• Open your registry editor
• Find and delete the following key:
  HKEY_LOCAL_MACHINE\Software\Qbik Software\WinGate\Data Scanning Plugins\Installed\AntiVirus
• Restart the WinGate engine

1. Open GateKeeper on the WinGate Server.
2. Open the FTP Proxy Server under the Services tab.
3. Select the Bindings tab.
4. Select the Allow connections coming in on any interface radio button.
5. With the FTP Proxy Server config still open select the Non-proxy Requests tab.
6. Select the Pipe requests through to predetermined server radio button. Here you should enter the IP address of the computer, which the FTP server is running on behind WinGate, to which all FTP requests from the Internet will be directed.
7. Enter the port the FTP server has been configured to listen on.
8. Select OK as you exit out of the FTP proxy service
9. Save changes in GateKeeper.

1. Open GateKeeper on the WinGate server
2. Open Extended Network Services under the System tab.
3. Select the Port Security tab.
4. Click the Add button.
5. On the port configuration dialog select Connections from the Internet and TCP as the protocol.
6. Enter Port 21 or designated FTP port (as required) on the FTP server.
7. Select the Redirect packet to this IP address option, specifying the IP address of the machine running the FTP server. In this scenario if the FTP server is listening on a different port such as 2121 the Override port option should be used.
8. Click OK to exit the Extended Networking Services.
9. Save changes in GateKeeper.

• Configure them both to use the same Port but on separate Network interfaces:
  (Requires the WinGate server to have two Network Interfaces).
  
  Port conflicts will only happen between two applications when they are listening on the same port on the SAME interface.
  
  In most common scenarios where Application servers are running on the same machine as WinGate, the machine will generally have two Network Interfaces, one with a private (internal) address and one with a public (external) address.
  
  When this is the case the Application server program can be configured to use its required port on the External interface, as it will usually only be accepting requests from the Internet and so only requires the use of the External IP address.
  
  The reverse is true for the corresponding WinGate proxy service, as it will usually only be accepting internal client Internet requests on this port through its Private interface.
  
  As long as the appropriate binding is set (external interface for the Application server program, and internal interfaces for the WinGate proxy service in question) then there should be no issues with port conflicts.
  
• Change the port for the Proxy service to run on.
  This is a problem for example if the WWW Proxy Server and a Web server are both running on the same machine using port 80. If you change the port on the WWW Proxy Server in WinGate to say 8088, this conflict will be resolved.
  
  The disadvantage to this is that clients using the Proxy connection method will have to connect specifying port 8088 in their web requests for WWW to work properly.
  
  An alternative and easier way to resolve this is to change the port the Application server is configured to receive requests on rather then altering the Port of the particular Proxy service in WinGate.
  
  For example configure the FTP server to listen on port 2121 instead of Port 21. You can then use the Proxy service to receive these Internet requests on behalf of the FTP server and (through the use of the Non proxy request setting) pipe them directly to the server concerned without having to alter the FTP proxy service configuration.
  

1. Open GateKeeper on the WinGate Server.
2. Open the FTP Proxy Server under the Services tab.
3. Select the Bindings tab.
4. Select the Allow connections coming in on any interface radio button.
5. Open the Non-proxy Requests tab.
6. Select the Pipe requests through to predetermined server radio button. Here you should enter the IP address of the computer, which the FTP server is running on behind WinGate, to which all FTP requests from the Internet will be directed.
7. Enter the port as 2121(or the new port the FTP server has been configured to listen on).
8. Select OK as you exit out of the FTP Proxy Server
9. Save changes in GateKeeper.

1. Open GateKeeper on the WinGate server.
2. Open Extended Network Services under the System tab.
3. Select the Port Security tab.
4. Click the Add button.
5. On the port configuration dialog select Connections from the Internet and TCP as the protocol.
6. Enter Port 21 or designated FTP port (as required) on the FTP server.
7. Select the Allow Packet option.
8. Click OK to exit the ENS configuration.
9. Save changes in Gatekeeper

• User Assumption - by IP address, or if you are using the WinGate DHCP service, by machine name.

