW Proxy to allow caching, and HTTP-specific policies.


Telnet Proxy server

Since Telnet is inherently a command-line based service, there is no special set up for the telnet client to use the Telnet Proxy server in WinGate. To use it however you must always first telnet to the WinGate server on the port you set up for the telnet service. The standard port for telnet is 23.

Telnet Proxy Server

Close

checkbox Use login where required by policies

If you select this option and are not already authenticated or assumed you will be asked to login to telnet:

checkbox Run as Command Shell

Allows the administrator to access some features of WinGate via a Telnet command shell interface. Check the box to enable this feature – however, for security reasons, we recommend that only advanced users may want to check this option.

It is also recommended that you also add a new telnet service called WinGate Telnet Command Shell and use a different port such as 8023. Do not bind this service to external adaptors.

Click here to read more about the telnet command shell

Using Telnet Administration in WinGate :

  1. Open a command prompt from Windows (Dos Window).
  2. Type Telnet.exe
  3. Type Open and enter the IP address of the WinGate server, or localhost if you are at the WinGate server, and connect on Port 23 (or whatever port the Telnet Proxy Service has been configured for). Then you can use the services of the Telnet Proxy command shell.

  • Login:

    Type your WinGate user name and hit the Enter key. You will then be prompted for your password:

  • Password:

    Enter your password and hit the Enter key.

    Once you have completed logging into telnet proxy you will be presented with the prompt you have specified, for example:

  • WinGate>

    At this prompt, type in the name of the host you wish to connect (it is optional to specify a port number). For example:

    WinGate>ftp.freddy-anne.com

    or

    WinGate>ftp.billy-sue.com 1023

    WinGate will display ‘Connecting to …’. When the ‘Connected’ message comes back, you are connected through to the remote computer.

    There have been a few changes with the WinGate telnet proxy, which affect telnet clients that issue telnet commands (e.g. EWAN, simpterm, and UNIX clients). You may get a double-echo while you are typing in the hostname you want to connect to. Once you are connected however, things should be alright again.

    Some clients may also have problems with hitting the Enter key. Try Ctrl-J or Ctrl-Enter. If that fails, try running the telnet service on a different port number. This sometimes tricks telnet clients into thinking they are not talking to a telnet server, and so they don’t send the telnet commands that may confuse WinGate.

Note:

The Telnet Proxy server in WinGate has only one primary function - to connect you to a real telnet server.

You cannot do any other functions usually associated with telnet. If you are always telnetting to the same host, you should use a mapped link instead - this will bypass having to type the host name in each time, and will allow full telnet option negotiation.

Please Note:

The Telnet command Window is available only to Pro and upwards all versions

©2009 Qbik New Zealand Limited


WinGate Telnet Command Shell

The WinGate Telnet command shell is a feature that can be used to administer WinGate.

To enable the shell:

  1. Open GateKeeper
  2. Open the Telnet Proxy on the Services tab in the GateKeeper Control Panel.

  3. Select the General configuration, ensure that Run as Command Shell has been selected.

    Telnet Proxy - General configuration

    Close | Close all images

  4. Open a command prompt from Windows (Dos Window).
  5. Type Telnet.exe
  6. Type Open and enter the IP address of the WinGate server, or localhost if you are at the WinGate server, and connect on Port 23 (or whatever port the Telnet Proxy Service has been configured for). Then you can use the services of the Telnet Proxy command shell.

Syntax of commands available

Command

Function

List

Lists the objects in current location, and their status

Locate

Returns current location

Locate

Returns current location

help (Object)

Returns general help

cd Object

Changes location to Object,"cd.." to go down

Quit or Exit

Exits the shell

Echo (on/off)

Switches on or off the echo (default off)

stop (Service)

stops the Service (type the service name exactly as it appears in list)

Start (Service)

Starts the service

enable (User)

Enables the user

disable (User)

Disables the user

trash (User)

Trashes/Removes all sessions associated with the user

Prompt

Turns the location prompt on or off (default off)

Example: Disabling a user.

Close | Close all images

After connecting:

  1. Type list (You may not see what you are typing, in this case type echo on). You should see a list including User Database (UDB) and Services (SVC).
  2. Type cd UDB. You are now in the user database: section.
  3. Beside the user database: command prompt, type list to see a list of users and their current status.
  4. Select a user to disable from the displayed list (in this example we have chosen the user called Betty) and type disable betty.


Adding a Telnet Proxy

Telnet Proxy generally uses port 23.

Adding a Telnet Proxy is fairly simple, and it will attempt to use port 23(TCP) by default to listen for client requests.

If you are adding a second Telnet proxy or have a Telnet server installed on the same machine as WinGate, then you will need to change the service port of the new Telnet Proxy to something other then port 23, since this port will already be in use.

To add a Telnet Proxy:

  1. Open GateKeeper.
  2. Select the Services tab on the GateKeeper Control Panel.

  3. Right click anywhere on the Services tab and select New Service - Telnet Proxy Service.

    New Service - Telnet Proxy service

    Close | Close all images

  4. On the General configuration of the new Telnet Proxy server properties, select the Service port window and enter the number of the port that users will connect to this service on. This is usually 23 unless you have a Telnet server already running on that port. In that case you will need another unused port to use.

  5. Click OK.

    Telnet Proxy Server

    Close | Close all images

See also:

Telnet Proxy


WWW Proxy server

The WWW Proxy service provides access to the Internet for clients that use the HTTP protocol.

This includes mainly browsers, but some other applications use HTTP as well (such as RealPlayer and the VIVO player software).

WWW Proxy Server

Close

WWW Proxy server guidelines:

  • WinGate’s WWW proxy supports HTTP, Secure HTTPS and FTP
  • The usual WWW proxy port is 80. This is configurable.
  • Web Servers also usually run on port 80.
  • The proxy supports cascading through upstream proxy and SOCKS servers
  • The WWW proxy supports Server(non-proxy) request handling through it's Web Server configuration
  • Users with a Java-capable browser can authenticate with WinGate using the Java client.
  • Users with an NTLM authentication supported browser can authenticate via NTLM.
  • Multiple WWW proxy services can be configured on different ports, but of course they must be uniquely named.

Authentication where required by policies

Select which method of authentication will be used to implement access security policies on the WWW Proxy server.

There are three choices:

  1. Plain

    The least secure authentication available. Clients with browsers that support basic authentication can use this method, regardless of whether WinGate is using its own user database or the Operating system/Remote database. If WinGate is using Operating system/Remote user database we suggest using NTLM option, as this is far more secure.

  2. Java Authentication

    Available for Java compatible browsers, users login using Java applet to authenticate. (Click here to read about Java Authentication)

  3. NTLM

    Allows clients to be authenticated via the NTLM authentication method used by Windows NT Operating systems. (Click here to read about NTLM Authentication )

    Note:

    Please note that NTLM Authentication will only appear if the Operating system(Windows) Database option is being used in WinGate.

Caching

The WinGate WWW Proxy provides HTTP caching. HTTP Caching is the process of storing recently accessed graphics, HTML documents, Java applets or any other Internet files on the WinGate server, to facilitate their speedy retrieval for the next time that they are requested from any computer on the network.

WinGate will only cache HTTP requests that use the "GET" method. WinGate will not cache FTP requests, any request that contains a query string (e.g. the response to any form submission), or any web page that requires authentication. In addition to this, you can also specify specific rules for what WinGate will cache.

Click here for more on WinGate Cache management

Https

The WWW Proxy will support SSL connections on any port automatically by default. For more security you can specify what ports the WWW Proxy will accept for SSL connections in the Https configuration.

Site retry order

If the requested URL does not exist, the WWW proxy will now attempt to connect to URLs based around that name. This allows one to simply type ‘microsoft’ to get to microsoft.com or ‘cnn’ to get to www.cnn.com. This order is configurable in the registry and will search sites in the following manner:

http://site/

http://site.com/

http://www.site.com/

etc…

To add site searches see the Advanced WinGate configuration/troubleshooting section


Web Server configuration

Web Server

The Web Server configuration in the WWW Proxy server in WinGate, replaces the Server requests configuration for the WWW Proxy Service in previous versions.

Web Server configuration

Close | Close all images

The Web Server configuration gives the WinGate WWW Proxy the ability to handle Server requests (non-proxy requests) based on the host tag portion provided in the HTTP request received from a Internet browser.

Whenever a Internet browser makes a HTTP request to access an Internet resource, there is always a tag present in these HTTP requests called the Host tag. This tag is used by the browser to indicate to the Web server, which site or host the browser wants the server to return resources from. (e.g. www.wingate.com).

The Host tag is commonly used by web servers hosting multiple websites to serve multiple web sites from a single IP address, allowing clients to specify the site they want using the Host tag. (e.g. www.wingate.com and www.netpatrol.com are hosted from the one Web server)

This allows the WinGate WWW Proxy server to determine what to do with any Server requests it may receive when the Host tags in the Server request match those that have been defined in the Web Server configuration. This configuration now allows for multiple host tag handling to be defined.

Note:

The Web Server configuration deals specifically with Server type HTTP requests. It does not refer to WinGate clients on the network behind WinGate who have their browsers configured to use the WWW Proxy, and make proxy requests to WinGate when trying to access the Internet.

The Web Server configuration is designed to handle Server requests (i.e. HTTP requests that are made by a client browser in the format where it is requests the resource directly from the Web server instead of a proxy request).

To define how a host tag in Server requests will be handled by the WWW Proxy server :

  1. Open GateKeeper
  2. Select the WWW Proxy server from the Services tab of the GateKeeper Control Panel.

  3. Select the Web Server screen.

    Web Server configuration

    Close | Close all images

  4. Click the Add button to add bring up the Edit site dialog to add a new host tag.

    Close | Close all images

  5. Select the Host tab and enter the desired host tag (e.g. www.wingate.com).

  6. Select the General tab and from the drop down menu select the way WinGate will deal with the request that matches the defined host tag.

    Close | Close all images

  7. Click OK. The new site should now be listed in Web Server configuration screen in the WWW Proxy server.

Click here to read about the Actions available in the Edit Site dialog

©2008 Qbik New Zealand Ltd


Web Server configuration - Edit Site

The Edit Site dialog in the Web Server configuration of the WWW Proxy Service allows you to define how WinGate will handle the host header tags in any Server HTTP requests (Server requests) the WWW Proxy may receive.

Close | Close all images

It consists of two tabs:

  1. General tab

    Edit Site - General tab

    Close | Close all images

    Action

    Select from the drop down menu an action that WinGate will take when the Server request contains a matching host tag listed in the Edit Site dialog.

    The options for responding to the Server request (Server request) matching the Host header tag are:

    • Reject the request

      This is the default option. Selecting this option means that when a browser makes a Server request to WinGate, which matches the host header tags associated with the site, it will be rejected with a message that it made a "malformed request".

    • Reverse-Proxy request

      Edit Site - Reverse Proxy request

      Close | Close all images

      This option is most commonly used if you have another web server on your LAN that is serving web pages to clients on the Internet, but for security reasons you wish it to be behind a firewall (such as WinGate).

      If you choose this option, when WinGate receives a Server request with a host tag matching one for this entry, it will connect to the specified server and port, modify the request if specified (i.e. prepend info to the URL, and/or change the Host tag in the request) then send the request, and send the response back through to the client.

      checkbox Cache requests

      Selecting the Cache requests option allows WinGate to cache similar Server requests for Internet clients, rather then constantly connecting the to the specified server for the resources every time it receives the same Server request.

      checkbox Prepend resource with

      Allows WinGate to add extra information (if required) to the request before connecting through to the server.

      checkbox Change Host: tag to

      Allows WinGate to change the Host: tag in the request before connecting through to the server.

    • Redirect the request

      Edit Site - Redirect

      Close | Close all images

      Selecting this option, the browser will be sent a redirect response with either a 301 HTTP code or 302, depending on whether you have selected Permanent redirect. Different browsers honour this code differently, but it is an indication to the browser as to whether it should make a subsequent request for that resource back to this server, or directly to the one indicated by the redirection.(The URL field)

    • Serve the request

      Edit Site - Serve Request

      Close | Close all images

      • Server root directory

        This is the root directory on the local disk where all Internet resources will be retrieved from (typically called wwwroot). Any sub-directories specified in a URL are appended to this pathname to locate resources.

      • Default filename

        The default filename is the html page that will be served when no page is specified by the URL. Typically no page is specified when a user first connects to a given URL and so this is normally the home page filename.

      • CGI Directory

        The directory on the local drive where the CGI script programs are stored (usually this will be a sub-directory of the www root directory).

      • CGI URL Prefix

        The name of the directory where the CGI scripts reside on the local disk. No CGI script will execute unless it exists in the root of this directory (note that it cannot be in a sub-directory either)

      • CGI timeout

        This is how long WinGate will allow a CGI executable to respond/execute before it is considered to have timed out. In previous versions of WinGate this had been a fixed value of 120 seconds. This option now allows you to set a longer period for scripts to execute if required.

      When set to serve a request, WinGate will act as a Web Server itself, and serve resources from the local hard disk. For each site you define, you can specify different server root folders, default filenames, whether or not directory browsing is permitted, or CGI (which includes applications like Perl or PHP).

      Click here to read about serving Web pages

  2. Hosts tab

    Edit Site - Host tab

    Close | Close all images

    The Hosts tab on the Edit Site dialog allows you to specify the Host header tags that WinGate will check for in Server requests (Server requests)

    Click the Add button to add a Host header. Once you have added a Host header it will be listed in the Web Server configuration screen in the WWW Proxy Service.

©2008 Qbik New Zealand Ltd


Serving Web pages

WinGate lets you configure the WWW Proxy Service to act like a web server to any incoming Server requests. This means that when it receives a Server request it will attempt to "serve" a resource (normally an html page) to the client.

With WinGate 6.0 and all later versions, is the ability to serve a wider range of Web requests such as php pages.

To configure WinGate to serve web pages:

  1. Open GateKeeper.
  2. Select the WWW Proxy server from the Services tab on the GateKeeper Control panel.

  3. Select the Web Server configuration.

    Web server configuration

    Close | Close all images

  4. Select the Add button, to bring up the Edit Site dialog.

  5. On the General tab select Serve Request from the Action drop down menu.

    Edit Site - General tab

    Close | Close all images

  6. Fill in the required fields for the Server root directory, Default filename etc.

  7. On the Host tab click the Add button to add a suitable Host tag(s) for the site.

    Close | Close all images

  8. Click OK to confirm changes in the Edit site dialog.
  9. On the Web Server configuration in the WWW Proxy server, click the Settings button to define the Web Server settings (as explained below)

The Web Server settings consist of two tabs:

  1. File Associations

    File Associations tab

    Close | Close all images

    This is where the executable that will be used to open specific file extensions used can be set if required.

    Note:

    When adding an executable extension do not include a period (".") in front of the extension. Just enter the actual extension only.

  2. Environment Variables

    Environment Variables tab

    Close | Close all images

    This is where environment variables can be set specifically for the executables listed on the File associations tab.

Note:

CGI (Common Gateway Interface) is an Internet standard for small programs (called scripts) that reside and run on the web server. Web pages often contain forms – the fields that you type in and the combo boxes that you select things from.

When the user clicks the button to submit the information entered on the form, the web server will execute the specified script and pass the information to it for processing. Most often the job of the script will be to enter that information in a database, or generate a new html page based on the user information entered.

It is important to note that where a script is generating a new HTML page, it must generate the entire page including all header information (NPH only – Non-Parsed Headers). Some web servers will generate the header information for you before serving the page, but this WinGate implementation will not.


Https configuration

The Https configuration found in the WWW Proxy server properties allows you to specify which ports may be used in SSL connections. The Allow ANY port to be connected (non-secure connect) box is checked by default which allows SSL connections to use any port. If you wish to only allow SSL connections to be made using a particular port then you should uncheck this setting and enter the desired port you require clients to use.

Close

Type a port number that you’d like be connected, then click Add port.

To remove a particular port from the list of those you’d like used in SSL connections, simply highlight the port and click Remove port.


Adding a WWW Proxy server

Adding a WWW Proxy server in WinGate is fairly simple. The service uses port 80(TCP) by default.

If you are adding a second WWW Proxy server, or running a web server on the WinGate machine, then you will need to change the Service port of the new proxy to something other then port 80 to avoid port conflicts (as the other WWW proxy or web server will be using this port).

