6. Instructions and Troubleshooting

Instructions for Creating VPN Connections

Instructions for Creating VPN Connections

Instructions for Creating VPN connection in Ubuntu

Before setting up a VPN connection, in the user tree in the desired user’s card, check the box Allow remote access via VPN. To do this, go to Users -> User & Group:

1. Instructions for Creating VPN connection in Ubuntu.png

PPTP Protocol

Before creating a connection in Ubuntu, go to SafeUTM, Users -> VPN connections, and check the box PPTP Connection:
2. Instructions for Creating VPN connection in Ubuntu.png

Creating a connection in Ubuntu

1. Go to Settings -> Networks and in the VPN line, click (+):
3. Instructions for Creating VPN connection in Ubuntu.png

2. In the connection creation window, select Point-to-Point Tunnel Protocol (PPTP):
4. Instructions for Creating VPN connection in Ubuntu.png

3. In the Identification section fill in the following fields:

We recommend that you click Advanced and check the following:

4. Click OK and Add.
5. Set the switch of the created VPN connection to the Enabled position:
7. Instructions for Creating VPN connection in Ubuntu.png

IKEv2/IPsec Protocol

Before creating a connection in Ubuntu, configure SafeUTM:

1. Go to Users -> VPN connections.
2. Check the box IKEv2/IPsec Connection and fill in the Domain fields:
8. Instructions for Creating VPN connection in Ubuntu.png

3. Download the root certificate from Services -> TLS Certificates:
9. Instructions for Creating VPN connection in Ubuntu.png

The root certificate will be required to configure the connection of the user's workstation if the root certificate was not obtained via Let’s Encrypt. If necessary, transfer the certificate file to the workstation.

If a certificate issued by Let's Encrypt is used for a VPN connection, then installing a root certificate on the device is not required.

Creating a connection in Ubuntu

1. Open the terminal with the keyboard shortcut Ctrl+Alt+F1 and run the command: sudo apt install -y network-manager-strongswan libcharon-extra-plugins libstrongswan-extra-plugins
2. After the installation is complete, restart the computer: sudo reboot
3. Go to Settings -> Networks  and in the VPN line, click (+):
10. Instructions for Creating VPN connection in Ubuntu.png

4. In the window that opens, select IPsec\IKEv2 (strongswan):
11. Instructions for Creating VPN connection in Ubuntu.png

5. In Identification fill in the following fields:

Check the box Request an inner IP address and click Add:
12. Instructions for Creating VPN connection in Ubuntu.png

 6. Set the switch of the created VPN connection to the Enabled position.

SSTP Protocol

Before creating a connection in Ubuntu, configure SafeUTM:

1. Go to Users -> VPN connections.
2. Check the box SSTP Connection and fill in Domain and Port fields:
13. Instructions for Creating VPN connection in Ubuntu.png

Creating a connection in Ubuntu

1. Open the terminal with the keyboard shortcut Ctrl+Alt+F1 and run two commands:

sudo apt-add-repository ppa:eivnaes/network-manager-sstp
sudo apt install -y network-manager-sstp sstp-client

2. After the installation is complete, restart the computer: sudo reboot
3. Having installed the packages, go to Settings -> Networks, and in the VPN line, click (+):
14. Instructions for Creating VPN connection in Ubuntu.png

4. In the window that opens, select Point-to-Point Tunnel Protocol (SSTP):
15. Instructions for Creating VPN connection in Ubuntu.png

5. In Identification fill in the following fields:

We recommend that you click Advanced and check the following:

6. Click Add and set the switch of the created VPN connection to the Enabled position:
17. Instructions for Creating VPN connection in Ubuntu.png

L2TP/IPsec Protocol

Important: L2TP IPsec clients behind the same NAT may experience connectivity issues if there is more than one. We recommend using IKEv2 IPSec instead of L2TP IPsec.

Before creating a connection, configure SafeUTM:

1. Go to Users -> VPN connections.
2. Check the box L2TP/IPsec Connection and copy the PSK key:
18. Instructions for Creating VPN connection in Ubuntu.png

Creating a connection in Ubuntu

1. Connect the repository that contains the necessary packages to create an L2TP VPN connection, and then update the information about the repositories. To do this, run the following commands:

sudo add-apt-repository ppa:nm-l2tp/network-manager-l2tp
sudo apt update

2. Install the add-on to the standard NetworkManager using two packages: sudo apt install -y network-manager-l2tp network-manager-l2tp-gnome
3. After the installation is complete, restart the computer: sudo reboot
4. Having installed the packages, go to Settings -> Networks and in the VPN line, click (+):
17. Instructions for Creating VPN connection in Ubuntu.png

5. In the VPN connection creation window, select Layer 2 Tunneling Protocol (L2TP):
19. Instructions for Creating VPN connection in Ubuntu.png

6 . In the tab Identification fill in the following fields:

7. Go to IPsec settings and enable IPsec tunnel to L2TP host to activate the ability to configure other parameters:

The section Advanced is optional.
21. Instructions for Creating VPN connection in Ubuntu.png

Having finished configuring L2TP IPsec Options, click OK.

8. If necessary, go to PPR settings and configure Authentication, Encryption and Compression, and Other:
22. Instructions for Creating VPN connection in Ubuntu.png

After setting up PPR parameters click OK and Apply.