• Basic Authentication

• Java Authentication

• NTLM Authentication

There are three levels of Authentication in WinGate and the above Authentication options fit into these levels of Authentication.

User may be Unknown:
This is the Unauthenticated level, all users will be seen to be GUEST and no Authentication is required to connect to the WinGate services. Policies can still be set to control access to the Internet, these policies will affect all users.



User may be Assumed:
An intermediate level of Authentication that does not provide a high level of security. Used with either Basic Authentication or Assumptions. It can be convenient to set up Assumptions by IP address, this allows you to create policies based on the machine that the user is connecting from and does not require any input from the user. Using Assumptions grants access rights on a per machine basis so any user accessing WinGate from a particular machine can be assumed to be a specified user.



For more information regarding the Assumed level of Authentication in WinGate please see this knowledge base article.

User must be Authenticated;
The highest level of security, uses either the Java login through the WWW proxy, NTLM authentication if using the Operating System database, or the GateKeeper login method to authenticate users.



For more information regarding the Authenticated level of Authentication in WinGate please see this knowledge base article.

If you have any questions about this article please contact Qbik Support.

To export the registry file:

If you can log in to GateKeeper-

• go to the options>advanced menu or START>> Programs >> WinGate >> WinGate advanced options >> Registry
• click the button Save Registry Settings
• save the registry file somewhere safe.

  

  If you cannot log in to GateKeeper-

• open the registry editor
• find the following key
• HKEY_LOCAL_MACHINE\SOFTWARE\Qbik Software
• go to the Registry menu and select export registry file save it somewhere safe.
  
  Importing WinGate settings
  Note. If you are importing to a 64bit OS then you need to follow the instructions here.
  • Stop the WinGate Engine (either from the WinGate icon in the systray or from the Stop WinGate engine in Start menu/Programs/WinGate).
  • Open the registry editor (Start menu/Run/regedit).
  • Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Qbik Software.
  • Delete or rename the registry key called "WinGate".
  • Close the registry editor.
  • Double click on the saved WinGate registry file.
  • Start the WinGate engine ( either from the WinGate icon in the systray or Stop WinGate engine in Start menu/Programs/WinGate).
  
  Please Note: Any configuration changes made in GateKeeper prior importing the registry file will be overwritten by the corresponding settings in the imported Reg file.
  
  If you have any questions about this article please contact Qbik Support.

• Adware.
• Remote administration programs.
• Utilities which can be used by malicious programs or users such as trojans.
• General Malware

1. Stop the WinGate engine
2. Open regedit, navigate to the following location
   
   • HKEY_LOCAL_MACHINE\SOFTWARE\Qbik Software\WinGate\Data Scanning Plugins\Installed\Kaspersky AntiVirus for WinGate\Update URL List
3. For each UpdateServer folder delete the "_ext" from the end of the URL key:
4. Close regedit
5. In Windows Explorer delete the following folders:
   
   • C:\Program Files\WinGate\Plugins\Kaspersky AntiVirus\Bases
   • C:\Program Files\WinGate\Plugins\Kaspersky AntiVirus\Downloads
6. Start the WinGate Engine
7. Start a manual update via the Start menu
   (Windows) Start menu --> Programs --> WinGate --> Plugins --> Kaspersky AntiVirus --> Kaspersky AntiVirus Updater
8. Once the update is complete stop then start the WinGate Engine.

If you have any questions about this article please contact Qbik Support.

From time to time, you might see a checksum error reported in the Firewall tab of the GateKeeper (as shown in the image below). This message occurs when WinGate receives a packet but finds that the checksum value which the packet evaluates to does not match up the checksum value which the packet reports it should evaluate to. In simpler terms, the packet has become corrupt during transmission.

