Administrator's Guide - Kerio Software Archive

Traffic Policy
Figure 7.37
Service definition without inspector protocol
Figure 7.38
This traffic rule allows accessing service without protocol inspection
Note: In the default configuration of the Traffic rules section, the Protocol inspector column
is hidden. To show it, modify settings through the Modify columns dialog (see chapter 3.3).
Warning:
To disable a protocol inspector, it is not sufficient to define a service that would not use
the inspector! Protocol inspectors are applied to all traffic performed by corresponding
protocols by default. To disable a protocol inspector, special traffic rules must be defined.
7.8 Use of Full cone NAT
However, many applications (especially applications working with multimedia, Voice over IP
technologies, etc.) use another traffic method where other clients can (with direct connection
established) connect to a port “opened” by an outgoing packet. For these cases, Kerio Control
includes a special mode of address translation, known as Full cone NAT. In this mode,
opened port can be accessed from any IP address and the traffic is always redirected to
a corresponding client in the local network.
Use of Full cone NAT may bring certain security risk. Each connection established in this mode
opens a possible passage from the Internet to the local network. To keep the security as high
108