9. Set the switch of the created VPN connection to the Enabled position:
23. Instructions for Creating VPN connection in Ubuntu.png

Instructions for Creating VPN Connections

Automatic Connection Creation

Before configuring a VPN connection, in the user tree, open the card of the required user and set the Allow remote access via VPN flag. To do this, go to the Users -> User & Group section:

1. Automatic Connection Creation.png

L2TP/IPsec Protocol

Important: L2TP IPsec clients behind the same NAT may experience connectivity issues if there is more than one. Instructions can help solve the problem. We recommend using IKEv2 IPSec instead of L2TP IPsec.

You can run the following PowerShell script to automatically create a connection on users' computers running Windows 8.1 and 10. To do this, download the ready-made scripts for connecting your server from Users -> VPN connections.

The connection will be created with the following parameters:

  1. L2TP/IPsec protocol using a PSK key.
  2. The parameter Use the primary gateway in the remote network is disabled.
    LANs of the same class that was obtained for a VPN connection by default in Windows 7 and 10 will be accessed via a VPN connection, so you do not need to create additional routes (unless you use different network classes in the office LAN).

Create a file named safe_utm_l2tp.ps1 (in Notepad or Windows PowerShell ISE Editor) and copy the following text into it:

param([switch]$Elevated)
$currentUser = New-Object Security.Principal.WindowsPrincipal $([Security.Principal.WindowsIdentity]::GetCurrent())
if (!$currentUser.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator))  {
  if (!$elevated) {
    Start-Process `
            powershell.exe `
            -Verb RunAs `
            -ArgumentList ('-noprofile -noexit -file "{0}" -elevated' -f ( $myinvocation.MyCommand.Definition ))
  }
  exit
}
Enable-NetFirewallRule -Group "@FirewallAPI.dll,-28502"
Add-VpnConnection `
    -Force `
    -Name "SafeUTM L2TP VPN" `
    -TunnelType L2TP `
    -ServerAddress my.domain.com `
    -L2tpPsk "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" `
    -EncryptionLevel "Required" `
    -AuthenticationMethod MSChapV2 `
    -SplitTunneling $False `
    -DnsSuffix activedirectory.domain `
    -RememberCredential

Change the necessary parameters in it to match your settings:

You can run the script on the user's computer from the file context menu "Run with PowerShell". Click OK in the elevation dialog (the rights are required to allow access to shared files and printers).

After that, a connection will be created in the system and shared access to files and printers for all networks will be enabled (otherwise access to file resources in the local network may not be possible).

The user must enter their username/password at the first authorization.

Possible errors when executing the script

If the error "Script execution is disabled on this system" appears, you need to enable script execution by running the following command in PowerShell: Set-ExecutionPolicy Unrestricted

SSTP Protocol

You can run the following PowerShell script to automatically create a connection on users' computers running Windows 8.1 and 10. To do this, download the ready-made script from Users -> VPN connections.

The connection will be created with the following parameters:

  1. SSTP protocol using the PSK key.
  2. The parameter Use the primary gateway in the remote network is disabled.
    LANs of the same class that was obtained for VPN connections by default in Windows 7 and 10 will be accessed via a VPN connection, so you do not need to create additional routes (unless you use different network classes in the office LAN).

Create a text file named safe_utm_sstp.ps1 (in Notepad or Windows PowerShell ISE editor) and copy the following text there:

param([switch]$Elevated)
$currentUser = New-Object Security.Principal.WindowsPrincipal $([Security.Principal.WindowsIdentity]::GetCurrent())
if (!$currentUser.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator))  {
  if (!$elevated) {
    Start-Process `
            powershell.exe `
            -Verb RunAs `
            -ArgumentList ('-noprofile -noexit -file "{0}" -elevated' -f ( $myinvocation.MyCommand.Definition ))
  }
  exit
}
Enable-NetFirewallRule -Group "@FirewallAPI.dll,-28502"
Add-VpnConnection `
    -Force `
    -Name "SafeUTM SSTP VPN" `
    -TunnelType SSTP `
    -ServerAddress my.domain.com:4443 `
    -EncryptionLevel "Required" `
    -AuthenticationMethod MSChapV2 `
    -SplitTunneling $False `
    -DnsSuffix activedirectory.domain `
    -RememberCredential

Change the necessary parameters in it to match your settings:

  1. SafeUTM SSTP VPN – the connection name in the system (can be arbitrary).
  2. my.domain. com:4443 – SafeUTM external interface domain and the port on which you enabled SSTP.
  3. activedirectory.domain – your Active Directory domain (if there is no domain, you need to delete this line from the script).

You can run the script on the user's computer from the file context menu "Run with PowerShell". Click OK in the elevation dialog (the rights are required to allow access to shared files and printers).

After that, a connection will be created in the system and shared access to files and printers for all networks will be enabled (otherwise access to file resources in the local network may not be possible).

The user must enter their username/password at the first authorization.

Possible errors when executing the script

If the error "Script execution is disabled on this system" appears, you need to enable script execution by running the following command in PowerShell: Set-ExecutionPolicy Unrestricted

IPsec IKEv2 Protocol

You can run a PowerShell script to automatically create a connection on users' computers running Windows 8.1 and 10. To do this, download the ready-made script from Users -> VPN connections.

The connection using the script will be created with the following parameters:

  1. IKEv2/IPsec Protocol
  2. The parameter Use the primary gateway in the remote network is disabled. LANs of the same class that was obtained for the default VPN connection in Windows 7 and 10 will be accessed via a VPN connection, so you do not need to create additional routes (unless you use different network classes in the office LAN).