Solution

It is normal to observe a checksum error from time to time, but if you are observing a large number of checksum errors regularly, then you may have a problem that needs to be addressed. We recommend starting the troubleshooting process by making the following change to your system which will stop Windows from offloading the checksumming tasks from the system CPU to the attached networking hardware. This change itself may not fix the problem, but it will let us know if the problem is with software or hardware.

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
3. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
4. Click Edit, point to New, and then click DWORD Value.
5. Type DisableTaskOffload as the entry name, and then press ENTER.
6. Right-click DisableTaskOffload, and then click Modify.
7. In the Value data box, type a value of 1, and then click OK.
8. Quit Registry Editor.
9. Restart your computer.

Monitor the firewall for a while after making this change. If checksum errors continue to occur, contact support@qbik.com for assistance with further troubleshooting.

1. Make sure the game you are using has all of the latest upgrades and patches from the official website of the game in question. Sometimes these fixes address networking and online gaming issues, which could stop the game connecting correctly.
2. Make sure all of the appropriate ports that the game requires have been configured correctly in the WinGate firewall. Sometimes the default medium setting in WinGates ENS configuration, does not correctly configure the ports that are particular to the game in question.
3. Make sure that you read the networking documentation of the game in question in case there are any special tweaks required when working with a proxy server/firewall scenario.

1. Open GateKeeper on the WinGate server
2. Select Help from the menu bar at the top of GateKeeper.
3. Click on the System Info menu item.
4. The WinGate version information will be displayed in the window that appears.

Or alternatively:

1. Open Gatekeeper.
2. Select Options from the menu bar at the top of GateKeeper.
3. Click on the Advanced menu item.
4. Click on the Troubleshooting tab and in the Configuration Report window it will have listed version details.

• 1 GHz CPU (or higher)

• 256 Megabytes RAM (or higher)

• 500 Megabytes of hard disk drive space (although we recommend as much as possible to allow for logging operation and virtual disk space)

• 2000

• XP (32 or 64 bit)

• 2003 (32 or 64 bit)

• Vista (32 or 64 bit)

• Windows 2008 Server (32 or 64 bit)

• Normal use of the Internet by users on your local network (LAN)
• Internet applications which may poll the Internet on a regular basis looking for updates. Windows update itself can even do this on some operating systems.
• Local machines making NetBIOS requests using DNS to look up other machines on your network. Some operating systems allow you to disable this.
• Machines participating in an Active Directory. Active Directory makes extensive use of DNS to locate directory services.

1. Log in to GateKeeper
2. Click on the DNS service on the System Tab
3. On the General tab in the DNS service properties, uncheck the box marked "Allow Request to initiate dialer".

• Using WinGate's ENS driver to connect by means of Network Address Translation (NAT).
  
  Machines on your network will be using this if you have the ENS driver installed, and the local machines are configured to use WinGate as either their DHCP server (in which case their default gateway setting will be set to the IP address of the WinGate machine).
  
  In this case, the effect for these machines will be to effectively disable dial on demand completely, since these machines will need to be able to complete a DNS lookup before they will attempt to connect to anything on the Internet.

• Using the WinGate Internet Client on your client computers.
  
  As with NAT above, the WinGate Internet Client requires that the client machines are able to complete a DNS lookup to resolve the name of the host they are connecting to before there will be any connection attempt.
  
  So similarly to the instructions above, if you choose to disallow WinGate's DNS server from dialing, then dial on demand will be effectively disabled for these users.
  
• Using Proxies in WinGate, for example the WWW Proxy.
  
  In this case, the client does not need to resolve an Internet address, as it connects to the proxy, issues the proxy an instruction to fetch a URL, and WinGate itself resolves the host name with DNS. In this case however, WinGate controls dialing separately. Therefore if your client machines are using this method to connect to the Internet, there will be little side-effect to disabling the DNS server from dialing.