To add a WinGate WWW proxy server:

  1. Open GateKeeper.
  2. Select the Services tab on the GateKeeper Control Panel.

  3. Right click anywhere in the Services tab and select New Service - WWW Proxy Service.

    New WWW Proxy server

    Close | Close all images

  4. You will be presented with a new WWW Proxy service configuration.

    WWW Proxy Server

    Close | Close all images

  5. Type in a name and description for the service, or use the default.
  6. Type in the port to use, or accept the default.
  7. Click OK.

The service is now added. Remember to ensure that clients connect on the correct Service port to reach the new WWW proxy.

Note:

All services must have distinct names.

You can choose to accept the defaults for the advanced options, or configure them yourself.

See also:

WWW Proxy


VDOLive Proxy server

WinGate users can enjoy live Video with the VDOLive proxy server. This proxy works for all versions of the VDOLive player 3.22 and later.

Note:

This is an older standard for live video than using the RTSP Proxy, which we recommend for most users instead of the RTSP Proxy.

To add a VDOLive proxy:

  1. Open GateKeeper
  2. Select the Services tab on the GateKeeper Control Panel

  3. Right click anywhere on the Services tab and select New Service - VDOLive Proxy Service

    New Service - VDOLive proxy

    Close | Close all images

  4. On the new VDOLive proxy server configuration select the General screen.

    VDOLive - General configuration

    Close | Close all images

  5. Type a Service Name and Description, or accept the defaults.
  6. Under the Startup options, select Service Port, and type in the port number. This is usually 7000.
  7. Click OK.

To run a VDOLive server and proxy on your network:

  1. Click on the VDOLive Server Requests configuration.

    VDOLive - Server Requests configuration

    Close | Close all images

  2. Select the Pipe request through to predetermined server radio button.
  3. Enter the address and port number of the computer that your VDOLive server is running on.


XDMA Proxy server

WinGate includes a XDMA proxy to allow full access to the Internet.

Please note that Streamworks is no longer supported by Xing Technology Corporation.

We recommend using the default port 8000 for this proxy. This needs to be configured in Streamworks itself.

To add an XDMA Proxy with WinGate:

  1. Open GateKeeper.
  2. Select the Services tab in the GateKeeper Control Panel.

  3. Right click anywhere in the Services tab and select New Service / XDMA Proxy

    Add new XMDA service

    Close

  4. On the general screen of the new XMDA proxy server, click OK to accept the defaults or change the port number and click OK.

To use the XDMA Proxy in Streamworks:

  1. In the Streamworks player on the client machine select Settings/Network...
  2. Select the Use Application firewall checkbox.

  3. Enter these settings:

    • Proxy Host: 192.168.0.1(The LAN IP address used by WinGate)
    • Proxy Port: 8000
  4. Click OK

Note:

These settings are stored in the swplayer.ini file in the Streamworks directory.


Mapping links overview

Mapped links overview

Mapped links provide the ability for you to create a direct TCP or UDP mapping to a remote computer via the WinGate machine on specified port.

Creating a TCP/UDP mapping in WinGate means that whenever a client workstation makes a request to WinGate on the particular port of the mapping, WinGate will patch the connection directly to a predetermined remote server/location.

This means that a client computer on the local network can simply enter the IP address of the WinGate machine and the specific port in their browser or application (rather then the address of the remote server) and WinGate will in turn send the request to the predetermined remote server or machine on their behalf (As shown in the example below).

If transparent proxy (intercepts) are enabled on the mapped link, whenever a client on the LAN attempts to access the Internet on that port through WinGate, they will be subject to the mappings that have been set.

So if a client uses an application or browses to any location (not just the WinGate server as mentioned above) on a specific port that has been set in the mapped link, then they to will be redirected to wherever the mapping for that port has been set to rather then their intended destination. If no mapping location has been set then WinGate will connect them to their requested destination as usual.

Mapping proxies are not as flexible as the other proxy services are. This is because they are a simple pipe-through of the data. For this reason, you generally need to specify in the mapping a remote host for WinGate to connect to when it receives a request on that particular port. Mapped links are perhaps the simplest level of implementing a gateway. A mapped link is like a patch cord or pipe. You are effectively patching computers through to remote computers on specified ports.

It is important to remember that mapped links are usable on any TCP/IP network, be it the Internet, a Company WAN or a home/office LAN.

Mapped link example:

Using an Internet News Reader Mapped Link.

News servers/applications usually use port 119. You could create a mapped link in WinGate that directs all traffic to a particular news site by default. (e.g examplenews.com) whenever it receives a request from a client on port 119.

When you want your news program to get your daily newsgroups, you ask it to connect to the IP address of the WinGate server, not the url http://examplenews.com, because WinGate has now become a connection to your news server (examplenews.com).

If you access the port for news, you will be communicating with the news server via WinGate. The News program doesn’t know or need to know this, all it cares about is that WinGate appears to be a news server. WinGate does not even know what protocol is running over the link, only the client and server need to know this. As a result their browser/application will open up the examplenews.com site since that is the default mapping WinGate will use.

Common uses for mapped links

  • Setting up an easy redirection to company Internet/File servers. Users can simply connect to the WinGate IP address on a certain port and be redirected automatically to a particular server, without having to remember the specific server address etc.
  • Implementing control of which gateway/Internet connection should be used when users make requests to WinGate on the certain mapping port.
  • Providing encrypted WinGate to WinGate links.
  • Control over use of application ports used by users (When transparent proxy is enabled on the mapped link).

Specific mappings

The port used for a mapped link may need to be used in different ways by different people. For example, while the port 119 might be used as a mapping to a particular news server, some users may wish to use the same port to map to a different news server.

In this case instead of creating a separate mapped link for each different server (each requiring a different port), you can create a TCP mapping set to a common news port and then use the specific mappings option available inside the Mapping configuration to configure where WinGate will map the connection to based on the user, or location the user is making the request from.

Then this allows individuals to connect to WinGate on the same 119 news port but be redirected to their particular news server.

Click here to read about specific mappings

Mapped link activity

WinGate TCP Mapped links monitor data passing through them and will display details for the session data that forms the link. TCP mapped links will often be displayed from the following sessions in the Activity tab in GateKeeper:

  • SMTP - Sending email
  • POP3 - Retrieving email
  • NNTP - Reading Internet news groups
  • HTTP - Viewing web sites
  • FTP - Accessing an FTP server
  • TELNET - Connecting to a Telnet server

Any of these protocols that are used via a TCP mapped link will show some details in GateKeeper (obviously with the exception of any password related commands which will never be displayed). Extra details will be displayed for HTTP, POP3 and SMTP.

Timeouts

For TCP based services (i.e. anything except DNS, XDMA, and UDP Mappings) the session timeouts are really only there as a safeguard against problems. In the normal operation of a session, it will terminate when the session has completed. However, sometimes connections can be left open when nothing is happening, and so the timeouts are there to terminate those sessions so that they don't do things like holding the modem up.

For UDP-based (UDP Mappings, DNS etc) sessions however, the timeout is the ONLY way a session will ever terminate, since there is no connect and close for a UDP socket there will be no indication when a session is completed.

The mapped link properties

You create a mapped link in WinGate from the Services tab in the GateKeeper control panel. You can use the mapped link configuration to set the all of the correct details for the link.

TCP Mapping properties

Click here to read about adding a mapped link

Advanced mapping features

WinGate also allows you to create mapped links between WinGate servers in remote locations via an encrypted link. This means that clients can be connected via a mapping on one WinGate server can be mapped via an encrypted link to a remote WinGate server.

Click here to read about Advanced mapping features


Adding a mapped link

To add a mapped link in WinGate:

  1. Open GateKeeper.
  2. Select the Services tab on the GateKeeper Control Panel.

  3. Right click anywhere on the Services tab and select New Service - TCP (or UDP) Mapping Service.

    Adding a new TCP Mapping

    Close | Close all images

  4. On the new Mapping service properties, choose the General configuration and select the Service port.

    TCP Mapping properties

    Close | Close all images

  5. Enter the port number that clients will use to make the request to WinGate on.
  6. Select Enable default mapping to check box.
  7. Enter the name of the remote computer in the Server field (e.g. news.iprolink.co.nz).
  8. Enter the port that the connection to the remote computer will be made on by WinGate in the on port field.
  9. Click OK.

Common mappings

Here are some typical mappings and what they are used for.

Service | Port | What to do
Internet/Usenet News | 119 | Set up a TCP Mapped link on port 119, mapped to your news server on the same port
IRC Chat | 6667 | Set up a TCP Mapped link on port 6667, mapped to your IRC server on the same port.

See also:

Adding specific mappings


Adding specific mappings

Whenever you create a TCP or UDP mapped link, there is an option of having a default mapping for the mapped link. This means that any computer on your network that connects to that port number will be put through to the computer name you specified. Sometimes this is not desirable. One person may want to connect to a different server on that particular port.

You can set up specific mappings within TCP or UDP mapped link based on IP addresses, Users or Dialer Profiles, of the computer which makes the request to WinGate.

Mapping by IP address

Example

Jon uses the computer with the IP address 192.168.6.90

A mapped link has been created in WinGate for the news on port 119.

Close | Close all images

Its default mapping is to examplenews.com, however Jon prefer to use news.second.com instead of the default.

To change his mapping:

  1. Open GateKeeper.
  2. Select the News mapping service in the GateKeeper Control Panel.

  3. Select the Mappings configuration icon the left hand side, then click the Add button the right hand side.

    Close | Close all images

  4. In the new Mapping Properties configuration that appears, enter the DNS name of the server in the Server field you wish to map to (news.somewhere.com in our example)

    Close | Close all images

  5. Enter the port number that WinGate will connect to the News server on in the on port window (in this example this will be 119 also).
  6. Select the Location tab and specify 192.168.6.90

    Close | Close all images

  7. Click OK.

Mapping by User name

Example

Betty uses news.somewhere.com instead of the default news server.

Follow these steps to change her mapping:

  1. Open GateKeeper.
  2. Double click the chosen News server mapped link in the Services tab.
  3. Select the Mappings configuration icon the left hand side then click the Add button on the right.
  4. In the Mapping properties configuration that appears, select the Mapping tab and type in the Server box the server to map to (news.second.com in this example)

    Close | Close all images

  5. Enter the port number that WinGate will connect to the News server on in the on port window (in this example this will be 119 also)
  6. Click on the User tab and select the Specify user or Group radio button and select the user Betty.

    Close | Close all images

  7. Click OK.

Mapping by Dialer profile

If you have two dialer profiles, using two different ISPs, you may well need to configure different News servers to be used depending on which profile is online.

To do this:

  1. Open GateKeeper.
  2. Double click the chosen News Server Mapped link in the Services tab.
  3. The Default Mapping should be to the News server of the first ISP.
  4. Click on Mappings configuration on the left then click the Add button on the right.
  5. In the new Mapping configuration that appears tick the Dialer Dependant option and select the second ISPs profile.
  6. Type in the Server name for the news server of the second ISP.
  7. Type the port used to connect, this will be 5645 for News.
  8. Click OK.

Show Example

Mapping by Dialer profile

Close | Close all images

All of these specific mapping examples will now be listed in the Mapping window of the News mapped link in GateKeeper.

Close | Close all images


Mapped links - Advanced features

While mapped links are somewhat limited compared to other proxies, they do offer several advanced features:

  • Mappings can be based on individual user needs. Configurations can differ per user, location or dialer profile. Click here to read about specific mappings.
  • The TCP mappings have the option of encryption. Encryption is the process of making data secure by making it extremely difficult for anyone but the intended user to understand.
  • With the transparent proxy (intercepts) feature in WinGate, a TCP mapping can now intercept any request made through WinGate on the port it is set to use regardless of connection method the client is using (e.g. NAT or WGIC)

The Encryption configuration

WinGate can use encryption in the mapped links to make a secure data channel for WinGate-to-WinGate mapped links.

This makes it extremely useful when clients behind WinGate wish to access an HTTP/FTP intranet/file server located on a remote network located behind a WinGate server over a secure connection.

It works by creating a mapping on one WinGate server that links to a WinGate server in another location. This remote WinGate server also has a mapping set so that when it receives the communication link from the first WinGate server it will map this data on to the fileserver/webserver etc on the LAN behind.

These mappings configured on each of the WinGate servers can be set to be encrypted to provide a secure connection across the Internet.

So the client on the LAN only needs to connect to the local WinGate server on tha specified port, and they will be able to have secure encrypted communication across the Internet to the file server behind the WinGate server in the remote location. (As shown in Example 1 below)

WinGate to WinGate encryption only works with mapped links. This can provide access for telnet, HTTP, email and others. Using encrypted mapping proxies, a company can provide secure access to their file server, and mail, and terminal programs.

Encrypting a mapped link:

  1. Add a TCP mapped link, use a suitable name
  2. Select a port that clients will make the requests on. It is usually safe to use port numbers above 10000.

  3. Select the Encryption configuration.

    TCP Mapping - Encryption configuration

    Close

  4. Select the either Connections to WinGate or Connections Out of WinGate encryption option.
  5. Enter details according to your needs.

Note:

When using the encryption configuration in your mapped link, you are given two options :

  1. Connections to WinGate

    This setting is used to prepare WinGate to accept encrypted communication from another WinGate server. The Username and Password should be valid credentials from the user database used by this WinGate server.

  2. Connections Out of WinGate

    This setting is used to provide the correct details for this WinGate Server to map to another remote WinGate server. The Username and Password should be valid credentials from the user database used by the remote WinGate server.

Example 1:

Secure access to files servers

A company has two offices, one in Auckland (New Zealand) and another in Melbourne (Australia). Users in Auckland want to be able to access the files on the Melbourne file server across the Internet securely.

Steps to take in Auckland (New Zealand) :

  1. Create an encrypted mapped link on port 3080 which maps through to the Melbourne WinGate on port 3080.
  2. Select the Encryption configuration in the mapping you have created, and tick the Connections out of WinGate - Encrypt connections made by this service check box.(Specify the same username and password in the user database selected to be used by the Melbourne WinGate (as in Step 3 below).
  3. Now to browse and retrieve and upload files, a user simply uses a WWW Browser and types in the URL http://(WinGate IP adddress:3080)

Steps to take in Melbourne (Australia) :

  1. Run an HTTP server on the file server on the Melbourne LAN.
  2. Create a mapped link in the Melbourne WinGate server, for example on port 3080 which maps through to the HTTP server on the LAN.
  3. Select the Encryption configuration in the mapping you have created and tick the Connections to WinGate - Connections to this service must be encrypted check box. (Specify a valid user in the user database used by the WinGate server).

The clients browser will then connect to the WinGate in Auckland, which is mapped to make an encrypted connection to the WinGate in Melbourne. The Melbourne WinGate server will inturn map the connection through to the HTTP server. Using directory browsing on the HTTP server, the browsing client user in Auckland can easily browse files, and download them.

If your HTTP server supports the PUT method, you can even upload files to the server, giving you basically full access throughout the browser.

Example 2 :

Secure Unix access

A company has a Unix server on which they run their order-entry system. They want to provide secure access to this system over the Internet so that their staff in remote offices (or even from home) can work on the server securely.

Step: Main office

  1. Set up an encrypted mapped link on say port 3023 which maps through to the Unix telnet server on port 23.

Step: Remote office

  1. Set up an encrypted mapped link on say port 3023 which maps to the to the main office WinGate server on port 3023.

To connect securely to the main office server the users simply telnet to WinGate on port 3023. They will then be presented with the logon prompt of the Unix computer in the main office, but all communications are encrypted.

Transparent proxy

With the transparent proxy option enabled on a mapped link, WinGate will intercept any request it receives on that port regardless of the type of connection method the client is using (NAT or WGIC) and subject it to the conditions of the mapped link.

So when a client makes a request to connect anywhere through WinGate on a certain port, and the transparent proxy is turned on in the Sessions configuration of the mapped link, then the request will be mapped to the destination set on the link (Default or specific mapping). If no destination is set in the mapped link then WinGate will handle the client request as normal and the client will be able to access their requested location.

Click here to read about Transparent proxy


WinGate Mail Server - Introduction

The WinGate Mail Server is a fully functional POP3 and SMTP mail server. The benefits of using the WinGate Mail Server are extensive.

These include:

  • WinGate’s data-scanning plugins (e.g. Kaspersky AntiVirus for WinGate)
  • Email from the client travels at LAN-speed.
  • Integration with the WinGate user database and the WinGate dialer.
  • Host multiple mail domains.

Options for using the WinGate Mail Server

The WinGate Mail Server is extremely versatile, and is able to perform a variety of different functions. There are various options for how you use email.