Create a text file named safe_utm_ikev2.ps1 (in Notepad or Windows PowerShell ISE editor) and copy the following text there:

param([switch]$Elevated)
$currentUser = New-Object Security.Principal.WindowsPrincipal $([Security.Principal.WindowsIdentity]::GetCurrent())
if (!$currentUser.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator))  {
  if (!$elevated) {
    Start-Process \`
            powershell.exe `
            -Verb RunAs `
            -ArgumentList ('-noprofile -noexit -file "{0}" -elevated' -f ( $myinvocation.MyCommand.Definition ))
  }
  exit
}
Enable-NetFirewallRule -Group "@FirewallAPI.dll,-28502"
Add-VpnConnection `
    -Force `
    -Name "SafeUTM IKEv2 VPN" `
    -TunnelType IKEv2 `
    -ServerAddress my.domain.com `
    -EncryptionLevel "Required" `
    -AuthenticationMethod EAP `
    -SplitTunneling $False `
    -DnsSuffix activedirectory.domain `
    -RememberCredential

Change the necessary parameters in it to match your settings:

  1. SafeUTM IKEv2 VPN – the connection name in the system (can be arbitrary).
  2. my.domain.com – the domain of SafeUTM external interface (A-record for the domain must refer to the IP address of SafeUTM external interface).
  3. activedirectory.domain – your Active Directory domain (if there is one if not, you need to delete this line from the script).

You can run the script on the user's computer from the file context menu "Run with PowerShell". Click OK in the elevation dialog (the rights are required to allow access to shared files and printers).

After that, a connection will be created in the system, and file and printer sharing will be enabled for all networks (otherwise access to shared folders in the local network will not be possible).

During the first authorization, it is necessary to enter the username/password.

Possible errors when executing the script

If the error "Script execution is disabled on this system" appears, you need to enable script execution by running the following command in PowerShell: Set-ExecutionPolicy Unrestricted

VPN connection errors

If a VPN connection using IPsec protocols in Windows is automatically terminated after 7 hours and 45 minutes and a "Group policy mapping" error or error 13868 occurs when connecting via IKEv2.

To restore the connection, the following actions are suitable:

1. Reconnect. In this case, the connection will be restored, but after 7 hours and 45 minutes, it will be automatically disconnected again. If you do not want the connection to be terminated automatically, follow the steps from the following paragraph.
2. Make changes to the registry:

If there is no parameter named NegotiateDH2048_AES256, then create it. To do this:

3. Restart Windows.

Instructions for Creating VPN Connections

Creating a VPN connection in Windows 10

Before configuring a VPN connection, in the user tree, open the card of the required user and set the Allow remote access via VPN flag. To do this, go to the Users -> User & Group section:

1. Creating a VPN connection in Windows 10.png

Creating a VPN connection in Windows 10

1. Click on the network connection icon in the system tray, and in the window that appears, select Network & Internet settings:
2. Creating a VPN connection in Windows 10.png

2. Go to VPN and click Add a VPN connection:
3. Creating a VPN connection in Windows 10.png

3. Fill in the following fields and click Save:

For PPTP

When setting up a VPN connection from the Internet, the following parameters must be specified in the VPN connection properties:

For L2TP/IPsec with the shared key

Important: L2TP IPsec clients behind the same NAT may experience connectivity issues if there is more than one. Instructions can help solve the problem. We recommend using IKEv2 IPSec instead of L2TP IPsec.

When setting up a VPN connection from the Internet, you need to specify the following parameters in the VPN connection properties:

If you are creating a VPN connection to UTM via port forwarding, we recommend following these steps:

  1. Open Registry editor.
  2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent and create a DWORD parameter named AssumeUDPEncapsulationContextOnSendRule and set it to 2.
  3. Restart Windows.

Possible problems

  1. The user's username or password is incorrect. Often, when reconnecting, it is suggested to specify the domain. Try to create alphanumeric passwords, preferably in Latin letters, for your accounts. If there are doubts, temporarily set the username and password as "user" and "123456".
  2. In order for the packets to go through the VPN tunnel, you need to make sure that in the settings of this connection the box Use primary gateway in remote network is checked in Configuring adapter settings -> Right-click on the connection -> Properties -> Network -> Properties of the option "Internet Protocol version 4 (TCP/IPv4)" -> Advanced. If it is not necessary to route all packets to this interface, then the route must be written manually.
  3. The connection takes place via DNAT, i.e. the external interface of SafeUTM does not have a "white" IP address, and the ports necessary for operation (500 and 4500) are "forwarded" to the external interface of the device located in front of SafeUTM and having a "white" IP address. In this case, the VPN connection will either not be established at all, or there will be periodic interruptions. The solution is to exclude the device before SafeUTM and specify a "white" IP address on the external interface of SafeUTM, to which L2TP/IPsec connections will eventually be made. Otherwise, use the SSTP protocol, because it is easier to publish it using port forwarding.
  4. If you reconnect via L2TP in Windows 10 OS, but use the invalid PSK key (by entering it in the advanced parameters [screenshot below]), the connection will still be established successfully. This is due to the features of the OS.

Make sure that the local network (or address on the network card) on the remote machine does not overlap with your organization's LAN. If it does, there will be no access to your organization's network (traffic through the routing table will go to the physical interface, not to the VPN). The address needs to be changed.