• Attempt to stop the client machines from making the DNS requests.
• Look on your client machines for applications that run in the background, ticker-tape applications, instant messenger applications, etc.
• Configure your client machines not to use DNS for windows name resolution.
• Find out which names are being looked up by looking in the WinGate history database, and ban these lookups. The lookups will then fail in all cases, but will not cause WinGate to dial the Internet.

• Mark the site as local Found in the Dialer configuration in GateKeeper. You will likely need to enter the IP address in here. When a client tries to connect to that address, WinGate's dialer will deem it to be local, and will not dial the Internet.
  
  You can find information about what sites are being connected to in the WinGate History in GateKeeper. Further information may be found in the WinGate service log files, in the log directory in the WinGate install directory.

• Assumptions based on IP addresses
• Assumptions based on Computer names.
  
  Configuring Assumed users based on IP address
  
  Please Note: In order to use this type of assumed user option, clients machines need to have statically set IP addresses.
  
  
  1. Open GateKeeper on the WinGate Server.
  2. Open the Users tab.
  3. Double click on Assumed Users.
  4. Select the By IP address tab.
  5. Click on the Add button.
  6. In the Location dialog that appears, enter the IP address of the client machine.
  7. In the Then Assume it is drop down box select the appropriate user.
  8. Click OK back through till you have exited the assumed users dialog.
  9. Save changes in GateKeeper.
  Configuring Users based on Computer Name
  
  Please Note: In order to use this type of assumed user option, the client needs to be using the WinGate DHCP service (i.e. receive its network details from WinGates DHCP) in order for it to work.
  1. Open GateKeeper on the WinGate Server.
  2. Open the Users tab.
  3. Double click on Assumed Users.
  4. Select the By Computer name tab.
  5. Click on the Add button.
  6. In the Location dialog that appears, enter the computer name of the client machine.
  7. In the Then Assume it is drop down box select the appropriate user.
  8. Click OK back through till you have exited the assumed users dialog.
  9. Save changes in GateKeeper.

1. Stop the WinGate Engine.
2. Copy your current logfile directory to it’s new location.
3. Open the registry editor (Start -> Run -> regedit) and navigate to “HKEY_LOCAL_MACHINE\SOFTWARE\Qbik Software\WinGate\Settings”.
4. Click “Drop-down menu -> Edit -> New -> String Value”.
5. Name the new value “LogFileDirectory”.
6. Double click on the new string value and set the value data to your new logfile directory.
   e.g. “C:\Program Files\WinGate\logs”.
7. Start the WinGate Engine

WinGate will record all logfiles in the directory that you just specified. You can delete the original logfile directory from the WinGate directory after it has been moved to it's new location.

1. Open GateKeeeper on the WinGate Server.
2. Open the Winsock redirector service (Which is listed under the System tab).
3. Select the Policies tab.
4. Ensure the Rights option at the top of the Policies tab, has User can access these services selected.
5. Make sure the Default Rights (System Policies) are set to are ignored
6. Click the add button below the Window.
7. Select the user(s)/groups to whom you want to restrict access by time.
8. Select the Time tab and select Specify times when this recipient has rights.
9. Click Add and you will be presented with the Time Slice dialog.
10. Choose/configure the appropriate times you need to choose.
11. Click OK back through each menu.
12. Save changes in GateKeeper.

1. Open GateKeeeper on the WinGate Server.
2. Open the WWW Proxy Server (Which is listed under the Services tab)
3. Select the Policies tab.
4. Ensure the Rights window at the top of the Policies tab has User can access these services selected.
5. Make sure the Default Rights (System Policies) are set to Ignored.
6. Click the add button below the Window.
7. Select the user(s)/groups to whom you want to restrict access by time.
8. Select the time tab and select Specify times when this recipient has rights.
9. Click add and you will be presented with the Time Slice dialog.
10. Choose the appropriate times you need to configure.
11. Click OK through each menu.
12. Save changes in GateKeeper.