For example it can be configured to work to/with:

  • WinGate as the main mail server.
  • A different mail server on my LAN.
  • An external mail server for sending and receiving mail.
  • Use ISP for receiving mail.
  • And many more…

Click here for details on the various options for configuring mail

Click here for advanced understanding on How WinGate Mail Works

Please Note:

WinGate Mail is only available only if you are running WinGate with a version 5 or later key.

©2008 Qbik New Zealand Limited


WinGate Mail Server set up options

The WinGate Mail server can be configured to work in a variety of scenarios depending on your situation:

  1. WinGate as your full email server

    • Without hosting a domain

      WinGate will install and run immediately in this mode. Mail Clients use WinGate as their SMTP and POP server.

    • With a domain name

      WinGate will install by default to be your mail Email server. Mail Clients use WinGate as their SMTP and POP server. All you need to do is to add your domain names to the domain section in WinGate, and set your domains MX record to point to the WinGate PCs external IP. If your ISP hosts your DNS details you will need to contact them to make this change

  2. WinGate as a gateway for an internal email server

    In this configuration you have an email server running on a machine on your network, and you want to use WinGate for firewall and antivirus protection.

    e.g.

    WinGate IPs: 202.10.10.2 (external) and 192.168.0.1 (LAN)

    mail server IP: 192.168.0.10

    The mail flow is like this:

    Internet <-> WinGate <-> mail server <-> Clients

    1. Configure WinGate mail so it has Local/Inbound mail server set to point to 192.168.0.10
    2. Add the domains to the domains screen that are considered local.
    3. Configure your mail server to use the internal IP of WinGate (192.168.0.1) as its Gateway.

    This means that the internal mail server will forward all non local email to WinGate for delivery.

  3. Using your ISP as a gateway

    With either of the above options, you may choose to use your ISP's mail server as your outgoing email gateway. This has the advantage that its quicker to send the mail to the ISP than directly to the remote domain. This is most useful if you are on a slow connection to the Internet. Note: You will need to get permission from your ISP to do this.

    Simply configure WinGate’s Remote Delivery to 'Use Gateway' and enter the IP address of your ISP’s email server.

    Mail flow looks like this:

    In: Internet -> WinGate -> clients

    Out: Internet < - ISP < - WinGate < - client

  4. Using WinGate for sending mail only

    If you have POP mail accounts hosted on your ISP, you can still use WinGate to send mail. WinGate will allow this straight from install. WinGate still scans any mail downloaded from the ISP, even though it is not hosting the mail itself.

    In: Internet - > ISP - > clients

    Out: Internet < - WinGate < - clients

    Or you can even use your ISP to send mail as well, with the Gateway set in WinGate mail.

    In: Internet - > ISP clients

    Out: Internet < - ISP < - WinGate < - clients


WinGate Mail Server file and directory structure

WinGate mail uses a simple directory structure to store mail. All information is saved in files to safeguard against losing any mail. Another advantage of storing everything in files is that the administrator can make adjustments to mail as it is being processed. All message (.msg) files are RFC822 compliant, and all routing files (.rcp files) use a simple user-readable format.

Examples:

  1. An important document is accidentally mailed to the wrong person outside the company:

    Solution

    The administrator can look for the mail in the Incoming Directory and simply delete it. If it has already been queued to send to the domain, the administrator can delete the message from the Holding Directory.

  2. An important document is accidentally mailed to the wrong person inside the company:

    Solution

    The administrator simply opens the POP3 Directory for the first user, finds the file, and moves the file to the directory of the correct user.

To stop the sending of all current messages to a domain:

  1. Open the Spool\Domains Directory.
  2. Find the directory with the corresponding name (e.g. all mail to hotmail.com will be in a directory called hotmail.com), and delete it, or drag it to the Dead Directory.

File types

All files are text, you can open and read with any text viewer.

  • .msg files

    These are the actual messages in RFC822 format.

  • .rcp files

    These files contain information about who the mail is to, and who its from.

  • .mri files

    These files are created in each domain directory, and contain information about when a domain was first tried, when it will be tried next, and how many times WinGate has attempted to send mail for this domain.

Directories under WinGate Mail

Directory

Description

POP3\

All directories under this directory are where Local user mail messages are stored e.g. WinGate user ‘bob’ has his mail stored in WinGate\Mail\POP3\Bob. All messages are in RFC822 text files.

Spool\Incoming

Mail messages and .rcp files are stored in this directory as they are received by the SMTP service.

Spool\PostIn

Mail messages and .rcp files are moved here when they have been OK'ed by the preprocessor. Pre-processor functions include data scanning (for viruses and inappropriate material) and loop protection.

Spool\Holding

Messages are stored in this directory till they have been delivered to all intended recipients. Note: One message file may be going to be delivered to several different recipients at several different domains, so it is much more efficient to store a single version of the file. Deleting a .msg file will prevent the email from being sent to any of the remaining intended recipients.

Spool\Domains\"domain.name"

Each domain that has messages waiting to send has an associated directory under the domains directory containing an .rcp file for each pending message. If there are 3 messages to be delivered to hotmail.com, there will be a directory: domains\hotmail.com\ with three .rcp files, each of which contains the recipient list for the corresponding email (.msg file). There will also be a domain.mri file, containing relevant delivery information. Deleting an .mri file will cause the resend schedule to be restarted (i.e. as if the emails had just been sent). Deleting an .rcp file from a domain directory will prevent this message from being delivered to anyone at that domain.

Spool\Sent

If you choose to save a copy of all mail sent, then .msg files will be moved to this directory when delivered, instead of being deleted. This is a very good idea if you are having problems with your mail delivery. Note: There is no size limit for this directory – the administrator is responsible for ensuring that it doesn't get too large for the machine to handle.

Spool\Domains\Dead

This directory will contain any files that have fallen into one of the following categories:

  • Orphaned files:

    If a remote server or your Internet connection fails while you are receiving mail, you may get orphaned files. Files get orphaned if the administrator deletes one part of the message pair. If an .rcp file is found without a corresponding .msg file, then it is an orphan file, and visa versa.

  • Files with an error:

    If you have a system crash while a file is being written, there may be an error processing the file. These are files that are not complete enough for WinGate to be able to use them to deliver a message.

  • Other:

    If the mail system is ever unsure whether email has been successfully sent, then it will be 'backed up' to the dead directory. There is no size limit on this directory, the administrator is responsible for ensuring it doesn’t grow too large.

Mail loop protection

The WinGate Mail Server has loop protection.

A mail loop can occur if a message is repetitively forwarded by mail servers but never reaches a final destination - WinGate stops this happening by limiting the total size of the message headers (the subject, date etc.).

This works because each time a mail server receives an email, it adds a "Received" header, including the date, the time and other information. If there are too many received headers, it generally means a mail loop. WinGate will move the message to the dead directory if it reaches the maximum allowed size.

This size is 8Kb by default, which allows for a generous number of headers.

The max size can be adjusted by changing the WinGate registry value:

WinGate\Settings\Mail REGDWORD:MaxMessageHeaderSize

WinGate will ignore levels below 2048 bytes, to make sure that normal email can always be processed.


POP3 Server

With the introduction of the WinGate Mail Server in versions 5.0 and above, the POP3 Server was introduced to provide the Mail server with full mail receiving capabilities.

The POP3 Server configuration is located on the System tab in the GateKeeper Control Panel.

Close

While there is very little configuration required there are several points worth noting for the POP3 Server configuration:

  • The POP3 Server should only be bound to an external interface if clients from the Internet are collecting their mail from the WinGate mail server. In most situations the WinGate mail server is used to receive mail on behalf of clients on the local LAN, and so will be bound to an internal interface (by default).
  • When the Allow POP3 proxying option is checked in the General configuration (shown above) , then this will allow clients to access the POP3 services of the POP3 proxy service. The POP3 Server is set to listen on port 110 by default and will interoperate with the POP3 Proxy service (as described) which uses port 8110. This allows for both POP3 services for WinGate Mail server clients, and POP3 Proxy request handling for WinGate clients who are retrieving mail from remote locations on the Internet.


SMTP Server

The SMTP Server listed on the System tab of the GateKeeper Control Panel is used to provide the WinGate Mail server with the ability to deliver of mail for clients.

While there is generally very little configuration required for the SMTP Server, as most settings are covered by the WinGate Mail server configuration, there are a few settings that may require checking depending on individual requirements.

Close | Close all images

  • Bindings

    The SMTP Server needs bound to an appropriate internal interface in order to send mail for WinGate clients on the LAN(this is usually done by default). This can be set on the Bindings configuration of the SMTP Server properties.

    SMTP Bindings configuration

    Close | Close all images

    In WinGate Enterprise there is the possibility of using SSL bindings. These should be configured via the Dynamic Binding configuration on the interface that SMTP Server will be bound to.

    Dynamic Bindings Policy

    Close | Close all images

  • Plug-ins

    If data scanning plug-ins are installed and to be used for scanning mail then they should be enabled in the Plug-ins configuration of the SMTP Server.

    Close | Close all images


IMAP4 Server overview

Since WinGate 6.1, the WinGate Mail Server now has an IMAP4 server.

What is IMAP4?

IMAP stands for Internet Message Access Protocol and is a protocol used for the storage and retrieval of messages from a centralised server. IMAP allows a client to access and manage their mail retrieval from the IMAP4 server itself via either an email client program or a Web interface.

Since IMAP4 provides centralised storage of email with folders it allows the end user to access their mail from different locations and still have their mail retrieval operations synchronised regardless of where or how they access the IMAP server. This unlike POP3 where mail is downloaded from the POP3 server mailbox, by an email client program (such as Outlook or Eudora) and user management of email options, folders, sorting and searching etc is controlled at the client end.

IMAP4 allows integration between web mail and remote and local mail clients. No longer will they have synchronisation issues with mail - Mail folders stay consistent wherever and whenever a client connects to the IMAP4 Server.

The IMAP4 server in WinGate offers a good alternative to POP3 collection with the WinGate Mail Server, and is useful in situations where users have to retrieve their email from different locations but need some consistency between their mail retrieval.

Differences between IMAP4 and POP3

  • Mail storage

    With IMAP4 the mail can be left on server making it centrally available regardless of where a client connects from.

    With POP3 when a client access their POP3 mailbox on the server, the mail is removed from server to the location from which they connect.

  • User configuration

    With IMAP4 when a client creates mail folders in their email client application (e.g. Outlook express, Eudora) these folders are replicated on the IMAP4 server.

    With POP3 retrieval, folders are only created in the client email application used to retrieve email from the server, but this folder structure is not kept by the POP3 Server itself.

  • Message searching

    With IMAP4 the search is done on the server.

    With POP3 the mail is downloaded to the client machine, so searches are performed on client.

  • Accessibility

    With IMAP4 all mail is stored and maintained in one central location (i.e. the IMAP4 server), so user access is consistent wherever they might access their mail from.

    With POP3 all of the user configuration (mail folders/mail searches etc) are configured inside the Email application they use to download their mail with, which limits where they can access their mail from.

Click here for instructions on configuring the IMAP4 server in WinGate


IMAP4 server

The IMAP4 server requires little user configuration to function, however there are several points to note:

  1. Since the IMAP4 server offers an alternative mail collection method for clients to POP3 collection by WinGate, a user can only have either a POP3 mailbox or an IMAP4 mailbox on the WinGate mail server. (not both)
  2. Due to some intensive handling calls made by the IMAP protocol, turning on the debug checkbox in the logging configuration of the IMAP4 server will fill the WinGate server hard drive rather quickly. This option should be used with extreme caution, and only when absolutely necessary.

The IMAP4 Server properties found on the System tab of the GateKeeper Control Panel is used to control and configure the IMAP4 server.

IMAP4 - General configuration

Close | Close all images

checkbox Enable IDLE command

Usually IMAP4 clients will accept updates (changes to their mailboxes, folders, new mail etc) from the IMAP4 server while they are connected. However some IMAP4 client applications will ignore these updates if they have not specifically issued the server an IDLE command. This checkbox is ticked by default to support these clients so they will accept updates from the server rather then ignoring them.

This checkbox may need to be disabled when these types of IMAP client applications (especially Thunderbird) are attempting to upload a large amount of email to the IMAP4 Server.

Configuring IMAP4 mail in WinGate

The steps listed below are the only configuration that is required to have the IMAP server available for clients.

  1. Enable the IMAP4 server

    1. Open GateKeeper.
    2. Select the IMAP4 Server from the System tab of the GateKeeper Control Panel.

    3. Select the General configuration.

      IMAP4 - General configuration

      Close | Close all images

    4. From the Service startup drop down menu select Service will start automatically.
    5. Click OK

    Note:

    The IMAP4 Server runs on port 143(TCP), and is usually set to start automatically by default.

  2. Configure IMAP4 mailboxes for WinGate users:

    1. Open GateKeeper.
    2. Select the Users tab on the GateKeeper Control Panel.

    3. Right click on the user that will have an IMAP4 mailbox on the WinGate IMAP4 server, and from the menu select properties.

      Close | Close all images

    4. On the users properties, select the Email tab.

      User properties - Email tab

      Close | Close all images

    5. From the This user has a mailbox on this server, type: drop down menu, select IMAP4.
    6. Click OK

    The configured user now will now have an associated IMAP mail box created in the WinGate IMAP4 server. This will be created in the WinGate\Mail\IMAP\"Username" directory.

    You should now configure the IMAP4 capable email client application on the users workstation to connect to the WinGate IMAP4 server.


Mail Server - Domains configuration

Mail Server - Domains

The Mail Server Domains configuration is where you define which email domains will be specially handled by WinGate.

In general, any email domain for which you wish WinGate to perform special treatment (such as accepting for local mailboxes, relaying to another server, applying extra restrictions etc), you would create a domain handler for it in here.

Mail Server - Domains configuration

Close

Domain

This is the name of the email domain for which you wish WinGate to perform special processing.

Default Delivery

This describes the default method by which mail is processed for this particular domain.

Note:

That individual settings per address may be created which can override the default processing methods.

Click the Add button to bring up the Edit Email Domain dialog which will allow you to configure the settings for the new domain you wish to add.

Click the Edit button to edit an existing domain, or click Delete button to remove a previously configured Domain.

Note:

An "email domain" is the name given to that part of an email address that follows the ‘@’ symbol. For instance in the email address "bob@qbik.com" the domain is "qbik.com".

An email domain may be configured for many purposes. The most common purpose is because you wish to receive mail destined for a domain, and deliver it to local mailboxes for your mail users.

However, other purposes are:

  • If you wish to perform special processing (i.e. override destination, limit message size, copy mail to other addresses etc) for a particular destination email address. Since mail is domain-centric, no special processing for an email address can happen without a domain being configured for the email domain of that address. Such mail may be received by SMTP reception, or by POP3 collection.
  • You may wish to allow mail for certain destinations to be accepted for delivery by untrusted senders even though that mail is not hosted locally (allow relay).
  • You may wish to divert all outbound mail destined for a specific domain to a particular location.
  • You may wish to receive mail for an entire domain and deliver it to a single mailbox, or all mail to a single mailbox except specific addresses.


Edit email domains - General tab

Edit email domain - General tab

The General tab of the Edit email domain configuration allows you to configure the default delivery method of the domain you are editing.

Edit email domain - General tab

Close | Close all images

checkbox Enable domain

Type the name of the domain for which you wish WinGate to perform special processing.

Default delivery method

Mailboxes are hosted on this server

Without having to configure email addresses for each accepted email address in your domain, WinGate can automatically deliver all mail for a domain to the local mailbox that corresponds.

For instance, if there is a user in WinGate called ‘info’, then by default the address info@qbik.com would be delivered to their local mailbox. If that user was disabled, or did not have an email mailbox configured, then mail for info@qbik.com would be rejected.

Mailboxes for this domain are hosted on another server

Alternatively, you can redirect all mail destined for the domain to another server by selecting the Mailboxes for this domain are hosted on another server radio button.

Choosing this option will open the Remote Delivery Options dialog where you can choose whether WinGate should look up the mail server via an MX record, or you can specify the address and details used to communicate with the remote mail server.

Close | Close all images

checkbox Redirect all mail to

Ticking this checkbox allows you to select a single email address (from the drop down menu) that ALL mail for this domain will be delivered to.


Edit email domain - Addresses tab

The Addresses tab of the Edit email domain configuration allows you to maintain the list of email addresses and mailing lists for the domain you are editing.