For SSTP

For IKEv2

When setting up a VPN connection from the Internet, you need to specify the following parameters in the VPN connection properties:

4. Activate the connection by left-clicking on the created connection and selecting Connect:
8. Creating a VPN connection in Windows 10.png

5. To disconnect, click Disconnect. If you need to change the created connection, click Advanced Parameters -> Edit.
9. Creating a VPN connection in Windows 10.png

VPN connection errors

If a VPN connection using IPsec protocols in Windows is automatically terminated after 7 hours and 45 minutes and a "Group policy mapping" error or error 13868 occurs when connecting via IKEv2.

To restore the connection, the following actions are suitable:

1. Reconnect. In this case, the connection will be restored, but after 7 hours and 45 minutes, it will be automatically disconnected again. If you do not want the connection to be terminated automatically, follow the steps from the following paragraph.
2. Make changes to the registry:

If there is no parameter named NegotiateDH2048_AES256, then create it. To do this:

 

3. Restart Windows.

If you do not want Internet traffic to go to external resources through SafeUTM after connecting via VPN, then in the properties of the VPN connection Network / Internet Protocol TCP / IP version 4 / Advanced, uncheck Use the default gateway on the remote network. Next, to access computers behind SafeUTM, manually enter routes.

Instructions for Creating VPN Connections

Creating a VPN connection in Windows 7

Before configuring a VPN connection, in the user tree, open the card of the required user and set the Allow remote access via VPN flag. To do this, go to the Users -> User & Group section.

1. Creating a VPN connection in Windows 7.png

Creating a VPN connection in Windows 7

L2TP IPsec clients behind the same NAT may experience connectivity issues if there is more than one. Instructions can help solve the problem. We recommend using IKEv2 IPSec instead of L2TP IPsec.

Before creating a VPN connection for SSTP, L2TP, and IKEv2 protocols, you must install the root certificate locally on the computer:

1. Download the Let's Encrypt root certificate from https://letsencrypt.org/certs/isrgrootx1.pem;
2. Click Start, find and run mmc.exe;
3. Click File -> Add or Remove Snap-in:
2. Creating a VPN connection in Windows 7.png

4. Select Certificates and click Add:
3. Creating a VPN connection in Windows 7.png
5. Set the flag in the computer account line, click Next -> Finish -> OK:
4. Creating a VPN connection in Windows 7.png
6. The Certificates (local computer) item will appear in the Console window:

Create a VPN connection

1. Select Network -> Network and Sharing Center:
5. Creating a VPN connection in Windows 7.png

2. Click Set up a new connection or network:
6. Creating a VPN connection in Windows 7.png

3. Select Connect to a workplace and Next:
7. Creating a VPN connection in Windows 7.png

4. Click Use my internet connection (VPN) and fill in the following fields:

Set the checkbox to Do not connect now, only install to connect in the future
8. Creating a VPN connection in Windows 7.png

5. In the Enter username and password window, fill in the appropriate fields;
6. Click Create, then Close;
7. In the Network and Sharing Center window, select Change adapter settings in the upper left corner:
9. Creating a VPN connection in Windows 7.png

8. Right-click on the created connection, and select Properties:
10. Creating a VPN connection in Windows 7.png

9. In the window that opens, do the following:

If necessary, fill in Additional properties

10. Click OK and close the Network and Sharing Center;
11. In the tray, click Network. A window will open with the created VPN connection;
12. Right-click on the connection and select Connect.

VPN connection errors

If a VPN connection using IPsec protocols in Windows is automatically terminated after 7 hours and 45 minutes and a "Group policy mapping" error or error 13868 occurs when connecting via IKEv2.

To restore the connection, the following actions are suitable:

1. Reconnect. In this case, the connection will be restored, but after 7 hours and 45 minutes, it will be automatically disconnected again. If you do not want the connection to be terminated automatically, follow the steps from the following paragraph.
2. Make changes to the registry:

If there is no parameter named NegotiateDH2048_AES256, then create it. To do this:

 

3. Restart Windows.

 

3. Restart Windows.

If you do not want Internet traffic to go to external resources through SafeUTM after connecting via VPN, then in the properties of the VPN connection Network / Internet Protocol TCP / IP version 4 / Advanced, uncheck Use the default gateway on the remote network. Next, to access computers behind SafeUTM, manually enter routes.

Instructions for Creating VPN Connections

Instructions for Creating VPN Connection on Mobile Devices

Before configuring a VPN connection, in the user tree, open the card of the required user and set the Allow remote access via VPN flag. To do this, go to the Users -> User & Group section:
1. Instructions for Creating VPN Connection on Mobile Devices.png

Connecting via the StrongSwan app

1. Click Add a VPN profile:
2. Instructions for Creating VPN Connection on Mobile Devices.png

2 . Fill in the fields:

3. Click Save and then click on the created connection.

Connecting on Android

1. Go to VPN in Settings -> Connections -> Other settings. If necessary, use the settings search bar.
2. Select the connection type and fill in the following fields:

For PPTP:

For IKEv2/IPsec MSCHAPv2:

For L2TP/IPsec PSK:

4. Click Save and activate the connection.

Connecting on iOS

1. Go to Settings -> General -> VPN:
5. Instructions for Creating VPN Connection on Mobile Devices.PNG.png

2. Click Add VPN configuration:
6. Instructions for Creating VPN Connection on Mobile Devices.PNG.png

3. Select Type and fill in the corresponding fields:

For PPTP:
Starting with iOS 10, Apple has removed support for the PPTP protocol.