1. Open Gatekeeper on the WinGate server.
2. Double click the WWW Proxy Server from the Service tab.
3. Open the Policies tab.
4. Select Default Rights (System Policies) are ignored,
5. Click Add.
6. In the Properties for new recipient dialogue select the Recipient tab and select the Users/groups to whom this policy will apply.
7. Select the Advanced tab and choose Specify which requests this recipient has rights for
8. Click Add filter,Add criterion.
9. Choose This criterion is met if
10. HTTP URL
11. contains
12. wingate
13. Ok your way out.

1. Open Gatekeeper on the WinGate server.
2. Select the WWW Proxy Server from the Service tab.
3. Open the Policies tab.
4. Underneathe the Recipient/Rights window in the middle of the dialog, make sure that the Default Rights (System Policies) are set to “Are Ignored”, then click on the Add button below this.
   The new dialog “Properties of new recipient” will appear.
5. Open the Recipient tab and select the Users/groups to whom this will apply.
6. Open the Advanced tab and select the Specify which requests this recipient has rights for radio button then click on the Add filter button below this (which will now be highlighted).
   A Filter 1-icon will appear in this window.
7. With this highlighted, click the Add criterion button.

1. On the criterion dialog that has appeared select, This criterion IS NOT met if radio button.
2. From the first dropdown menu select HTTP URL
3. From the Second drop down menu select CONTAINS
4. In the last test box input the words or phrases that might be in the URL that you would like to block (e.g. sex, or a phrase like porn.com etc)
5. Continue adding criterion for each URL word or phrase to what you wish to restrict access.
6. Click OK back through each dialog until you have exited the WWW Proxy Server.
7. Save changes in GateKeeper.

1. Open GateKeeper on the WinGate Server.
2. Select the Email Server icon from the System tab.
3. Select the Delivery tab.
4. Under the Remote Delivery section, click on the How to Deliver menu, and select Use Gateway option.
5. In the Server text box enter the IP address of the SMTP server(the external mail server you are to use).
6. Click OK.
7. Save changes in GateKeeper.

1. Open GateKeeper on the WinGate server.
2. Select the User tab.
3. Double click on the user in question.
4. Select the Email tab
5. Make sure the check box and current addresses information are correct at the top of this configuration.
6. Make sure the Override WinGate password for POP3 is checked.
7. Enter the correct Pop3 Password in the box.
8. Click OK.
9. Save changes in GateKeeper.

1. Select the ”My Network Places” icon on the desktop and right click to open the context menu and select properties. An alternative to this, is to enter the control panel (via the start menu) and select the Network and Dial-up Connections.
2. Once the Properties window appears, you will see listed the available network connections (usually marked Local Area Connection ). If there is more then one Network connection listed, select the Interface that will connect the WinGate Server to the rest of your Local Network (not the Internet).
3. Right click on this Interface and from the menu select Properties.
4. A dialogue listing the Network adapter (NIC), its Protocols and Services will appear. Scroll down to the entry that says Internet protocol (TCP/IP) and click on the properties button at the bottom.
5. Under the general tab, select Specify an IP address in the IP address field. Enter a suitable IP address of a private class (in accordance with RFC , (such as 10.0.0.1, 192.168.x.x). This should be in the same range as what the rest of the network will be numbered with.
6. The subnet mask will be automatically set by Windows after you have entered the IP address, or you can specify a specific mask depending on your requirements.
7. The next thing to ensure is that the Gateway entry is left empty. This is most important when setting the internal IP interface, as the external interface that is used to connect out to the Internet is the only NIC on the machine that should require a Gateway setting, and this will usually be assigned by the ISP.
8. Leave the DNS option at the bottom blank as explained above there is no requirement for the Internal interface to have a DNS setting.
   
   Note if there is a requirement for the DNS to be enabled, the only DNS servers that should be there are that of the ISP, or specified DNS server with an external IP address).
   
   
9. There is no need to adjust anything under the Advanced tab. When WinGate server is is set to run on the machine, you should avoid listing or entering a Wins server as WINS lookups can be configured via the lmhost file in WinGate itself.