Edit email domain - Addresses tab

Close | Close all images

Clicking the Add button will show the option of selecting either Add address or Add address list

Add address or Add address list

Close | Close all images

Selecting the Add address option will open the Edit email address handler configuration.

Selecting the Add address list will open the Edit email list address handler configuration so you can create and configure mailing lists.

Clicking the Add all local mailboxes button will add all of the mailboxes that have been configured for WinGate users (as per the Email tab in each users properties)

checkbox Enable reception of mail for addresses where no matching address handler exists. Else mail for unhandled addresses will be rejected.

This setting influences how the Default delivery method (as defined on the General tab) is used for this domain.

Edit email domain - General tab

Close | Close all images

  1. If the Default delivery method Mailboxes for this domain are hosted on this server radio button on the General tab is selected:

    • Then ticking the Enable reception of mail... checkbox on the Addresses tab, will result in mail being delivered to any matching local mailbox, and any Address Handler you specify will override the processing for the respective address.
    • If the Enable reception of mail... checkbox is not ticked, then only mail for which there is a matching email address handler will be accepted for delivery.

    (This option then can be used in conjunction with Add all local mailboxes button to quickly define the complete set of email addresses that will be accepted by WinGate mail.)

  2. If the Default delivery method Mailboxes for this domain are hosted on another server radio button on the General tab is selected:
    • Then ticking the Enable reception of mail... checkbox on the Addresses tab will force WinGate will not verify email addresses, and it will forward all mail for the domain to the remote server.
    • If the Enable reception of mail... checkbox is not ticked, then WinGate will only accept mail for addresses that match an address handler, and forward that mail to the remote server, or as otherwise specified in the particular address handler. In this way it is possible to get WinGate to block mail for all non-existent addresses in a domain, even if that domain is hosted on a remote server.

©2008 Qbik New Zealand Ltd


Edit email domains - Domain Aliases tab

Edit email domain - Domain Aliases tab

You can use the Domain Aliases tab to maintain the list of aliases for this domain.

Edit email domain - Domain Aliases tab

Close

A domain alias is used where a mail server may host more then one domain (e.g. WinGate.com, Qbik.com) and users will have email addresses in each domain. Rather then configuring a domain handler for each domain, you can simply add the other domains to the Domain Aliases tab that this domain will also receive mail for. This means that if a user has the address such as bob@qbik.com and the mail server also hosts the WinGate.com domain, then by adding WinGate.com to the domain aliases list for qbik.com, any mail addressed to bob at wingate.com will be accepted and treated as though it is being delivered to bob@qbik.com

This reduces the administrative burden on having to configure domain/email address handlers etc, and is handy for catch all type email situations.

However if a specific domain requires particular mailboxes, processing etc, then you will need to configure a domain handler for it in the Domains configuration in the mail server.


Edit email address handler - General tab

An email address handler is the name given in WinGate mail to a configuration for specific handling for a particular email address. WinGate Mail allows you to configure several properties for how to handle mail on an address by address basis.

You can configure these settings on the Edit email address handler dialog (This is accessed by clicking the Add button on the Addresses tab of the Edit email domain configuration).

This allows you to do things such as redirect mail for a user to another location (either local or remote), copy mail for a user to another address (or list of addresses), restrict message size for reception of mail for a particular address, or block all file attachments for an address.

Email address handler - General tab

Close | Close all images

checkbox Address handler enabled

Select this to enable special processing of mail destined for this email address.

Address @domain

The address in the domain you are configuring for. This is the part of the email address that precedes the ‘@’ symbol in an entire email address. The reason for this is due to domain aliases, as discussed below in the remarks.

Note:

Depending on whether default delivery is enabled for the domain that this address handler is part of, disabling this address handler may result in blocking of reception of mail for this address. See remarks below for more information.

Delivery

checkbox Override domain delivery settings

Check this box to override the defaults for this domain, as they are defined on the Domain delivery configuration.

This will enable the two radio-button options below:

  1. Deliver mail to local mailbox

    Check this box if you wish to deliver mail for this user to a mailbox on the same local area network. You can choose a local mailbox from the Destination drop down menu.

  2. Deliver mail to another mail server

    Check this box if you wish to deliver mail for this user to a mailbox on a remote server. Checking this radio button will produce the Remote Delivery Options dialog . This is where you may choose to deliver to a specific server, or use an MX lookup to find out the correct server to deliver to.

Click the (...) button produce the Server properties dialog, in order to define the configuration for the specific server you are choosing.

Note:

On the Edit email domain - Addresses tab, there is a check box setting entitled Enable reception of mail where no matching address handler exists. Else mail for unhandled addresses will be rejected.

Edit email domains - Addresses tab

Close | Close all images

If you enable this check box, the list of Email address handlers for the domain may be considered to be an override on the particular email address but all other addresses will also be received. If this setting is disabled, then the list of Email address handlers defines the entire set of email addresses that will be accepted for this domain. In this case, if you were to disable a particular Email address handler, that would be equivalent of removing it which would result in blocking reception of mail for that address.

Due to the fact that WinGate mail allows aliases for a domain, a single address handler may result in the effective creation of many email addresses (one extra per domain alias). For example, if there is domain called qbik.com, and you create an address handler called info, then you have effectively created the address info@qbik.com.

If you now add an alias to the domain qbik.com say test.com, then there is effectively another email address created called info@test.com.


Edit email address handler - Advanced tab

Use the Advanced tab in the Edit email address handler configuration to configure message size restrictions and set whether or not to block attachments for this user.

Edit email address handler - Advanced tab

Close

checkbox Apply extra restrictions for this address

Check this box to enable these extra restrictions for this address.

  • Limit message size to

    This limit is per message, per user.

  • Block all attachments

    Check this box to block all emails containing attachments to this user.

Copy mail

checkbox Deliver a copy of all mail for this address to the following

Check this box and add appropriate email addresses for all those who you want to receive a copy of all email delivered to this particular address. This will often be an administrator’s address.


Edit email list address handler - General tab

A new feature in the Mail Server configuration of WinGate (from version 6.1) is the ability to create mailing lists.

The Edit email list address handler configuration is where you can create/edit mailing list addresses for the domain you are configuring.

Edit email list address handler - General tab

Close

To create a mailing list:

  1. Make sure the Enabled checkbox is ticked
  2. Enter the email address that will be used for the mailing list in the Address field (e.g. In the example above this address is Accountants. This address will be @the domain you are configuring the mailing list for (e.g. Accountants@wingate.com).
  3. Enter the name that the list will be known by in the List Name: field (e.g. The Accountants list).
  4. Enter an email address where errors generated by the list should be sent to into the Errors to: field.
  5. Next add members to the mail list from the Members tab.

Options

Who can post:

You can select who is allowed to post messages to this list by selecting one of the three options from the drop down menu:

  1. Members only
  2. List owner
  3. Anyone

Replies go

This allows you to select the destination where replies to this list should be sent:

  1. Back to the list

    All replies will be sent to all list members.

  2. Back to the sender

    This setting means that a reply to a post that has been sent to a mail list, will be sent back to the person who made the original post.

  3. Back to the list owner

    All replies made to posts on this mailing list will be sent back to the List owner.


Edit email list handler - Members tab

Edit email list address handler - Members tab

The Members tab of the Edit email list address handler configuration allows you to add members to the mail list you are configuring.

Edit email list address handler - Members tab

Close | Close all images

Clicking the Add button will bring up the Edit email address dialog where you can add the email address of users who you want to be list members.

Edit email address - Add a list member

Close | Close all images

Enter the email address of the person you wish to make a member of the list. Or you can simply enter a username, if the user has a mailbox in this domain that is hosted on this server, i.e. a local mailbox.

On the Edit email address dialog you can select whether the list member can post mail to the list, and whether or not this list member will receive list posts.


Edit email list address handler - Advanced tab

The Advanced tab of the Edit email list address handler configuration allows you to set extra restrictions for the mailing list you are configuring.

Edit email list address handler - Advanced tab

Close

checkbox Limit message size to

This setting allows you to limit the largest size email that can be posted to the list.

checkbox Block all attachments

Setting this option will stop users from sending an attachment with any email they post to this list.

©2008 Qbik New Zealand Ltd


Mail Server - Mailboxes configuration

Mail Server - Mailboxes

The Mail Server Mailboxes configuration lists all the user mailboxes on this server.

Mail Server - Mailboxes

Close

This list displays summary information of the mailbox configuration for all WinGate users who have mailboxes on the Mail Server.

Status

This field indicates whether a users mailbox is enabled or disabled.

Quota

This field indicates the size allocation (if there is one set) of a users mailbox.

Type

This field indicates whether the users mailbox is a POP3 or IMAP4 mailbox as specified on the Email tab of the users properties in WinGate. (It can only be one or the other)

Double clicking on a specific mailbox will bring up the Email tab of the WinGate User. This allows you to set quotas, enable or disable the user’s mailbox and display a list of all current email addresses in effect for the user.


Mail Server - Receiving

The Mail Server Receiving configuration is used to configure options for receiving mail.

Mail Server - Receiving configuration

Close

checkbox Receive mail while ... MB free on partition

You must have this checked in order to receive mail through WinGate. The number you enter here is the ‘low watermark’ for the mail server i.e. when this figure is reached, WinGate will stop receiving mail, and only deliver.

Untrusted Sender (e.g. Inbound from the Internet)

checkbox Allow relay

Select this if you wish the WinGate mail server to accept and send email for domains that are not local. Note: This option is a potential security risk and is not recommended.

checkbox Max message size (KB)

Check this box and fill in the field to set size limits on all incoming mail.

checkbox Max number of recipients

Check this box and fill in the field to set limits on how many mail recipients can be delivered to at any one time.

checkbox Disconnect if sender sends... disallowed commands

This limits the number of commands the server will tolerate before the connection will be terminated. Lower this limit if you have a slower Internet connection.

checkbox Block invalid sender domain

Check this box to examine the validity of mail from incoming IP addresses. When turned on, this option ensures that the domain is valid against DNS records and/or a mail exchange (MX) record. It also checks that the IP addresses and server names are not obviously bogus (e.g. 127.0.0.1 – or any other loopback addresses – are invalid).

checkbox Block blank return-path

Check this box if you don’t want to receive emails that don’t have a valid return path i.e. checking this is a good way of reducing spam.

checkbox Block numeric sender domains

Check this box if you don’t want to receive emails that contain IPs in the address field. This is a common spamming technique.

checkbox Use Open Relay Detection

Check this box to enter the domain name or IP of a server if you want this server to check the sender’s IP against known open relay server lists. You do this in the subsequent Open Relay Database Settings dialog.

checkbox Block spoofed sender-address

Check this box and use the subsequent Sender Address Validation Settings window to check whether the IP address of the sender is using the same service provider as the server responsible for receiving mail for that domain.

checkbox Block attachment file types

You may wish to ban attachment file types that are a potential virus risk to your network e.g. .exe, .vbs, .pif, .com, .scr. Enter these attachment types into the subsequent Banned Attachments screen.

Trusted Sender (e.g. Local/Outbound from the LAN)

checkbox Allow relay

Select this if you want the WinGate mail server to accept and send email for domains that are not local. Checking this box in the Trusted Senders section is not the security risk that checking it in the Untrusted section is because this only pertains to users on your LAN.


Mail Server - Open Relay Database Settings

Use the Open Relay Database Settings to enter the domain name or IP address of an open relay database (ORDB) server that the WinGate Mail Server will use in order to check that the IP address of the client attempting to send mail through WinGate is not on a open relay server list.

Open Relay Database Settings

Close

Open relays through remote mail servers are often used to send SPAM.

Open Relay Database Servers keep lists of known or suspected IP addresses that try to relay mail through unauthorised mail servers on the Internet. Here are some examples of ORDB servers:

  • inputs.orbz.org
  • outputs.orbz.org
  • relays.ordb.org
  • orbs.dorkslayers.com
  • dev.null.dk
  • relays.osirusoft.com
  • bl.spamcop.net
  • relays.visi.com

Note:

The downside of using this feature is the possibility of your server rejecting legitimate (non-spam) email.

Use the Up and Down buttons to specify the order in which WinGate will check these servers.

Alternatively use the Allowed Servers pane to list IP addresses that the WinGate Mail Server will always allow mail for.


Mail Server - Banned Attachments

Use the Banned Attachments dialog to define extension types that will not be accepted for delivery through the WinGate Mail Server.

Banned Attachments dialog

Close

Note:

Remember only to add the extension without the period (.).


Mail Server - Sender Address Validation Settings

The Sender Address Validation settings screen is used to specify whether or not the Mail Server should perform reverse lookup verification of other mail servers that are connecting to it.

Sender Address Validation

Close

©2008 Qbik New Zealand Ltd


Mail Server - Delivery

Use the Mail Server Delivery configuration to choose options for sending on messages that have already been received.

Mail Server - Delivery configuration

Close

checkbox Enable Delivery of Mail

You must have this checked in order for WinGate to deliver mail whether it is remote or local.

Remote delivery

How to deliver

  1. Deliver directly

    WinGate makes special DNS queries (known as MX lookups) to automatically discover the servers that are prepared to accept delivery of mail for the destination email domains that WinGate has to deliver to. This is the normal setting, and does not require you to use any other server (such as your ISP’s) – you will probably want to use this option if you have a full-time connection to the Internet).

  2. Use Gateway

    If you select this option, WinGate will forward all outbound mail (mail that is not destined for local mailboxes or otherwise has delivery settings specified in an email domain configuration) to the mail server you specify here. This will normally be the SMTP server at your ISP.

  3. Use Gateway for undeliverable mail

    the mail server tries to deliver directly in the first instance but, if unsuccessful, will pass it on to the defined server for it to try to deliver. This can be useful if your server is running on an IP address that may be blacklisted by other servers (i.e. some dialup addresses are blacklisted by some server administrators).

Gateway server

If you have selected Use Gateway or Use Gateway for undeliverable mail in the How to deliver field, then this is where you specify the server to be used (you may specify either an IP address or a host name). If you have extra settings that you need to specify, for instance if you are delivering to your ISP and they require authentication, you may specify the extra settings by clicking on the button to the right.

checkbox Attempt immediate delivery

If you have this option selected, WinGate will trigger its delivery processing mechanism for a particular message as soon as the message has been received. Otherwise, WinGate will only check for new messages that require delivery as often as you specify in the Process mail every... seconds field.

checkbox Reset next scheduled delivery time when new mail for queued domain

Checking this box will set the delivery time of mail already queued, to be sent immediately whenever more mail for that domain joins the queue behind it.

checkbox Use secure connection if supported by server (TLS)

If the mail server that the WinGate mail server is delivering mail to supports TLS (Transport Layer Security) then this connection will utilize TLS.

Use maximum ... threads for delivery

Enter the maximum number of threads you wish WinGate to use at any one time for delivery of mail. The default setting is appropriate in most cases, however if you are on a heavily loaded machine, you may wish to reduce this number to reduce the workload incurred in WinGate by delivery of email.

Process mail every... seconds

Enter how often you want WinGate to check its list of domain delivery jobs to see if one is scheduled for delivery.

General mail delivery settings

checkbox Keep copies of sent mail

If you check this box, all processed mail will be copied to the \Mail\Spool\Sent folder under the WinGate install directory once it has been delivered. You should be sure to clear this folder regularly.

Try to deliver for ... days or ... tries

Define the length of time or number of delivery attempts that will be made (which ever expires first) before all queued mail for a domain will be returned to its respective originators.

Note:

WinGate keeps track of mail to be delivered based on files and directories under the \Mail\Spool directory in the WinGate install directory.

WinGate will periodically scan these directories looking for mail that has been received that may require processing.

WinGate maintains an internal database which keeps track of scheduled delivery attempts for each domain that has messages pending delivery. Due to occasional delivery problems (for instance a remote server is unavailable), WinGate may sometimes need to re-schedule failed delivery attempts.

Parameters associated with the number of tries, the period over which to attempt delivery, and other delivery parameters are configured on this tab.


Mail Server - Security

The Mail Server Security configuration is used to configure the security settings for WinGate Mail.

Mail Server - Security configuration

Close | Close all images

WinGate mail security consists of two main areas of functionality:

  1. Support for authentication (both POP3, IMAP4 and SMTP protocols).
  2. Support for secure connections using TLS (Transport Layer Security)

Authentication support:

Authentication is how the client (i.e. software sending or retrieving email) validates its identity with the server. There are a number of methods for doing this, and each method has various implications. In the main they can be classified as either secure or insecure, in terms of whether or not they transmit passwords over the network in a way that can be intercepted.