For L2TP:

For IKEv2:

4. Click Done.
5. To connect, slide the Status switch to the right.

Instructions for Creating VPN Connections

Instructions for creating a connection in Mac OS

Before setting up a VPN connection, in the user tree in the desired users’ card check the box Allow remote access via VPN. To do this, go to Users -> User & Group:
1. Instructions for creating a connection in Mac OS.png

PPPoE Protocol

To configure SafeUTM, go to Users -> VPN connections and check the box PPPoE Connection:
2. Instructions for creating a connection in Mac OS.png

Creating a connection in Mac OS

1. Go to System Preferences -> Network.
2. Click Add in the lower left corner (icon +).
3. In the window that appears, fill in:

4. Click Create and fill in:

5. Click Connect.

IKEv2/IPsec Protocol

Configure SafeUTM:

1. Go to Users -> VPN connections.
2. Check the box IKEv2/IPsec Connection and fill in the Domain fields:
5. Instructions for Creating VPN connection in Ubuntu.png

Creating a connection in Mac OS

1. Go to System Preferences -> Network:
2. Click Add in the lower left corner (icon +).
3. In the window that appears, fill in the fields:

4. Click Create.
5. Configure the connection parameters:

6. Select Authentication settings.
7. Enter the identification data and click OK:

8. Click OK.
9. Check the box Show VPN status in the menu bar and click Apply.

L2TP/IPsec Protocol

Important: L2TP IPsec clients behind the same NAT may experience connectivity issues if there is more than one. We recommend using IKEv2 IPSec instead of L2TP IPsec.

Before creating a connection, configure SafeUTM:

1. Go to Users -> VPN connections.
2. Check L2TP/IPsec Connection and copy the PSK key:
9. Instructions for Creating VPN connection in Ubuntu.png

Creating a connection in Mac OS

1. Go to System Preferences -> Network:
10. Instructions for creating a connection in Mac OS.png
2. Click Add in the lower left corner (icon +).
3. In the window that appears, fill in:

4. Click Create.
5. Fill in the Server address and Account name:
12. Instructions for creating a connection in Mac OS.png

6. Check the box Show VPN status in the menu bar and select Authentication settings.
7. In User authentication fill in Password and in Computer Authentication fill in Shared Key (Shared Secret).
13. Instructions for creating a connection in Mac OS.png

8. Click OK -> Apply.

Turn on the VPN connection:

Instructions for Creating VPN Connections

Connecting Wi-Fi Keenetic Routers via SSTP

You can connect the user's home network to the VPN of the workplace network directly on the Keenetic router. (If you want to connect the office with Keenetic, follow the instructions).

All routers based on KeeneticOS 3.x.x are supported.

1. Configure the users in SafeUTM and enable SSTP in Users -> VPN connections.
2. Log in to the Keenetic web management interface: http://my.keenetic.net.
3. Install the SSTP client system component in the System components options menu.
01.png

For more information about the settings, see Keenetic documentation.

4. Create a connection: go to Internet -> Other Connections and click Add connection.
02.png

Don't check the box Use it to access the Internet.
Enter the connection name, SSTP protocol, server address (be sure to specify the port in the address separated by a colon), username, and password.

5. In Network Rules -> Routes add routes to your workplace network.
For example, if the office network is 10.0.0.0/8, add the following route.
03.png

Choose the VPN connection you created as Interface and check the box Add automatically so that the route is valid only when the VPN connection is active.

6. Configure DNS for your local domain (for example, Active Directory) so that you can access resources (files and other servers) by DNS names.

In Network Rules -> Internet Filter -> DNS Servers specify the DNS server of your domain controller and the domain name.
04.png

The setup is finished.

7. Use the ping utility in the command line to check communication and routing.

nslookup - to check the local names resolution of the working network.

If the VPN works, but there is no connection to some resources (for example, file or RDP), use the instructions to diagnose problems.

Access to Remote Networks via Router on LAN

Deleting Direct Routing Between Router and LAN Hosts

Let's say there is a router in the local UTM network that establishes communication with other networks (often using a tunnel). UTM is the default gateway for network clients. You want to set up routing on UTM so that clients can access the remote network through the router. To do this, the router and the clients of the local UTM network must be in different subnets. Otherwise, there will be an effect of asymmetric routing, due to which part of the traffic from clients to the router will go through the gateway, and part will go directly from the router to the network subscribers. Different routing on different traffic sections will make it impossible for packets to pass between two LANs.

A variant of the incorrect topology of such a network where there is a direct or asymmetric routing between the router and the clients of the local network:

SafeUTM is the gateway for LAN 10.80.1.0/24. This network has a router with the IP address 10.80.1.2, which has access to the remote network 192.168.10.0/24. It is required to provide access of the 10.80.1.0/24 network hosts to the 192.168.10.0/24 network and back.
1. Access to Remote Networks via Router on LAN.pngThe red arrow indicates two-way communication of the router with a remote gateway (or also a router), through which access to the remote network 192.168.10.0/24 is provided. This can be a tunnel to a gateway located on the Internet or a route to a router in a neighboring enterprise network.