1. Access the Network Interface properties as described in the server scenario above.
2. Under the general tab of the Internet Protocol (TCP/IP) properties, enter an Internal IP address that is in the same range as the WinGate server (e.g. 192.168.4.*)
3. After entering the IP the subnet mask field should be filled in automatically or set as specifically as required, and should be the same as the mask used on the Internal Interface of the server. (this ensures they share the same subnet range).
4. In the Default Gateway field, you should enter the Internal IP address of the WinGate Server
5. In the DNS field choose the Use this DNS server radio button and again enter the internal IP of the WinGate Server.

1. Open GateKeeper on the WinGate server
2. Select the Users tab and double click on the User icon or right click anywhere in the pane and select Add new user.
3. Under the Properties for new user dialog that appears, configure the appropriate details as required, selecting the groups that the user will belong to etc.

1. Open GateKeeper on the WinGate server.
2. Select the Users tab.
3. Double click the Database options icon.
4. Select the Windows NT/2000/Xp pro User Database option.
5. Click the Synchronize now button.
6. Click OK.

1. From the Run command on the Start Menu type Regedit.
2. Expand to the key called HKEY_LOCAL_MACHINE\\Software\\QbikSoftware\\WinGate\\UserDatabase.
3. Create a string value called DomainServer
4. Set the value in the form of a \\\\Servername , where Servername is the Computer name of the Primary Domain controller.

1. Open the Computer Management MMC (found in Administrative tools in Windows) and open the Services and Applications configuration that lists all Services.
2. Select the Qbik WinGate Engine service.
3. Right click on this service and select Properties.
4. Select the Log On tab.
5. Where it says Log on as, select the This Account option and browse the Active directory for a suitable account with Domain Adminstration equivilent privilages. (It is recommended that administrators create a special account in Active Directory Users and Computers for this purpose.)
6. Stop and then Restart the WinGate engine for the changes to affect.
7. Re-synchronise the database from the User database configuration found under the Users tab in GateKeeper.
   
   If the setup is not followed exactly as outlined above then it will cause the inability for the administrator to log in to Gatekeeper, which may require uninstalling and reinstalling WinGate if necessary.

1. On the Users tab in GateKeeper double click Database options
2. Check the option Use the Operating system user database
3. If your Domain Controller is not the machine that WinGate is installed on you will need to tell WinGate where to find the user database. Select the option Use remote user database and enter the path to the server
4. Select your synchronisation options
5. When you're ready to import the user database click the button Synchronise now

   

   Please Note: For Active Directory Domain Controllers

   When using an Active Directory Domain Controller for a database there is one futher step required for this work correctly:

   1. Open the Computer Management MMC (found in Administrative tools in Windows) and open the Services and Applications configuration that lists all Services.
   2. Select the Qbik WinGate Engine service.
   3. Right click on this service and select Properties.
   4. Select the Log On tab.
   5. Where it says Log on as, select the This Account option and browse the Active directory for a suitable account with Domain Adminstration equivilent privilages. (It is recommended that administrators create a special account in Active Directory Users and Computers for this purpose.)
   6. Stop and then Restart the WinGate engine for the changes to affect.
   7. Re-synchronise the database from the User database configuration found under the Users tab in GateKeeper.

1. Go to the system tab in GateKeeper and double click caching
2. Select What to cache and change the radio button to specify which requests will be cached
3. Click Add Filter, click Add Criterion
4. Choose This criterion is NOT met if
5. HTTP URL
6. contains
7. windowsupdate
8. Click ok, ok

1. From the Start menu select Run and type Regedit.
2. Navigate to the following key: HKEY_LOCAL_MACHINE\Software\Qbik Software\WinGate\Dialer.
3. Find the Dword setting called [b]IdleTrafficLevel[/b].
4. Tweak the level to the appropriate amount required.
5. Exit regedit.
6. Stop and Restart the WinGate Engine for the setting to take effect.