The reasons for authentication for POP3 (email retrieval) are fairly obvious, since the system needs this to determine which mailbox the user is trying to access, for SMTP (email sending) this is less obvious.

The reason you may wish users to authenticate for SMTP is to make the system treat them as a trusted user. Trusted users have more privileges (like being able to send mail that requires relaying).

By default when sending mail through WinGate mail server, a user is trusted if either:

  • They connected to WinGate on an interface that is marked as Internal (see the Network connections section for details on network interface usage).
  • There is an user assumption set up for their IP address, which associates them with a WinGate user account.
  • They authenticate with the WinGate SMTP server.

So, if you wish users external to your network to be able to use WinGate's mail server to send mail out onto the Internet, and you do not wish to set up an assumption for their IP (as it may change regularly), then authentication is the only secure way.

WinGate supports the following authentication methods:

Insecure:

  • SASL: PLAIN
  • USER/PASS (POP3 only)

Secure:

  • SASL: NTLM
  • SASL: CRAM-MD5
  • APOP (POP3 only)

SASL (Simple Authentication and Security Layer) is a definition for a way in which authentication takes place by a certain method, so the methods PLAIN, NTLM, and CRAM-MD5 are supported for both SMTP and POP3, and furthermore for POP3 the normal USER/PASS method as well as APOP commands are supported.

WinGate also allows you to specify that a connection must be secure (see below) before a certain authentication method will be allowed. This allows you to stop passwords from being sent insecurely over the network.

User database considerations

Depending on whether you are using the WinGate user database, or the user database of the underlying operating system (Operating system/Remote user database), these authentication methods are either available or not.

In summary, to authenticate against the Operating system/Remote user database requires the use of a plaintext authentication method, or the SASL NTLM method (used by Outlook). If you wish to only use the WinGate user database, then the NTLM method is not available.

POP3 Override password

In some other cases, the user account settings will also come into play. For instance, if you have specified that the user uses a POP3 override password, then if your email program uses USER/PASS method to authenticate for retrieving mail, then this password is the one that MUST be used. The normal WinGate or NT password will not work.

For some other methods however, the POP3 override password is used as a second-chance check, for instance the APOP, CRAM-MD5 methods do this if you are using the Operating system/Remote user database. This is because these methods would otherwise not be available.

Availability settings

Each authentication scheme has 3 possible settings and these can be configured by double clicking each Authentication mechanism listed in the window to produce the Edit Authentication Method dialog.

Edit Authentication Method dialog

Close | Close all images

  1. Denied

    Denied will block all authentication attempts that are made using that particular method.

  2. Allowed

    Allowed will permit an authentication mechanism to be used.

  3. Allowed only with secure connection

    Secure (TLS) will allow a particular authentication scheme, as long as it takes place over an encrypted TLS/SSL connection.

Secure connections (TLS/SSL)

Secure connections allow for a greater level of security for insecure authentication methods, since the connection is first encrypted. This allows you to use authentication methods safely where they would not be safe over an insecure connection.

Furthermore the content of the email is also sent over the encrypted connection, so people sniffing network traffic on your network or on the Internet cannot see the content of your emails, as they are being sent and retrieved.

Certificates

In order to use TLS support, a certificate (X.509 standard PEM format) must be available. Certificates are used to validate the authenticity of a server, and have been commonly used with secure web-servers for years.

You may get WinGate to generate a certificate itself to use with mail if you wish, via the Server Certificate manager on the System tab in GateKeeper, or in certain circumstances you may wish instead to obtain a certificate from a recognised certificate authority.

If you choose the easy option of having WinGate generate its own certificate, some email clients may complain that they do not trust the certificate used by your mail server. In this case, most clients have an option whereby you can force the client to trust the certificate.

You are unlikely to need to go elsewhere for a certificate unless having the mail clients manually configured to trust the certificate proves too much of a burden. There are normally costs associated with obtaining a signed certificate from a certificate agency.

Note:

When generating a certificate, you must specify a common name. This is the name attached to the certificate, which is used to identify the server. Most mail programs will complain if the name in the certificate is not the same as the name of the server they connected to. You may generate wild-card names (which match a whole range of names) as follows, for example, the Qbik mail server, uses the name

*.qbik.com

This means that if an email client connects to any name that ends in qbik.com to get their mail, then the name will match.

Finally, WinGate only supports certificates that are in a .PEM format, so if you choose to obtain a certificate from elsewhere, you may need to convert the format that they provide you with. There are many available tools that will convert certificates from other formats to this format.

Server identity

This is the name by which the server is known. It defaults to the DNS name of the machine it is running on. So for example on a Windows 2000 Active Directory server this could be qbik.com, where as on older operating systems this might be WorkPC1.

This is important also for certificate generation, as this name is used within the certificate generation process for the common name unless you change it, and therefore will be the name that will be displayed in peoples certificate manager programs.

Common email client support

Support for secure connections and/or authentication is available in many email clients, to differing levels.

The following information covers some common email clients:

  • Microsoft Outlook, and Outlook Express.

    Supported authentication methods are:

    For POP3: USER/PASS, NTLM.

    For SMTP: NTLM

    As far as secure connections goes, Outlook supports TLS for sending mail (SMTP), but not for retrieving mail (POP3).

    If you specify that Outlook must use an encrypted connection for POP3, it will instead attempt to connect to a secure pop3 server (SPOP) on port 995. WinGate’s TLS support for POP3 does not support this.

    Furthermore, beware of how Outlook operates when it tries to authenticate if you are using the NTLM method ("secure password authentication"). It will in all cases first try to use the username and password of the currently logged in Windows user, before it will then try the username and password you specify. We hope Microsoft changes this soon.

  • Qualcomm Eudora

    Supported authentication methods are:

    For POP3: USER/PASS, APOP, CRAM-MD5, Kerberos (not available)

    For SMTP: CRAM-MD5, Kerberos, PLAIN

    Full TLS support is included.


Mail Server - Misc Settings

If you have the optional data scanning plugin (such as Kaspersky AntiVirus for WinGate) installed with WinGate, then you can use the Mail Server Misc Settings configuration to select data-scanning preferences governing email across your network.

Mail Server - Misc Settings configuration

Close

General settings

System postmaster address (required)

This field must have a valid entry in order to operate your mail server i.e. the name of your postmaster’s email address.

Scanning

Scan / reject incoming mail prior to accepting it for delivery

Select this checkbox if you wish to have the data scanning plugin scan the email before it is accepted by the mail server for delivery. Selecting this option will disable the other options underneath.

checkbox Inform original sender

Select this option to send an email to the sender informing them that the email they sent contained a virus.

checkbox Inform original recipients

Select this option to send an email to the people who were originally going to receive the infected email, telling them that it was rejected.

checkbox Inform system administrator at

Select this option to send an email to the Administrator, informing them that an email coming into the network has been rejected. This requires a valid email address to be entered in the ‘ Administrator Email Address’ field on the right.

checkbox Include original email headers

Select this option to include the original email headers with the automated message. This is often useful to determine the source of the rejected email.

Note:

The settings you select under Scanning will have no effect if you do not have data scanning plugins installed.

If configured to do so in the Plugin configuration of WinGate’s SMTP Server, WinGate will scan any received email. Typical applications of this are scanning for email-borne viruses, or spam. If an email is rejected, notification emails may be sent to the original sender, original recipients or the system administrator.


Mail Server - Trust Policy

New to WinGate 6.2 Mail Server is the Trust Policy configuration.

Mail Server - Trust Policy configuration

Close | Close all images

Here you can set custom policies on how the WinGate Mail Server should trust or distrust certain senders. There are a number of policies created by default (Shown in the Trust Policy screen). To enable/disable the default policies simply uncheck the box beside each one.

To add a new policy:

  1. Click on the Add button to bring up the Edit mail trust policy dialog.

    Edit mail trust policy dialog

    Close | Close all images

  2. Select the Action, either Trust or Distrust
  3. Set one condition in the Where drop down menu.
  4. Enter the appropriate condition in the Matches field that corresponds to the Where field to determine when this policy will be enforced. (e.g. Where: sender email address Matches: Jblog@WinGate.com)
  5. Make sure the Policy Enabled check box at the top of the dialog is ticked.
  6. Click OK. The new custom trust/distrust policy will now be listed in the main Trust Policy screen of the Mail Server.

©2008 Qbik New Zealand Ltd


Mail Server - Collection

You can configure how the WinGate Mail server will collect mail for your domain through the Mail Server Collection configuration

Using the collection features in WinGate Mail, you can set up tasks to periodically log into POP3 servers and collect mail for you.

The mail that is collected may be delivered according to a number of rules, configured on a task-by-task basis.

This makes this feature useful for sharing POP3 accounts, or catch-all accounts (where all mail for a domain ends up in a single mailbox, usually on your ISP).

Mail Server - Collection configuration

Close

Account

Shows the server and login where the mailbox is hosted.

Deliver to

This specifies how the retrieved emails will be delivered.

Every

This is how often (in minutes) the Mail Server will check for mail.

Clicking the Add button will open the Mail collection properties dialog. This enables you to add a new mail collection task and configure its properties.

Click the Edit button to edit information about a particular (highlighted) mail account. Or click the Delete button to delete a mail collection task.


Mail collection - Account tab

The Mail collection Account tab is accessed by adding or editing a mail collection policy on the Mail Server Collection configuration

Mail collection - Account tab

Close

checkbox Check account every ? minutes

This allows you to check how often mail collection will be performed.

Account details

Here is where you enter the account details that are required for the WinGate mail server to use to collect mail from the remote POP3 server.

checkbox Use secure connection if supported by server (TLS)

You must generate the certificate on the Servers tab in order to use this method.

Authentication method

By default WinGate discovers the best method of authentication that the remote server supports. In some cases however, a mail server may not correctly advertise supported methods.

In these instances, it may be necessary to instruct WinGate to use a specific method from the list below:

  1. USER/PASS
  2. SASL PLAIN
  3. APOP
  4. CRAM–MD5
  5. NTLM

Message deletion:

Leave all mail on server

This will require the manual deletion of all mail periodically.

Delete mail on server only if it can be delivered

Check this option if you want to ensure mail has been successfully delivered to the account holder before it can be deleted from the server.

Delete mail from server regardless

Check this option if you want to delete mail from the server, even if it has not been successfully delivered to the account holder.


Mail collection - Delivery tab

The Delivery tab on the Mail collection configuration, allows you to specify how mail collected from this POP3 account is to be delivered.

Mail collection - Delivery tab

Close

Message headers

You can specify the email headers from which email addresses should be extracted for delivery. Some common email headers used for catch-all email accounts have been included. You can also add your own headers for your own requirements, and specify the order in which headers are checked.

The system supports multiple email addresses in all of these fields, however once addresses have been found in a matching header, WinGate ceases looking for more addresses. This is to prevent multiple deliveries. The only exception to this is the To: and Cc: headers. If none of the other headers are found, and processing gets down to looking in the To and Cc fields, then finding an email address in the To field does not stop processing. Keep these headers at the bottom if you are not relying on them.

checkbox Parse the following message headers for recipient address(es)

This setting is used to select what email message headers WinGate will check in mail it has collected so it can determine which mailbox it is to be delivered to. If all the mail in this account should be delivered to the same local account or email address, then leave this checkbox unticked and specify a default address.

This will stop WinGate from checking any of the listed email headers for other recipient addresses.

checkbox Only deliver if destination matches a local mailbox

This setting is available if you are parsing message headers. If selected, then once the destination addresses are extracted from the downloaded emails, delivery will only be made to those email addresses which are considered local. If this setting is not selected, WinGate can download mail, and deliver to a remote address.

checkbox If no addresses are recognised, use the default address

This setting is available if you are parsing message headers. It allows you to specify a back-up address which will be used if none of the extracted email addresses from the email are recognised.

Default address

This is the address to which the email will be delivered if you have specified WinGate should not parse message headers, or if in parsing no recognised addresses were found and you have enabled the default address.

©2008 Qbik New Zealand Ltd


Mail Server - Servers

The Mail Server Servers configuration lists SMTP servers that have been configured with specific requirements.

Mail Server - Server configuration

Close | Close all images

Click the Add button to bring up the Server Properties dialog and add a new server profile.

Click the Edit button to edit a server in the Server Properties dialog.

Click the Delete button to remove the highlighted server.

Server Properties dialog

Close | Close all images

The Server Properties dialog allows you to add or edit SMTP server information.

It may be accessed either by clicking on a specific server on the Mail Server Servers screen, or you may access it from the Remote Delivery Options screen, when you are defining a server to deliver to, overriding a default setting.

General

Server

Enter the IP address or DNS name for the destination server.

Description

Allows you to more easily remember why you set up this server profile.

Security

checkbox Use secure connection if supported by server (TLS)

This displays whether you will use an encrypted connection (conforming to the TLS specification) to the destination server.

checkbox Server requires authentication

This displays whether you will attempt to authenticate with the destination server.

Method

Choose the type of security mechanism to be used with the server

  1. use best method available
  2. SASL PLAIN
  3. SASL LOGIN
  4. CRAM MD5
  5. NTLM

Note:

That even if authentication fails on delivery, WinGate will still attempt to deliver the mail, since often authentication is not mandated.


Plug-ins configuration

The Plug-ins configuration lets you enable and disable installed plug-ins for this particular service as you wish.

Close

Whenever you install a data scanning plugin into WinGate, it will appear in the Plug-ins screen of the service(s) that it can be used for.

To enable a listed plugin, simply tick the corresponding check box.

Unchecking the box will have the effect of disabling the plugin for that particular service.

checkbox Drip-feed data to client if file bigger than ‘x’ kB

This feature sends the client part of the downloaded data while a file is being scanned. This prevents clients like Outlook or Internet Explorer from timing out while waiting for the data to arrive.

Note:

The Plug-ins configuration is only available in the SMTP server, and the FTP, POP3, WWW Proxy servers


Quarantine Properties

The Quarantine properties dialog is accessed from the Options menu at the top of GateKeeper, and allows you to configure settings for the WinGate quarantine.

Close

Storage

Maximum size

This is as large (in MB) as the Quarantine can get before it must purge some files. In the example above, the purge will take the size of the files stored in Quarantine down to 200 MB.

Maximum age

This is the length of time a file will remain in quarantine before it is purged.

Maximum items

Enter the maximum number of files that will be kept in quarantine before purging will occur.

Miscellaneous

checkbox Auto activate when an item is quarantined

Check this box to make GateKeeper’s Quarantine tab pop to the front whenever a new file gets quarantined.


Viewing audit and logfiles

Advanced monitoring allows an administrator to see full details of all WinGate activity so they can control user and system access more effectively.

  • Auditing

    The User Properties dialogs have an Auditing tab.

    User propeties - Auditing tab

    Close | Close all images

    All per-user monitoring is stored in the audit files.

    These files are in a Tab delimited format. User audits are stored by default as: %WinGatePath%\audit\username.log

  • Logging

    Service properties have a Logging configuration screen.

    Close | Close all images

    All per-service monitoring is recorded in the log files.

    These files are in a Tab delimited format. Service logs are stored by default as: %WinGatePath%\logs\servicename.log.

The file format for auditing and logging files is:

Date | Time | IP Address | Session # | EventType | Event Details
12/02/96 | 15:01:25 | 192.168.0.1 | 0000006100 | Modify | user John
12/02/96 | 15:04:35 | 192.168.0.1 | 0000007126 | Created http:// |

There are two divisions of audit/logging events which allow several options.

Administrators may select any or all of these to suit their auditing/logging requirements. The default options are indicated.

Session events

blank checkbox Session creation (Default setting: Off)

Selecting this option causes session creation details to be logged.

The detail indicates the service type, e.g. HTTP.

Session creation details are often used when tracking down problems.

blank checkbox Session termination (Default setting: Off)

Selecting this option causes termination of sessions to be logged.

This is not normally selected unless there are problems with your applications hanging.

An individual session can be tracked from creation and request to termination.

checkbox Request details (Default setting: On)

Session request detail will be stored. In HTTP, the requested URL will be recorded.

blank checkbox Debug (Default setting: Off)

Logs any debug messages that occur.

blank checkbox License violations (Default setting: Off)

Any violation of the license count will be recorded.

checkbox Session traffic (Default setting: On)

Traffic levels recorded for the session. In Bytes (sent to, received from, sent for, received for client, seconds).