The blue arrows indicate traffic sections from the hosts of the local UTM network 10.80.1.0/24 to remote network 192.168.10.0/24 through the UTM gateway with IP address 10.80.1.1 . Then the traffic goes through the router with the IP address 10.80.1.2, and a portion of the traffic returned to the LAN hosts from the router, bypassing UTM, which leads to the non-acceptance of such traffic by the LAN hosts.

In order for the scheme to work correctly, it is necessary to:

  1. Move the router to a separate LAN (DMZ) (for example, 10.90.1.0/24) to avoid direct routing between the router and LAN clients.
  2. Configure the DMZ on UTM by adding another IP address to the local UTM interface 10.90.1.1/24, to whose LAN the router is connected.
  3. On the router, configure the IP address from the address space of the new 10.90.1.2 network. Specify an additional IP address configured on the local UTM interface from this 10.90.1.1  network as the gateway.

Physically, the router and LAN clients will be in the same segment, while having different IP addresses and gateways.

You can also physically isolate the UTM clients’ LAN and router by connecting an additional network card to SafeUTM. Set up an additional local interface on it and a separate IP address in this network. The gateway for the router will be the address configured on the additional local interface.

Physically, the router will be located in the segment of an additional network card. However, as a rule, a scheme with virtual isolation of networks based on a single physical interface is enough.

The network topology after the DMZ organization is based on the creation of an additional 10.90.1.0/24 network on the local UTM interface is shown in the diagram below:
2. Access to Remote Networks via Router on LAN.png

Required UTM Settings

Several virtual LANs on one physical local UTM interface is set up in Services -> Network Interfaces. It looks like this:
3. Access to Remote Networks via Router on LAN.png

After isolating the router in the DMZ, you need to specify a route to the remote network on UTM.

The clients’ LAN has the address 10.80.1.0/24 , the router address in the DMZ is 10.90.1.2, and a remote network to which the router has access has the address 192.168.10.0/24. In this case, the UTM route will have the following parameters:

You can also add Source (SRC), in our case 10.80.1.0/24, but this is arbitrary. Now traffic between UTM networks (10.80.1.0/24 and 192.168.10.0/24) in all directions will be routed via UTM and router.

Always avoid specifying the 0.0.0.0/0 network in routes.

Settings on Client Machines

Hosts of the networks that the UTM now serves (10.80.1.0/24 and 10.90.1.0/24) are physically included in one ethernet segment. The gateway and DNS server for the hosts of these networks is the address corresponding to the network on the local UTM interface. For example, for a host with the address 10.80.1.10, the gateway and DNS will be 10.80.1.1, and for a host with the address 10.90.1.15, the gateway and DNS will be 10.90.1.1 .

What to Do if Your IP is Blacklisted by DNSBL

If you are using a public static IP address, then an IP address being in the blacklists may mean that bot activity, participation in DDoS attacks, or spam mailing has been recorded in your network.

The presence of a dynamic IP address from the "home" IP address ranges of providers in blacklists is generally normal, because malicious activity in this case may not be coming from your network.

Steps to Follow When on Blacklist

  1. Find out the reason for getting into the DNSBL list. Often the service names a specific virus or network worm and its features - the ports used, and protocols. Follow the service recommendations.
  2. Activate the intrusion prevention system on your gateway. Analyze the logs and the presence of requests to the botnet command centers.
  3. Check all computers in your network with an antivirus. Make sure that the antivirus protection is activated, the databases are updated (as a rule, viruses interfere with updating databases or the work of antivirus software).
  4. After treating infected computers, send a message to the DNSBL service with a request to exclude your IP from the blacklist.

SafeUTM

Our solution has all the functionality that provides maximum protection from spam bots, and botnet clients, and the prevention of viral activity in your network.

A 40-day trial version is available for up to 10,000 users.

Get SafeUTM

How to Restore Access to SafeUTM

If you lose the Administrator’s password, you can reset it if you have physical access to the server.

To do this, follow these steps:

  1. Reboot the server. When the GRUB bootloader menu appears with the choice of the Linux kernel to boot the system, press E on the keyboard.

    1. How to Restore Access to SafeUTM.png

  2. The kernel parameters window opens with the possibility of editing. Add the text p=1 as in the screenshot below:

    2. How to Restore Access to SafeUTM.png

  3. Press the Enter.
  4. After reloading the system again, a window for creating an administrator’s account will appear. Set a new administrator’s username and password.

    3. How to Restore Access to SafeUTM.png

Requirements for creating an administrator’s password:

If the password does not meet the requirements of the security policy, an error window will open. You need to click "OK" and enter a new password, taking into account the requirements for creating passwords.

4. How to Restore Access to SafeUTM.png

If, when creating a new administrator’s username, it matches the previous one, an error window will open. Create a different administrator’s username.

5. How to Restore Access to SafeUTM.png

How to Restore to Previous Version after Updating SafeUTM

We recommend using this feature if SafeUTM does not work correctly after an update.

It is possible to restore to the previous version after updating SafeUTM from version 13.0.

When updating UTM to version 13.0 and higher, all the information of the version you are updating from will be saved on the UTM disk. To restore, follow these steps:

1. Go to SafeUTM local menu.
2. Enter the administrator’s username and password.
3. Enter 15 and press Enter:
1. How to Restore to Previous Version after Updating SafeUTM.png

A window will appear with a warning and a description of the version to which it will restore.

