Policy Logic

[ngtech]

Dear All,
I am having difficulty understanding how wingate policy works.
Just to list one of them, setting System Policy to
Server name = MailServer AND server port = 110.
When I do "telnet MailServer 110", it fail to connect to the port.

When I change the server name to its IP by setting System Policy to
Server IP = xxx.xxx.xxx.xxx AND server port = 110.
I can connect to the port using "telnet MailServer 110"

P/S: I only set policy using system policy except DNS & DHCP which is set to everyone unrestricted rights.

Pls kindly advise.

Regards,
CL

[jamesc]

Is this with the NAT or WinGate Internet Client connection method?

The DNS is resolved on the LAN Client, and then the IP Address is sent to the WinGate server; hence the IP Address policy worked, but the server name does not. *You also need to be careful when using "Equals" server name as you have mentioned in your post; I usually use "Contains" unless I am absolutely certain.

*If you were to use the Proxy connection method, it would work, because the DNS is resolved on the WinGate server.

[ngtech]

With the correct logic, now everything behave so logically. Thanks!

[ngtech]

Here is the another one.
I set in System Policy allow only DHCP clients to surf net but it seem that manually assign IP also can surf net.

What is the logic?

[jamesc]

1. Do you have any other policies in your system policies; the least permissive policy will be allowed through.

2. How did you create the policy to only allow access from DHCP Clients?

3. Is WinGate the DHCP server?

4. Is the server / service the clients are connecting to with static ip addresses, are they set to check the default rights? Below is an example WWW Proxy Service, and the setting that can be changed regarding the Default Rights (System Policies)




"Are Ignored" = Do not check the policies in the Default Rights (System Policies)

"May be used instead" = If the WWW Proxy Denies access to the request, then check if the System Policies allow it; if it does, grant the user access.

"Must also be granted" = If the WWW Proxy allows the request, then it must also be allowed in the System Policies.

[ngtech]

A1. Other than DHCP, DNS & Remote Control, all set to follow system policy. (No one is granted in service policy with default rights may be used instead.)

A2. In system policy, properties for recipients, under specify which requests this recipient has rights for, Client is a DHCP client is TRUE. This is the only rules.

A3. Yes

A4. I think A1 is the answer you ask.

P/S: I assign the policy by group, each user only assigned to 1 group.

[jamesc]

Thanks for the details.

A1. Other than DHCP, DNS & Remote Control, all set to follow system policy. (No one is granted in service policy with default rights may be used instead.)

---> Ok, thanks for that. Just confirming you have the correct policies / system policy usage for these services:
(NAT) GateKeeper --> Extended Networking Service --> Policies:
(WGIC) GateKeeper --> Winsock Redirector Service --> Policies:
(Proxy) GateKeeper --> WWW Proxy Server --> Policies:
(Socks) GateKeeper --> Socks Proxy Server --> Policies:

Has the default rights to "May be used instead", and there are no Groups or users policies in those particular services/servers.

A2. In system policy, properties for recipients, under specify which requests this recipient has rights for, Client is a DHCP client is TRUE. This is the only rules.

So your policy looks like this.






If you cannot resolve, then I think we will need to look at your settings; I just created the policy on WinGate 6.1.3 shown above and it worked as expected.


1. WinGate Registry.
GateKeeper --> Options menu --> Advanced --> Save Registry

2. WinGate Config Report
GateKeeper --> Options menu --> Advanced --> Save Config Report

3. ipconfig/all from the WinGate Server
(Windows) Start menu --> Run --> cmd --> ipconfig/all >> C:\ipa.txt

[ngtech]

BTW, I foresee in the future I might use Windows Server DNS & DHCP. Will it cause any sacrifaction of features?

[jamesc]

If you use Windows DHCP, then you will not be able to use the following policies:

1. DHCP Client policies
2. MAC Address policies
3. Computer name policies


With regards to DNS:
If you are in an Active Directory network, it is a MS Requirement for the LAN Clients to have their DNS pointing towards the AD DNS server. If WinGate has the AD DNS Address on its network card as well, then we usually recommend excluding that from WinGate’s DNS lookup process; to do that you add the AD DNS address into:
(Windows) Start menu --> Programs --> WinGate --> Advanced Options --> DNS

When using an AD DNS for internet resolution, usually you need to forward it to another DNS server; it could be WinGate’s DNS, the Hardware routers DNS or the ISPs DNS.

[ngtech]

Jamesc, can I have your email pls?

[jamesc]

Sure, I believe you can see the email button below my post?

Actually, t is probably best to send to our support desk, so if I am not available, my other colleagues can answer.

http://support.qbik.com/index.php?_a=tickets&_m=submit

[ngtech]

I can't submit cause I haven't buy the license yet. I can't see the email button as well.. because of evaluation user also?

[jamesc]

jamesc -at- wingate.com

[ngtech]

I already sent you the attachment. In the mean time can I know what is syn cookies? What does it do?

[jamesc]

WWW Proxy. No users in policies and the default rights may be used instead.
Extended Networking Service. No users in policies and the default rights may be used instead.


So you have four different policies in the default rights.

1. Admin Group, full access. Must be Authed
2. Group1 Must Be DHCP Client. May be Authed
3. Group2 Must Be DHCP Client. May be Authed
4. Guests, limited access. May be unknown


a) Are the people with static’s just testing with the addresses that the guests can access?
b) Are the static ip addresses logged in with the Administrator user?
c) What user is shown in the Activity tab of GateKeeper when the Static IP Addresses connects?

[ngtech]

a. Actually I am testing if the policy is functioning. I assigned a range of IPs that can access internet. (Assumed Users). So I want to make sure user that manually assigned themselves these range of IPs won't granted access.

b. They are logged in as a user under Group1.

c. It shown the static IP as a user that is under group1(Assume).

[ngtech]

Find out the solution yet?

[ngtech]

What is going on??

[jamesc]

Sorry for the delay. I will look at this on Monday when I am at work.

[jamesc]

Client is a DHCP Client = True.

This is based off what IP Addresses have been previously distributed by WinGate’s DHCP Server; not who it had been distributed to.

*I also thought it worked as you expected, sorry for my mistake and delay.

**Also, I noticed that in some of your BAN Lists, you are using "Equals windowsupdates.com"; I would suggest using "Contains windowsupdate.com"

[ngtech]

Hi, that means it is not possible to make it like only PCs that are using DHCP granted the permission? I think it is a quite useful condition to have.

Client is a DHCP Client = True.

This is based off what IP Addresses have been previously distributed by WinGate’s DHCP Server; not who it had been distributed to.