Configuration events

checkbox Authorisation failures (Default setting: On)

If a user enters the wrong password, the event will be noted.

checkbox Errors (Default setting: On)

Records details of any errors.

checkbox Service start/stop (Default setting: On)

Notes when the service is started or stopped.

checkbox Configuration changes (Default setting: On)

Notes service/user configuration changes.

checkbox User login (Default setting: On)

Indicates when the user logs in.

checkbox User logout (Default setting: On)

Notes when a user logs out.

A text editor or the Logfile Server can be used to view these files.


History Settings

The History Settings dialog allows control over what is recorded and what is ignored by WinGate history. This lets you stop WinGate from filling up your hard drive with useless data and from doing unnecessary work.

History Settings dialog

Close | Close all images

Users are able to construct filters (based on useful criteria) that tell WinGate what activity, events and other information to log. Filters are further discussed below.

View Filter Settings

The viewer component displays the data that is logged. The basic implementation in "Traditional WinGate Logging" allows you to construct filters which determine what is displayed. This is useful as it allows you to locate and display specific history data – this may help to troubleshoot specific events or track undesired network activity to a source.

There are two types of filter:

  1. Simple filter

    Close | Close all images

    This feature makes it easy to create filters using any of the history criteria available (these can be selected from the combo-box on the left). The filter displayed above is very basic – it will only display the history for the user "bob". Note that history data for all other users still exists but has been filtered out – for example, you may be investigating a certain user activity.

  2. Free-Hand Filter

    Free hand filter

    Close | Close all images

    This feature is for advanced users. It is extremely flexible and versatile, allowing the user to combine any of the available history criteria and values into logical statements (using Boolean operators like OR, AND, NOT etc).

Examples:

username="bob" will display all items where "bob" is the user

username="t?m" will display all items where the first letter of the username is t and the third and last letter is m, e.g. tim, tom etc.

username<>"tim" AND username<>"b??" AND (compname <>"b*" OR IP <> "192.168.*") (((type<> DNS) or (type<>RCS)) = FALSE) AND (bytesin > 4096))

Displays only sessions with traffic over 4k (excluding RCS and DNS sessions) for users with 3 letter names not starting with "b" (e.g. excludes ben, bob) or equal to "tim". Also excludes sessions from any computers that have a NetBIOS name beginning with "b" or an IP address in the 192.168.*.* range.

Braces

May be used to group expressions.

( : Open bracket

) : Close Bracket

Comparison types

Operand description

<

Less than

>

Greater than

=

Equals, is equal to

==

Equal to, the same as

<=

Less than or Equal to

>=

Greater than or equal to

AND

BOOLEAN and, i.e. both operands must evaluate TRUE

OR

BOOLEAN or, i.e. at least one of the operands must evaluate TRUE

XOR

BOOLEAN xor, i.e. one and only one operand must evaluate TRUE

ISU

String contains (non-case), i.e. TRUE if operand 1 contains operand 2

IS

String match, case-sensitive

Operators

Operators can be used in expressions where appropriate:

+ : Numerical addition and string concatenation

- : Subtraction

* : Multiplication in numerical expression, e.g. 3*5

/ : Division

Data Types

  • Constants:

    TRUE : Evaluates TRUE

    FALSE : Evaluates FALSE

    <Type Constant> : See below

  • Wildcards:

    * : matches any string 0 or more chars long

    ? : matches any single char

  • Strings:

    a string can be constructed as so: "string contents"

    Strings can contain wildcards

    Strings can be concatenated: "str" + "ing"

  • Number types

    integers : i.e. {...,-2, -1, 0, 1, 2, ...}

    real numbers : e.g. {1.2, 3.9, -4.6, etc. }

Available Variables

All string values must be enclosed in " ".

Variable

Type

Description

USERNAME

String

This is the NetBIOS username (may not be known) of the user who created the session. Will appear as blank in the database if the user name is unknown

WGUSERNAME

String

This is the WinGate username (may not be known) of the user who created this session. Will appear as blank in the database if the user name is unknown

COMPNAME

String

NetBIOS network computer name (if known)

IPNUMBER

String

IP number of client

APPNAME

String

Name of application creating this session, if known from WRP

DESCRIPTION

String

Activity description of session

DURATION

Integer

Time in seconds this session lasted

BYTESIN

Integer

Data in bytes that were sent to the client

BYTESOUT

Integer

Data in bytes that were sent from the client

TYPE

Predefined constant

A protocol method, one of:

NONE, RCS, DNS, WRP, PLUG, HTTP, FTP, POP3, SMTP, NNTP, TELNET, REALPLAYER, VDO, SOCKS4, SOCKS5, XDMA, VPN


Advanced Options

GateKeeper - Advanced Options

The Advanced Options configuration is found under the Options/Advanced options menu at the top of GateKeeper.

Close | Close all images

It provides the following options for tracing configuration problems:

  • Troubleshooting

    Configuration Report

    This dialog can be used to produce a text report of the current WinGate configuration, including information such as version numbers, network interfaces, service configuration, etc. The gray text box provides a preview of the report, which can be saved to a text file by pressing the Save Report button. A list of report sections is displayed on the left, in the white text box. Each section can be included or omitted by clicking on the corresponding check box.

    Save Registry Settings

    Click this button to save your current registry settings into a re-loadable registry file, which you specify. This feature can be used to examine your WinGate configuration more closely, or as a backup before making configuration changes. This button is only visible if GateKeeper is running on the WinGate server.

  • Syslog Options

    Syslog Options configuration

    Close | Close all images

    The Syslog screen in the Advanced Options allows you to set the options for how system events will be displayed on the System Messages tab in GateKeeper. You can also set how WinGate will log actual system events.

  • Confirmation Options

    Confirmation Options configuration

    Close | Close all images

    The Confirmation Options screen in the Advanced Options allows you to set when a user will be given a confirmation dialog when making changes to the GateKeeper configuration.


System messages

System Message

WinGate Component

ID

Description

NO VALID LICENCE REVERT TO ONE USER

Engine

(0x0001)

This means that the licence failed checking on startup, and the engine will revert to a single user mode.

This single user can only be the localhost, so no other client machine will have access to the server.

If you have client licensing, then clients with valid licences will still be honoured.

Otherwise, you will have to register the software to be able to use it on your network. If you believe you have a currently valid licence, and you get this message, you will need to contact your software supplier for a replacement licence.

NO CONFIG FOUND USING DEFAULT

Engine

(0x0004)

No configuration information was found in the Registry. Default operating configuration will be used.

NO SNMP SUPPORT

Engine

(0x0005)

Whilst trying to initialise the SNMP subsystem, an error occured. This may be caused by a number of things:

  1. The file SNMPAPI.DLL is not existent in your windows system directory.
  2. The file SNMPAPI.DLL in your system directory is corrupted.

Without SNMP support, a number of features of WinGate cannot operate. This includes the WinGate NAT, which relies heavily on SNMP.

SNMP should be installed by default on your operating system when TCP/IP is installed. If you cannot find this file, you may need to contact your operating system vendor for support.

INTERNAL DIALER RESTART

Engine

(0x0006)

This occurs when too many unknown errors occur in processing dialer requests in WinGate.

When this occurs, the dialer manager is restarted to attempt to recover from the situation.

NO ICMP SUPPORT

Engine

(0x0007)

Whilst trying to initialise support for ping (ICMP), an error occured.

This is caused when:

  1. The file ICMP.DLL is not found in your system directory
  2. The file ICMP.DLL in your system directory is invalid of corrupted

Without support for ICMP, a number of features of WinGate will not operate correctly.

In particular the DHCP service relies on the ability to verify IP addresses by pinging. So without this support DHCP may not operate correctly.

AFFINITY SETTING

Engine

(0x0008)

The normal process affinity is over-ridden, as detailed in the message text (as configured by the registry value for "Settings\AffinityMask" (DWORD) )

SCHEDULED SYSTEM REMINDER

Engine

(0x0009)

A scheduled system reminder message (eg "Your licence is about to expire")

SCHEDULED REMINDER

Engine

(0x000A)

An scheduled reminder message from the administrator (eg "Log off now - system shutting down in 5 minutes" before a nightly backup, etc)

TRIAL LICENCE EXPIRED

Engine

(0x000B)

Your trial licence has expired - WinGate has reverted to your previous licence, and so some new features will have become disabled.

OLD LICENCE

Engine

(0x000C)

Your licence version is older than the WinGate version, so some features are not available.

NO ROUTE TO INTERNET

Engine

(0x000D)

There are no enabled dialer profiles and no default gateway configured. Computers using WinGate as their default gateway will not be able to connect to computers on the Internet.

AUTOUPDATE CURRENT

Engine

(0x000E)

Your WinGate version has been checked and is up to date.

AUTOUPDATE NEWER AVAILABLE

Engine

(0x000F)

Your WinGate version has been checked and there's a newer version available.

AUTOUPDATE FAILED

Engine

(0x0010)

Auto Update check failed.

NEED MANUAL DNS

Engine

(0x0012)

WinGate requires manual configuration of DNS servers.

DNS CACHE DISABLED

Engine

(0x0014)

Acquiring a lock has failed and the cache has disabled itself. Probably due to a long purge or overloading or both. Queries are still processed but are not resolved locally, i.e. all result in messages to upstream servers.

INTERFACE DETECTED

Engine

(0x0015)

Change detector has determined that there is a new interface detected.

WWW CACHE CANNOT OPEN CACHE FILE

Cache

(0x0016)

Could not open cache index file.

NO PRO LICENCE BUT OTHER USERS

user database

(0x0101)

Whilst reading the configuration for the user database, non system users were found. However your licence does not allow you to use these database entries, so they will be ignored.

This typically happens when you use a Standard licence, but previously had a Professional version installed where you had added users.

To get rid of this message, you will need to remove the other users from the registry.

These may be found under:

HKEY_LOCAL_MACHINE\Software\QbikSoftware\WinGate\user database.

You should delete all but the Users, Administrators, Guest, and Administrator subkeys.

If you delete these keys by accident, the default accounts will be recreated, but you will lose any password and accounting information.

DEFAULT USER NOT FOUND CREATED

user database

(0x0102)

A default user account (either the Administrator or Guest) was not found. This account is required and has been created.

This may occur if you start WinGate from another machine, or your settings have been lost.

DEFAULT GROUP NOT FOUND CREATED

user database

(0x0103)

A default user group (either the Administrators or Users group) was not found. This group is required and has been created.

This may occur if you start WinGate from another machine, or your settings have been lost.

NT INTEGRATION BUT NO 4 LICENSE

user database

(0x0104)

You have NT User database integration selected. You can not use this option unless you have a WinGate 4 license.

REMOTE CONTROL SERVICE NOT FOUND CREATED

Services

(0x0201)

Whilst validating WinGate's configuration, the Remote Control Service was not found.

This is a required service, and so has been added.

This may occur if you start WinGate from another machine, or your settings have been lost.

AUTHENTICATION ACCESS PERMISSION DENIED

Authentication

(0x0301)

A user attempted to perform an action that has been denied by WinGate's policies.

You may need to verify that this was the correct action. If not, you will need to modify yourpolicy configuration for the service concerned, or modify the system policies.

CONNECTOID REMOVED

Dialer

(0x0401)

A previously known DUN (Dial Up Networking) connectoid has been removed from the operating system. This is no longer available for use by WinGate.

For Standard and Pro users,

Some settings in WinGate may have depended on the existence of this connectoid, and hence may now need to be modified. In particular, you should check:

  1. In the Dialer settings, if this connectoid was specified as the
    primary or secondary connectoid.
  2. For any services that on the Interfaces tab specified a specific DUN connectoid to use.
  3. For any TCP or UDP mapping services that had specific mappings dependent on this connectoid.
  4. Any rules in any service, or the default rules, that had criterion based on the state of this connectoid.

CONNECTOID ADDED

Dialer

(0x0402)

There is a new dialup connection available. Use the Dialer settings to configure it for use by WinGate.

NO VALID INTERFACES AVAILABLE

Services

(0x0501)

Whilst validating the configuration of this service, it was determined that no valid interfaces were available to be bound to this service.

The service will not operate.

If you feel this to be in error, you should consider the following :

  • DNS services cannot be bound to the localhost (127.0.0.1) interface.
  • DHCP services cannot be bound to localhost, nor any interface that has its address allocated automatically.

BINDING OPTION INVALID FOR SERVICE)

Services

(0x0502)

Whilst validating the configuration of this service, it was determined that the method of binding (bind to any, one specific, or multiple) was invalid for this type of service.

The service will perform an automatic binding sequence, and will bind itself to all interfaces that are:

a) valid for this type of service (classed as Internal)

b) NOT accessible by the Internet

NO SPECIFIC BINDING SPECIFIED

Services

(0x0503)

Whilst validating the configuration of this service, it was determined that although the binding option for this service specified that a single interface would be bound, that interface itself was not specified.

The service will perform an automatic binding sequence, and will bind itself to all interfaces that are:

a) valid for this type of service

b) NOT accessible by the Internet

This will not normally happen, and should not be a concern. It is used when new default services are created in the engine, for instance if you run just the engine without having performed an installation. Or, this may occur the first time the engine is run.

BINDING NO LONGER AVAILABLE

Services

(0x0504)

Whilst validating the configuration of this service, it was determined that a binding is no longer available, and so has been removed from this service binding list.

This typically happens when:

  1. An interface on your system has been removed
  2. Your IP address has changed. This may happen frequently if you use a DHCP server on your network to automatically allocate your IP address.

BINDING NOT VALID FOR SERVICE

Services

(0x0505)

Whilst validating the configuration of this service, it was determined that a binding was not valid for this type of service, and so has been removed.

You may get this message in the DHCP server if you change your TCP/IP settings from using a predefined IP address, to automatically getting an address from a server (using DHCP).

START UP ERROR

Services

(0x0506)

The service failed to start up completely. This is typically due to a port conflict where some other software on your system is using the same port number as the service in WinGate that failed to start.

Check the section in the help file on dealing with port conflicts, and running WinGate with other Internet server software.

DHCP NO PRIVATE INTERFACES BOUND

Dhcp Service

(0x0601)

The DHCP service has not been bound to any interfaces on your system that use a private IP address.

A Private IP address is a special address reserved for use on private networks, and cannot be used on the Internet.

It is strongly recommended that you use private addresses on your network. The DHCP service in WinGate will allocate IP addresses based on the IP address of the network adapter on your WinGate machine.

DHCP CLIENT DENIED NON PRIVATE ALLOCATION

Dhcp Service

(0x0602)

This will occur if your DHCP configuration denies allocating non-private IP addresses, and a DHCP request came in from a subnet using public addresses.

By default the WinGate DHCP server will not allocate public addresses. This is a safety precaution required especially if you are connected to the Internet through a cable modem provider.

If you use public IP addresses on your local network (discouraged) then you may need to either:

  1. Renumber your network to use private addresses. You can use WinGate's DHCP to help here.
  2. Change the configuration of the DHCP server to allow it to allocate public IP addresses.

If you choose option 2, you should check the bindings also, to make sure you do not bind the DHCP service to any externally accessible interfaces, else you may run into troubles with your ISP.

DHCP ACCESS DENIED

DHCP

(0x0603)

The client was denied access to the DHCP server.

If this is a client on your network, it machine may not function properly on your network, unless it has access to another DHCP server, or you can change its configuration to use a manually configured IP address.

DHCP NO ACCEPTABLE OFFER AVAILABLE

DHCP

(0x0604)

The DHCP server could not make an offer to the client.

BAD NAT DRIVER VERSION

NAT

(0x0701)

The driver used to provide NAT services to WinGate is not compatible with this version of WinGate.

You should contact your software vendor for an updated NAT driver.

NAT NETWORK ADAPTOR CHANGE

ENS

(0x0702)

A change in your network configuration has been detected. You must run the Network Setup Wizard to reconfigure your network; until you do so the network may not function properly.

Click Start, Select Programs, Select the Network Setup Wizard Group, Select the Network Setup Wizard item.

ENS DRIVER/NAT REFUSED LOAD (BOOT SAFETY)

ENS

(0x0703)

The ENS driver refused to load. This may occur if the system has failed to boot several times.

The ENS driver has chosen not to load after failing to communicate with the WinGate Engine on previous computer starts. This is a safety feature that can enable your computer to recover from a conflict, which may have been caused by the ENS.