4. Confirm your choice by typing y and pressing Enter.
5. After rebooting, SafeUTM will restore to the previous version.

The previous version will be restored with the settings and logs that were in SafeUTM at the time of the update.
When restoring the previous version, settings and logs from the updated version are not transferred to the previous version.

Choosing Hardware Platform for SafeUTM

Information about Software Platform

SafeUTM is a Linux operating system installed on a server or virtual machine. SafeUTM is based on Fedora 31 and contains a Linux kernel with a set of drivers from this OS with minor changes on our part. Thus, SafeUTM supports most of the hardware supported by Fedora 31.

General Recommendations for Chipsets and Manufacturers

Having worked for years with client servers, we can identify several patterns:

Hardware Platform Power Selection

The number of GHz of the processor and the amount of RAM of the server strongly depend on the load imposed on SafeUTM. When calculating the load, it is necessary to consider three factors:

The minimum system requirements satisfy the low involvement of UTM services serving a small number of authorized users. With a larger number of users (50 and more) and services served on SafeUTM, pay attention to the recommended and maximum system requirements of the server.

Disk Subsystem

RAID arrays are not required for typical UTM usage schemes. One modern 200 GB SATA hard drive is sufficient in most configurations. In the case of a heavily used mail server on SafeUTM, we recommend connecting a separate hard drive to store mail correspondence. We recommend using Western Digital brand devices. We do not recommend using disk devices of the Green or Eco series, since their speed and energy indications are artificially understated and they are not suitable for use on servers. Using SSD drives is also possible and recommended. We recommend using Micron brand devices.

Support of Outdated Encryption Algorithms

SafeUTM is based on Fedora operating system. In Fedora 33, which was used in the previous SafeUTM version, the current system-wide encryption policy has been updated to further disable outdated cryptographic protocols (TLS 1.0 and TLS 1.1), weak Diffie-Hellman key exchange sizes (1024 bits), and the use of SHA-1 hash in signatures. You can read more about changes in the algorithm policy in the article.

Outdated algorithms, like (cryptographic) hashing and encryption, usually have a lifetime after which they are considered either too risky or even unsafe to use.

You may have problems related to HTTPS, for example, when running OWA (web interface for accessing Microsoft Exchange). If you encounter this, follow these steps to switch to the encryption policy levels compatibility mode:

  1. Log in to the SafeUTM console. This can be done from the local menu, SSH, or SafeUTM web interface.
  2. Enter update-crypto-policies --set DEFAULT:FEDORA32 the command in the terminal.
  3. Reboot SafeUTM.

We strongly do not recommend using this setting, since after the next update of SafeUTM compatibility mode settings will be reset. And in newer versions, this feature will be disabled.

Configuring Proxifier for Direct Connections to Proxy Server

When using direct connections to a proxy server, access to the Internet will be supported by all programs that have proxy server settings, or by programs that use proxy system settings (from Internet Explorer).

However, some software does not have proxy server settings, which is why it is necessary to use specialized software on end workstations to output such programs to the Internet.

Setup

Perform standard browser settings for direct connections to the proxy server, and then configure the program to redirect the rest of the traffic to the proxy server.

In the proxy server settings in Proxifier, enter the IP address of the local SafeUTM interface and the port specified in the proxy settings for direct connections (see the proxy server documentation). Protocol type: HTTPS. Authorization settings are optional.

image-1661639814075.png

After adding a proxy server, answer yes to questions about creating rules for redirecting traffic to it.

You can also edit these settings later:

image-1661639836174.png

The setup is finished, and the programs will access the Internet through the specified proxy server.

Blocking Popular Resources

Blocking Remote Access Programs

TeamViewer

TeamViewer can be blocked using the Application control module.  To do this, select the protocol of the same name in the rule for users or groups.
1. Blocking Popular Resources.png

Blocking Anonymizers

You can block anonymizers in Traffic rules in three ways:

  1. Anonymizers working over HTTP(S) can be blocked using the Content Filter module (Anonymizers category).

    2. Blocking Popular Resources.png

  2. To block VPN anonymizers using the PPTP protocol, as a rule, it is enough to block the GRE protocol in the Firewall rules.

    3. Blocking Popular Resources.png

  3. To prohibit circumvention of the content filter, we recommend creating a rule prohibiting direct requests to IP addresses in the Content Filter.

    4. Blocking Popular Resources.png

Blocking Opera Turbo, Opera VPN, friGate, Anonymox, Browsec

You can block data and some other plugins (anonymizers) and browser functions that are often used to bypass content filtering using the Intrusion Prevention module. To do this, in the tab Rules activate the Anonymizers rules group and a separate group of Opera VPN rules to block the service of the same name.

Attempts to bypass content filtering using this software will be recorded in the intrusion prevention system log, after which they will be blocked. An example of the output of information displayed in the intrusion prevention system log is presented below:

Blocking TOR

Tor is a proxy server system that allows you to establish an anonymous network connection to bypass content filtering.

Tor is a specially developed software and proxy server environment designed to bypass various kinds of blocks, which is why it is currently not possible to completely block it.

To counter the use of the Tor network, as well as to log attempts to connect to it and use it, you need to do the following:

1. Enable the Intrusion Prevention system and activate the Blocking attacks category in it, which allows you to block connections to the input nodes of the Tor network.