Some of the common situations which can cause this are:

  • If you have just installed the ENS or a new version of WinGate then this probably means that the driver is conflicting with some other software or hardware on your computer. It may be possible to work around the problem or to obtain a newer version of the driver. Contact technical support for further information
  • If the ENS has been working previously but the addition of new hardware or software caused "blue screen" crashes, then you may want to re-enable the ENS, especially if you believe the problem has been fixed (e.g. the hardware has been removed again)·
  • If there were some incomplete or very rapid computer restarts, e.g. if you switched it off during the startup or selected the restart option immediately after it had started, then the WinGate engine may not have finished communicating with the ENS driver. Try re-enabling the ENS driver.The ENS driver can be enabled disabled in the ENS Configuration on the System Tab in GateKeeper. You will continue to see this message until the ENS is re-enabled or explicitly told not to load.

ENS DRIVER FAILED TO LOAD (UNKNOWN REASON)

ENS

(0x0704)

The ENS driver failed to load (couldn't do so)

This may mean that it is missing or has been disabled. The ENS driver was not loaded by the operating system despite apparently being configured to do so. This could mean that the driver file is missing, or that during a "safe mode" start you chose not to load it (its name begins with "QbikHk").

If you believe that the computer started up normally, then you may want to try re-installing the ENS driver, or contacting technical support.

NAT BUFFERS EXHAUSTED

ENS

(0x0705)

The ENS driver is running out of memory, and has switched off to avoid interfering with networking.

All ENS functions, including the firewall, have been disabled.

NAT MANUALLY DISABLED

ENS

(0x0706)

The ENS driver has been manually disabled. To re-enable it:

  1. Open GateKeeper
  2. Select ENS on the GateKeeper Control Panel.
  3. Select the General tab
  4. Make sure the Enable Extended Network Driver checkbox is ticked.
  5. Click Ok.
  6. Restart the computer to load the driver.

There is no Administrator password, this service is being reconfigured for local access only

Remote Control Service

(0x0801)

There was no password found for the Administrator account. This is a security risk. This service has been reconfigured to be available from the local machine only.

If you wish to keep accessibility to this service from external machines, you will need to specify a password for the Administrator account.

VPN ACCESS TO DOMAIN DENIED

VPN

(0x0901)

The user tried to join a domain in the VPN, and was denied access. The attempting users subnet will not form part of this domain, and this domain will not be available to them.

INFO NTUDB REFLECTED

user database

(0x0A01)

The NT User database was modified. %u NT users and %u NT groups were added to the WinGate User database.

INFO NTUDB NET API 32 DLL LOAD FAIL

user database

(0x0A02)

An error occurred while trying to initialise the NT User database support. The file NETAPI32.DLL may be missing or corrupt. Without this DLL, WinGate cannot syncronize with the NT User database.

INFO COMPONENT NOT SUPPORTED

(0x0B01)

The component \"(Component(s)\" is not of a supported type or is not licensed for your system.

SMTP RELAY DENIED

Mail Server

(0x0c01)

A relay attempt was discovered and blocked. If the relay attempts persist, you may need to take action against the perpetrators.

SMTP SILENT DISCARD

Mail Server

(0x0c02)

A relay attempt was discovered and silently discarded. If the relay attempts persist, you may need to take action against the perpetrators.

SMTP PROBE EMAIL RELAYED

Mail Server

(0x0c02)

A relay probe attempt was discovered. This has been forwarded for relaying, so that your SMTP server will still appear to be an open relay. If you wish to disable this, you should set the relaying action to deny rather than to silently discard.

FIREWALL ATTACK BLOCKED

Firewall

(0x0c04)

The firewall has blocked a connection attempt made to port from port.........known virus attack on this port.....

PLUGIN LICENSE INVALID

Plugins

(0x0c05)

The license for %s has expired or is invalid. %s functionality will not be available.

SMTP OPEN RELAY BLOCKED

Mail Server

(0x0c06)

SMTP DETECTED NON PROXY REQUEST

Mail Server

(0x0c07)

SMTP DEFAULTING TO COMPUTERNAME

Mail Server

(0x0c08)

HISTORY CORRUPTED

Engine

(0x0c09)


Advanced WinGate configurations

This is an advanced section for extra configuration of WinGate.

Most of the advanced configuration available in WinGate is done through the registry, with regedit.exe or regedt32.exe.

Care must be taken with any registry operations, as they are not readily reversible.

It is recommended that you back up the WinGate key before making any changes to the registry.

Registry Keys

WinGate saves all settings under the key:

HKEY_LOCAL_COMPUTER\SOFTWARE\Qbik Software\WinGate\

Here are the details of a few of the keys:

Key

Description

Cache

Contained here are the settings for the WinGate cache.

Default rights

This section contains the defaults rights that are normally accessed via the Default rights section in GateKeeper. If you accidentally lock out all access to any of the Access, Edit or Start Stop rights, then deleting the appropriate sub key will cause defaults to be used, and Administrators will have access as normal.

DHCP (DO NOT TOUCH)

Stored here are the current leases allocated by the WinGate DHCP server. Also stored is the Assumptions key, which stores details of assumptions based on Computer name.

ErrorStrings

The keys contained within each section contained here are the error messages strings that WinGate uses in the event of an error. You can customize the values held in these strings (don’t change the names themselves). You may wish to use more descriptive error messages, messages that tell a user who to contact, or translate then to another language.

These strings can be HTML files, the source its self, WinGate supplies the header so the body content is all that is required See below for more on this section.

Locations

This key holds sub keys relating to each IP based user assumption that you set in GateKeeper. Filter is the IP address, Internal filter is the IP expanded to contain all the 0’s and ? placeholders for wildcards.

MimeTypes

The values stored are in the format Name <extension-name> Value <mimetype>.

For example the mime type GIF would be stored with the name GIF and the value image/gif. You can create new mime types so that the FTP in WWW can show more file types. Simply add the name of the extension with its mime type, and add an icon to the resources directory.

This directory contains GIF files with the filename format .gif These GIFs are used as icons for FTP in the WWW proxy. You will notice common extensions such as .GIF, .jpg, .htm and .doc.

WinGate will look in that directory for .gif, and use it if it exists. If it does not exist, the default.gif file will be used, a blank page icon. Directories are shown with the directory.gif image.

You can customize your WWW FTP proxy by adding new icons such as bat.gif, an icon that could be used to represent batch files. You will notice that jpg.gif and gif.gif are identical. If you use another image type, you could introduce a new icon for that type, or make a copy of gif.gif to say img.gif. Netscape’s mime types are listed in the Options - general - helpers menu.

To add mime types for the WWW Proxy (used where WinGate is used as a WWW server, and also used for FTP in the WWW proxy), add values to the key:

HKEY_LOCAL_COMPUTER\SOFTWARE\Qbik Software\WinGate\MimeTypes

The name of the value should be the file extension for the relevant Mime Type. The string value should be the actual mime type.

e.g.

html="text/html"

exe="application/binary"

There are a number of MimeTypes built into WinGate already.

Services

All the WinGate Services are listed in this section with self-explanatory titles.

Settings

The directories used for Audits, Logging and Caching are configurable in registry. All changes to the registry settings for WinGate require the WinGate service to be restarted.

Audit Files

To change the directory of the audit files:

HKEY_LOCAL_COMPUTER\SOFTWARE\Qbik Software\WinGate\Settings\

create a value called AuditDirectory and set it to the path you want.

HTTPSearchOrder

This list of keys named FormatX contains the list of Site names that will be searched upon an HTTP requests.

WinGate will:

  1. Search for the site "%s", (eg wingate)
  2. If it cant find it, it will read the Format0 value and substitute the %s, e.g. wingate.com (This example will succeed)
  3. This process continues till a site is found that matches or there are no more formats.

The requested site is represented as %s.

Normally the HTTPSearchOrder key will have the following entries:

"Format0"="www.%s.com"

"Format1"="%s.com"

"Format2"="www.%s"

Dont specify a key for %s as WinGate always checks this first. You can add more sites. This would be a comprehensive search:

"Format0"="www.%s.com"

"Format1"="%s.com"

"Format2"="www.%s"

"Format3"="www.%s.net"

"Format4"="%s.net"

"Format5"=" www.wingate.com/Titles?qt=%s"

The last entry will direct the client to the search site if there is no site with any of the matching formats, and start a search with that keyword.

Log Files

To change the directory of the service log files:

HKEY_LOCAL_COMPUTER\SOFTWARE\Qbik Software\WinGate\Settings\

Create a value called LogfileDirectory and set it to the path you want.

Cache directory

To change the directory of the cache files:

HKEY_LOCAL_COMPUTER\SOFTWARE\Qbik Software\WinGate\Cache\

edit a value called CacheDirectory and set it to the path you want.

Notes on Paths:

If you want to use a network drive, you must use the UNC name, rather than any mapped drive letter, as these are only valid once a user is logged on.

\\servername\sharename\path

e.g

CacheDirectory="\\BEAST\C\Cache"

Error Messages

There are four areas where individual error messages can be configured.

Below is a list of the keys for those areas with some examples of individual available error messages that are configurable.

You most likely will not need to change these.

[HKEY_LOCAL_COMPUTER\SOFTWARE\Qbik Software\WinGate\ErrorStrings\HTTP]

"AccessDeniedTitle"="Access Denied"

"AccessDeniedDescription"="You do not have sufficient rights for access to this resource"

[HKEY_LOCAL_COMPUTER\SOFTWARE\Qbik Software\WinGate\ErrorStrings\SocketErrors]

"HostnameLookupFailed"="Host name lookup for '%s' failed"

"RecvLineTimeout"="Timeout in recvline function"

[HKEY_LOCAL_COMPUTER\SOFTWARE\Qbik Software\WinGate\ErrorStrings\SOCKS]

"AccessDenied"="SOCKS4 connect to %s:%u failed - denied by SOCKS server"

"NoResponse"="SOCKS4 connect to %s:%u failed - no response from SOCKS server"

[HKEY_LOCAL_COMPUTER\SOFTWARE\Qbik Software\WinGate\ErrorStrings\SSL]

"BadResponse"="SSLTunnelling connect to %s:%u failed - bad response from HTTP server"

Other keys

Warning:

Changing the following keys is not recommended. Windows likes to deal with these services itself. The preferred method for removing the service is in Uninstalling WinGate.

98/ME

In the Windows 95/98 versions the following key is used to run WinGate as a service:

HKEY_LOCAL_COMPUTER\SOFTWARE\Microsoft\Windows\Current version\Run Services\WinGate

Removing this key will prevent WinGate loading at startup. If you cannot access WinGate with GateKeeper to shut it down, removing or renaming this key and restarting will have the same effect.

NT / 2000

In NT/ 2000 service information for WinGate is stored in :

HKEY_LOCAL_COMPUTER\SYSTEM\CurrentControlSet\Services\WinGateEngine

In all versions:

HKEY_ LOCAL_COMPUTER\Software\Microsoft\Windows\CurrentVersion\App Paths\gatekeeper.exe is used to store the path of GateKeeper.

HKEY_CURRENT_USER\Software\Qbik Software\GateKeeper is used to GateKeeper settings.

Other information

  • If you accidentally delete WinGate configuration information that prevents you from accessing WinGate with GateKeeper, do not reinstall WinGate.

    There are two likely possibilities:

    1. You may have damaged your user account. If this is the case, log on as Administrator and rectify the information, or delete the user key in the registry. If you have damaged the Admin user, delete the Admin user in the registry.
    2. The other possibility is that you may have denied access to yourself. Either log on as an Administrator and reinstate your access, or edit the registry and look at the rules that may have prevented access to GateKeeper. Check the Remote control service rules, and System policies.

  • InfoWorld 10/20/97, page 31, in "The Bug Report" article, it mentions a registry fix for those using Novell NetWare Client 32 software and Internet Explorer 4. It mentions that IE 4 will work with proxy servers after making this change.

    The change is to add the registry key:

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\DontUseDNSLoadBalancing = (REG_DWORD) 1.

  • Various command line options are available with the WinGate.exe file.

    For a list of these options, from the command prompt type: wingate.exe -?

    One of the available command line options is –clean.

    This option will stop and uninstall the service, and delete all registry keys. Only use this option if you are sure you want to lose all your settings. If you have a faulty installation you can use this option, but you will need to manually reconfigure all settings upon reinstallation.


Testing TCP/IP

Ping is a popular utility that is installed as part of the TCP/IP protocol suite. It is used as a quick and easy method of finding out whether or not another computer is online and responding.

When you "ping" another computer's IP address (or ping by domain name), you are effectively sending out the message "Are you there?" (this consists of four ICMP packets).

If the computer is online and able to respond, it will then send a reply consisting of the same four ICMP packets.

If you try and use the ping command and it fails, you can use Event Viewer to check the event log and look for problems reported by Setup or the Internet Protocol (TCP/IP) service.

Testing TCP/IP on the Local Computer

You can test whether the TCP/IP installed on a computer is working properly by ‘pinging’ the loopback address on your computer.

You do this by opening a command prompt on the machine and typing: ping 127.0.0.1

If ping fails, verify that the computer has TCP/IP was installed and configured correctly.

Ping across the network

Begin by attempting to ping the WinGate server

At the command line type (replacing 192.168.0.1 with the IP of your WinGate server): ping 192.168.0.1

The response should be similar to:

Pinging [192.168.0.1] with 32 bytes of data

Reply from 192.168.0.1: bytes=32 time < =10ms TTL=32

Reply from 192.168.0.1: bytes=32 time < =10ms TTL=32

Reply from 192.168.0.1: bytes=32 time < =10ms TTL=32

Reply from 192.168.0.1: bytes=32 time < =10ms TTL=32

This is a confirmation that TCP/IP is working properly between client machine and the WinGate server. This result should be the same from any computer on the network. If this is the case, you can then move on to configuring TCP/IP settings for either the WinGate server or the client computer.

Note:

If you get:

Destination host unreachable

or:

Bad IP

then you need to check your TCP/IP settings as outlined previously.

Pinging a computer on the Internet

Note:

You will only be able to ping a computer on the Internet when you either:

  1. Know the IP address of the remote server, and have access to the Internet via a gateway on the local network.
  2. Have a DNS server able to resolve the DNS name of the remote computer to an IP address, and you have access to the Internet via a gateway on the network.

Since the WinGate server has the Internet connection it can act as the Gateway out of the network and provide DNS resolution if required. As such you can set the Gateway and DNS entries in the network properties of the client computer to the LAN IP address of the WinGate server for this test.

At the command line type (or any other reliable web site):

ping www.cnn.com

Running this test on any computer on the network except the WinGate server should produce this response:

Pinging cnn.com [207.25.71.29] with 32 bytes of data

Reply from 207.25.71.29: bytes=32 time < =10ms TTL=32

Reply from 207.25.71.29: bytes=32 time < =10ms TTL=32

Reply from 207.25.71.29: bytes=32 time < =10ms TTL=32

Reply from 207.25.71.29: bytes=32 time < =10ms TTL=32

This means that WinGate DNS is working properly. The DNS has looked-up the name, and returned the corresponding IP address for that name. It also indicates that you can reach the Internet since you received a reply from CNN.com.

Alternatively you can also ping the IP address of CNN.com to receive a similar response.


WinGate Glossary

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

A

Active service

An active service is a service that is running i.e. listening for TCP/IP requests.

Assumed users

Assumed users are users that are using WinGate services, have not logged in, but WinGate has some information about them. This information is either MAC address of the LAN card in their computer, or preferably the Net Bios computer name.

B

Binding

A binding is a ‘requirement to use’. In the case of a service (or protocol) to interface binding, it is a requirement for the service to use the specified interface. Binding a service to an interface causes the service to listen on the specified interface. WinGate services bind to all 'non-external' interfaces by default. Services only listen to interfaces for which they have a binding. WinGate eliminates the chance of binding to non-existent interfaces by listing only the interfaces actually on the WinGate server.

BSOD

(Blue Screen Of Death) When things go very wrong in Windows (it crashes), the last thing it does is dump the contents of its memory to a file. A blue screen will appear asking you to contact your system administrator. This screen is widely known as the infamous "Blue Screen of Death" and there is no recovery from it – you must reboot the computer.

C

Caching

The WinGate WWW Proxy performs HTTP caching. Caching is the process of storing recently accessed graphics, HTML documents or other files from the Internet on the WinGate server, to allow faster retrieval. The cache in WinGate checks documents daily to ensure they are up-to-date, and will get a new copy of the file if ‘Reloaded’ from a browser. The cache will not store URLs that have a ‘?’ symbol, i.e. CGI dependent documents.

Cascading

Using one proxy to connect via another proxy is called cascading. It is commonly done when an ISP has a WWW proxy for its customers to use. To cascade the WinGate WWW Proxy to the ISPs proxy, simply enter the ISPs proxy details on the Connection configuration of the WWW proxy, and select Through cascaded proxy server.

CGI

CGI (Common Gateway Interface) is an Internet standard for small programs (called scripts) that reside and run on the web server. They are most often used to process information sent from the user via an html form (edit, combo and list boxes on web pages) and are used extensively by search engines etc.

Client applications

Most applications make outgoing connections with other computers on the Internet to request services e.g. forward or retrieve email, retrieve a web page or file for viewing etc. These applications are the most common and include browsers like Netscape and IE, mail and ftp programs; they are called "client applications". It is also important to realize that a single computer can play simultaneously the roles of both client and server by running client and server applications.

Connection

A connection can mean several things. At a physical level it means a joining of two devices, by cable, plug or similar. With Modems, it means a connection made on a successful dialing of another modem. At an Internet software level it commonly means a channel of communication between the client and server has been established.

D

DHCP - Dynamic Host Configuration Protocol.

This is a service that automatically configures the TCP/IP settings for the client computers on your network.

Dialer

The dialer is software that tells the modem who and when to dial. WinGate has a built in dialer. DUN This stands for Dial-Up-Networking, a Microsoft term for the part of the operating system used to get modems to talk to each other in Windows.

E

Encryption

Encryption is the process of making data secure by making extremely difficult for any one but the intended user to decode.

Exclusions

In DHCP manual mode, excluded IP ranges allow the administrator to say "Don’t allocate these IP addresses to any computer. " An exclusion range must lie with in one of the scopes. The IP of the WinGate server will not be assigned. This is effectively exclusion.

ENS

Extended Network Support: Refer to NAT

F

Firewall

A firewall is a barrier between your network and the Internet, through which only authorized traffic can pass. As traffic passes between your network and the Internet it is examined by the firewall which follows the strict guideline of "whatever is not expressly permitted is denied." To create the rules by which your firewall allows and disallows traffic, simply select the different Internet services, IP addresses and hosts you wish to permit or deny. Most firewalls screen traffic between a company's internal network and the Internet, however firewalls can also secure one part of a network from another. For instance securing your corporate accounting department or your network from your subsidiary's network. FTP FTP stands for File-Transfer-Protocol. This is a method by which files are up/down loaded from the Internet. Many client applications exist to make the process easy.

G

GDP - Generic (or Gateway) Discovery Protocol.

This protocol is an IANA registered Internet standard, with an assigned system port number: 368. GDP is used for finding or discovering Gateway computers on a network.

Group

The ‘Group’ is a collection of users. Typically members of a group will share common characteristics, such as being in the same department of a company. If a rule applies to a group then the rule then applies to all members of that group. You might have ‘Administrators’, ‘Users’ and ‘Dial-in’ groups, each allowing different access rights. Users can belong to one, several, all or no groups.

H

Hosts file

The hosts file is a file that resides in the drivers directory of your Windows operating system. The hosts file maps host names to IP addresses. Hosts files are not necessary now that WinGate has DHCP.

HTTP

HTTP is the Protocol used for World Wide Web browsing, but many other programs are starting to use HTTP. The WinGate WWW proxy allows HTTP access to LAN users so they can view World Wide Web sites.

HTTPS

This is secure HTTP. Netscape and other browsers have built in encryption, to make data exchange more secure. This is commonly used for online purchasing, especially where credit cards are involved. Sometimes called SHTTP.

I

IANA

Internet Assigned Numbers Authority. This organization controls the assignment of IP port numbers. Port numbers below 1024 are referred to as System ports. Developers of server applications that use these ports must apply to the IANA for permission. Many port numbers are already assigned.

ICMP

Internet Control Message Protocol. This is a very low level extension to IP.

Interface

An interface is a ‘network connection’. That may be a network card, an online Dialer profile, or your localhost loopback.

IP address

An Internet protocol address is a unique identifying Internet locator.

IRC - Internet Relay Chat

This is a popular type of application that allows many users to ‘text-chat’ with multiple Internet users.

ISP

This stands for Internet Service Provider. ISPs are companies that have a connection to the Internet and provide dial-up or direct connections to customers. Typically ISPs have many modems that customers can dial up with a PPP account. Dialing up an ISP usually gives you direct access to the Internet. Many ISPs also offer ISDN T1, or other connections for improved speed.

L

Lease

The length of time for which a DHCP assigned IP can be used. Before the lease expires, the client must renew the lease with the DHCP server.

Leased line

A Leased line is a full-time network connection to the Internet where you are given an IP address (or a range of IP addresses) for your LAN. There are different methods of connection including ISDN, modem and Ethernet. Basically they give you guaranteed access to the Internet. Full-time connections are often called 24/7, meaning 24 hours, 7 days a week.

Licence

WinGate licenses are sold in different versions and counts. There are three versions of WinGate, Plus, Pro and Enterprise. A licence is obtained from a WinGate reseller. WinGate comes with a free built-in 1-user licence for evaluation. The user counts are : 2 3 6 12 25 50 and unlimited. This number represents the number of simultaneous access to the Internet via WinGate and it is not the number of computers on you network. It is common to have a network of over 10 users, but to have only a 6-user licence. This is a way of limiting Internet use.

Localhost

Localhost is a special term in TCP/IP. 127.0.0.0 is the localhost (loopback interface). This is a software only interface, internal to the stack itself, and it is not accessible over any interface.

LSP - Layered Service Provider

This system is part of Winsock 2 extensions. It allows chaining of certain Winsock functions. The WinGate Internet client is a LSP.

N

NAT

NAT(Network Address Translation) is a key feature of the ENS. The WinGate NAT acts as a router but substitutes its own external public IP address for the internal private addresses of its clients in the packets that it forwards. Thus enabling you to share an Internet connection amongst networked computers running virtually any application on any platform (including Windows, MacOS, Unix and Linux).

NIC

Network Interface Card.

Non-Proxy Request

When a program talks directly to a port as if it were a server without using the proxy protocol (i.e. method), it makes a non-proxy request. Most proxy servers cannot handle this request type, though some WinGate services can handle both types of requests.

P

Packet

A data packet is a like a ‘mail parcel’. Think of a package that gets sent in the post. There are a few things that you must have – they are the necessary requirements for mailing the parcel. There has to be a name and address for the recipient, a return address, then you need stamps, and of course the envelope or wrapping paper. But what you put in the parcel is up to you. You can send (within reason) anything that will be accepted by the post office. A data packet is very similar to this. You have to supply certain ‘wrappers’ like the "to and from" fields, but what is sent as the payload is up to you. There are different types of packets used on the Internet and other networks, but all of them use this idea of a parcel of data.

Ping

Ping is a command available on most TCP/IP capable systems including DOS. It is a command line program that tests a TCP connection between locations, and gives feedback on the speed of the link.

Click here to read about using Ping to test TCP/IP

Policies

WinGate policies and rights are available to allow the Administrator to control who can do what operations with WinGate configuration or access.

POP3

Used for retrieving mail from mail servers. It is a simple protocol that was preceded by the even simpler POP2, and the positively prehistoric POP. POP3 is used by Eudora and other mail clients to talk to POP3 servers in order to retrieve mail.

Ports

A port can be thought of as a channel of communications to a computer. Similar to telephones, it is like a company’s PABX that has several lines. Packets of information coming into a computer are addressed not only to that computer, but to that computer on a specified port. You can think of a port as a radio channel if you like, but the fundamental difference between a radio receiver and a computer, is that the computer can listen to any / all of 65000 possible channels at once! A Port is a logical TCP/IP connection. Any TCP/IP program needs to use a port to communicate with any other program or Computer. Certain ports are set aside for certain TCP/IP operation, e.g. 80 for HTTP.

Protocol

A Protocol is a method by which 2 or more parties can communicate or organize their communication. Network protocols are very strict. If an application does not follow the agreed style of communication, then they are unlikely to be understood. Protocol includes such things as greeting a server, logging on with a name and password, requesting and sending information, and saying ‘good bye’ when closing the connection. This is a similar idea as when one writes a letter. First one writes ones own details, then the recipients name and address, then you greet them with their correct title. Then the bulk of the letter is written. At the end, a suitable sign off such as ‘your sincerely’ and then a signature close the communication. Proxy servers typically need one proxy per supported protocol. Examples of Protocols are POP3 Post office protocol and http hypertext transfer protocol.

Proxy

The normal meaning of the word proxy is someone who does something on behalf of someone else, e.g. voting by proxy. The Internet use of the word means basically the same thing, in relation to a software program. WinGate does things on behalf of other software programs. Specifically WinGate makes Internet requests on behalf of Internet clients to Internet servers.

Proxy request

This is the action taken when a proxy aware program ‘talks’ to a proxy and asks for a resource.

R

RAS

Remote Access Service. An NT term similar to DUN. This is the modem control software in Windows.

Resource

A resource is a term used to mean any data item or hardware processing/storage. On a computer, resources are the memory, disk space, or processing time. An Internet resource is a Graphic, an HTML page, a downloadable file, live streaming video or any other available data.

Rights

WinGate rights and policies are available to allow the Administrator to control who can do what operations with WinGate configuration or access.

S

Scope

A Scope is a range of IP addresses sharing common properties. The DHCP servers Auto mode will use the 192.168.0.1 à192.168.0.254 scope. A DHCP scope comprises a group of computers running DHCP clients in a subnet.

Server application

Some applications ‘listen’ for incoming connections or requests to do something for other computer. These kind of programs are called "server applications" because they exist to provide services for other computers that request them. Common examples of these are web servers (serve requested html documents to clients), ftp servers (serve any requested files to clients) and SMTP/POP3 mail servers (store and forward email). Note that for a server application to ‘hear’ incoming requests from computers on the Internet it must be ‘bound’ to a port on a public interface (i.e. a port on the WinGate server).

Service

A service is something that helps or serves you. In WinGate, the proxies are services provided to help you connect to the Internet.

SMTP

Simple Mail Transfer Protocol is the method used on the Internet for sending mail.

SOCKS

SOCKS is a firewall negotiation protocol. WinGate has a SOCKS server built in.

SSL

SSL (Secure Socket Layer) is one of the two protocols for secure WWW connections (the other is SHTTP). WWW security has become important, as increasing amounts of sensitive information, such as credit card numbers, are being transmitted over the Internet.

Subnet

A subnet is a group of computers that are directly connected via coax or a hub. A computer with two network adapters will be on 2 subnets. However multiple virtual subnets can be on one physical subnet.

T

TCP/IP

TCP/IP stands for ‘Transmission Control Protocol / Internet Protocol’. TCP/IP (usually called TCP) is the standard method of sending data on the Internet. It is based on data packets that have a set format, including to and from addresses, similar to a letter. If you want to use the Internet or WinGate, it needs to be installed on every computer on your LAN. Actually TCP and IP are different protocols, but they are so tied up that they are usually referred to in this way.

Telnet

Telnet is a command line program used to access remote computer and run programs on them. Telnet was the method by which the Internet was first used. WinGate has a Telnet proxy.

U

UDP

User Datagram Protocol is a ‘Connectionless’ protocol. It uses IP to send Datagram in a similar way to TCP, except that like IP, and unlike TCP, UDP does not ensure the packets reach their destination.

Unix

Unix is an operating system like DOS that developed originally from a project at Berkley. Really it is a collection of operating systems that range from being identical to similar to totally incompatible. There are a number of ‘Official’ or common Unix systems. It is an OS used on typically large computers. While it is now recognized as being buggy clunky and ugly, it is flexible and can be more secure than most other available OS’s. Because of the differences in some systems, certain ‘Protocols’ were established. These protocols were like an intermediary language that both computers could use so they would understand each other. These Protocols were a ‘Standard’ that could be published, and anyone could write a program that could use that protocol, and it would understand any other program that used that protocol.

URL

Uniform Resource Locator. URLs are a standard format for describing where a resource is on the Internet. e.g. a Web URL reads as http://www.qbik.com/index.html This means use the HTTP protocol, when connecting to the server www.qbik.com to retrieve the index.html document.

Users

WinGate allows you to create user names (e.g. Tim, Ben, Adrien). This gives you control over who is able to access WinGate, what access they have, see how much data each user has used, and who can configure WinGate. These are users just as in Windows. There are two default users that cannot be removed: Administrator and Guest.

W

WGIC

WinGate Internet Client. This control panel applet provides Winsock redirection for the client computer.

WinGate engine

This refers to the program called wingate.exe. This program is the actual proxy server. You cannot see the engine running, as it is a Windows service.

Winsock

Windows Sockets. This is the part of Windows that provides Sockets for TCP/IP.

WRP

Winsock Redirection Protocol. WRP is the protocol used by the WGIC and WRS to provide Winsock redirection services.

WRS

Winsock Redirector Service. This is the service in WinGate that provides Winsock redirection.


About Qbik New Zealand

WinGate is owned and developed by Qbik, a software development company specializing in innovative Internet software solutions.

Our main office is in Auckland, New Zealand. You can find out more about Qbik and our other products on our web site at:

http://www.qbik.com

For any online WinGate support, you should see the following web site:

http://www.wingate.com

For sales, support, and general inquiries, see the Contact Information.

Lots of thanks go to the many WinGate beta testers and supporters for giving their time and energy towards making WinGate the product that we are most proud of.

Qbik New Zealand Limited


Contact information

You can get technical support from the dealer from whom you purchased WinGate. For purchasing, if you have obtained a trial key for WinGate you should purchase your license from the dealer who provided your license.

All other contact for WinGate is handled by the Authors, Qbik at the following URL:

http://www.wingate.com

Other inquiries may be made to:

info@wingate.com

Documentation for WinGate is being revised and improved continuously. Please visit the WinGate web site occasionally for updated documentation and other information.


Game play through WinGate

In order to play games over the Internet with WinGate, you must ensure that you adhere to both:

  1. The configuration specifications as set down in the manual of the particular game you wish to play.
  2. WinGate configuration specifications.

Note:

For most games, it is only possible for one WinGate Internet client to play at one time. This is because there is only one IP you are using to connect through GateKeeper. The game’s server only sees one player.

WinGate now supports Direct Play through ENS/NAT connections. WinGate will allow multiple connections to a game on the Internet.

With this in mind, follow these general instructions to play games through WinGate:

  1. Ensure your configuration settings are connecting you to the Internet through WinGate.

  2. Ensure GateKeeper’s Firewall setting is Medium: For games and Internet applications.

    Firewall Medium setting

    Close

  3. Install the game as per the manuals instructions. Pay special attention to any port it may require you to open in the firewall.
  4. For this amend any port information as necessary in the Port Security configuration in the Extended Network Services properties.


Installing TCP/IP

From Windows 98 upwards, Windows will have installed TCP/IP by default in nearly all circumstances.

If this is the case, you may not need to install it again but you can test to see that it is working properly. If you later have problems with TCP/IP, remove and reinstall the protocol using the steps below.

It is usually bundled free with your operating system.

Important Note:

  • If you have a working Internet modem setup then you already have TCP/IP installed and therefore this step may be skipped.
  • You may be asked for a disk to install the software from. This will be the CD or disk for your operating system (e.g. a Windows CD).

In Windows 95 or 98

  1. Press the Start button
  2. Select Settings /Control Panel
  3. Double-click the Network icon
  4. To install TCP/IP, click the Add...button
  5. Double-click Protocol, then select Microsoft
  6. Select TCP/IP and click OK.
  7. (** You will be asked to restart your computer **)

In Windows NT4

  1. Press the Start button

  2. Select Settings / Control Panel
  3. Double-click the Network icon

  4. To install TCP/IP, choose protocol
  5. Click Add

  6. Select TCP/IP Protocol and click OK.

(** You will be asked to restart your computer **)

In Windows 2000

  1. Press the Start button
  2. Select Network and Dialup Connections
  3. Double-click the Local Area Connection icon
  4. Click on the ‘Install...' button
  5. Select Microsoft, then TCP/IP Protocol
  6. Click OK.

(** You will be asked to restart your computer **)

©2008 Qbik New Zealand Limited


Installing Winsock 2

Some versions of Windows 95 will not have WinSock 2 installed (it is standard with later versions of Windows).

You will have to install it before you can install WinGate on this computer.

WinSock 2 provides your applications with special network functionality. You can download the WinSock 2 extension free of charge from the Microsoft web site (www.microsoft.com).