2. Enable Application Control and add a Tor application prohibiting rules to a specific group or all users:
6. Blocking Popular Resources.png

Blocking Torrents

BitTorrent is a P2P protocol designed for file sharing over the Internet.

To significantly limit the possibility of using torrents, you need to perform the following settings:

1. Prohibit BitTorrent protocol using a rule in the Application Control module.
7. Blocking Popular Resources.png

2. Use the policy Prohibit all except what is allowed when configuring the firewall. Allow the necessary TCP and UDP ports to users by making the last rule prohibiting.

3. Prohibit torrent file directory sites using the Content Filter module by prohibiting the Torrent Trackers category. And prohibit downloading files with the extension .torrent.
8. Blocking Popular Resources.png

4. Enable the Intrusion Prevention system and activate the category Requests to compromised resources in it, which allows you to block the activity of P2P programs.

Transferring Data and Settings to Another Server

In order to transfer the installed SafeUTM from one server to another with all the settings saved, follow these steps:

Step 1: Copying backups from the server

Go to Server Management -> Backup -> create a backup of the server settings. Download the created copy to your computer by clicking Download in the column Operations.

Step 2. Installing SafeUTM on a new server

Installation instructions: Installation Process.

Step 3: Transfer backups to a new server

Go to Server Management -> Backup of the server web interface, click on the Add backup button -> Download from file, and select the backup downloaded at the first stage.

Step 4: Restoring the database from backups

Click Apply in the column Operations. The system will be rebooted to apply the server settings.

Transferring Mail Server Data

To transfer data with the transfer of mail to a separate disk, follow these steps:

1. Download all mail from /var/mail/ folder to external storage. This can be done using various programs for copying files between a local computer and a remote server (for example: rsync, WinSCP, ssh scp, etc.).
2. Install the latest version of SafeUTM from the boot image to the physical disk.
3. Connect the second physical disk that will be used for storing mail.
4. In the SafeUTM web interface, go to Mail Relay -> General Settings, select a disk for storing mail, and format it.
5. Allow SSH access from local networks in Server Management -> Administrators.
6. Connect to UTM, for example, using the WinSCP program, and copy all the mail along the path /var/mail/ .
7. After copying the mail files, you need to run the command chown -R mail-backend:mail-backend /var/spool/mail/. This command changes the owner and group for mail files so that the dovecot mail daemon can have access to these files.

If the mail has already been moved to a separate disk, connect it to UTM and jump to step 7.

Troubleshooting

Troubleshooting

Error ERR_CONNECTION_TIMED_OUT When Opening Site or Site Does Not Open

Step 1. Check if the site opens in Allow Internet to all mode:

If the site does not open, check if the site opens on another device from the same IP address:

1.1. If it doesn't, we recommend contacting your provider. Most likely, the provider blocks the IP address or website address.
1.2. If the site opens, contact technical support.

Step 2. Check if the site is blocked by the Intrusion Prevention system.


If the site has opened, find the number of the blocking rule in the logs and add the rule number to IPS -> Exceptions.

Step 3. If the previous paragraph did not help, check whether the site is blocked by a Content Filter rule. To do this:

If the site opens, you can find the blocking rule by dropping the test rule down the list.

If the blocking rule has not been found, proceed to the next step.

Step 4. Determine the blocked domain or IP address (let's take Firefox as an example):

Pay attention to the status codes 4xx and 5xx; it is these requests that are blocked either by UTM or by higher-level services.
Determine which category of the content filter a particular name belongs to. To do this, go to Traffic Rules -> Content Filter -> URL for categorization:
4. Error ERR_CONNECTION_TIMED_OUT When Opening Site or Site Does Not Open.png

If you failed to solve the problem, please send the following to technical support:

1. Screenshot of the error in the browser.
2. Screenshot of sorted errors from Firefox so that problematic domains or IP addresses can be seen (changed).

Obviously reliable services can be added to Services -> Proxy -> Exceptions in the tab Destination networks.
It is not recommended to add the addresses of your network's clients to the exceptions, since in this case their web traffic will not be filtered by the content filter rules and will not be included in reports.

Troubleshooting

What to Do If Internet Does Not Work

Step 1. Check user parameters

Make sure that the user being checked is logged in to the server. Possible user statuses are described in the chapter User Tree.

Step 2. Checking the user's computer

Run ping command from the user's computer to address 8.8.8.8: Start -> Run, enter the command cmd, in the window that appears enter ping 8.8.8.8.

Step 3. Checking Internet access on the server

Go to Terminal in the web interface: run the command ping 8.8.8.8, to stop ctrl+c.

If the ping fails:

If the ping passes, go to Step 4.

Step 4. Checking the firewall
Step 5. Checking web traffic

If the user receives responses to echo requests with the command ping both by domain name and IP address, but there is no web traffic:

If you failed to solve the problem, please send the following to technical support:

1. Take screenshots of the user’s tab General in an expanded form and contact us via the support portal or email us at support@safedns.com.

2 . Enable Remote Assistant mode and contact technical support: https://www.safedns.com/resource/support-ticket.

Troubleshooting

Authorization error "The browser is outdated"

If you are using a browser that does not support UTM, then the error Your browser is outdated will appear during authorization. This version of the browser is not secure and unsupported by modern web technologies. Please install the latest version of one of the listed browsers.

Supported Browsers:

We recommend updating your browser to the minimum supported version.

To continue authorization despite the risks, you will need to click I understand the risks and wish to continue.