After TCP/IP is installed on the client machines and IP addressing has been configured, the next step is to choose which connection method your clients will use to access the Internet.

WinGate offers the choice of three different methods that clients on the LAN can use when connecting through WinGate.

These are:

1. Network Address Translation
2. Wingate Internet Client
3. Proxy Method

Follow the links below for instructions on configuring your LAN clients to connect to a WinGate server using:

• NAT
• WGIC
• Proxy

Network Address Translation (NAT)

NAT is the easiest of the client connection methods to configure and use.

Network Address Translation happens when clients send their Internet requests to the WinGate server.

The WinGate server keeps track of which client is making the request. The WinGate server then makes the request on behalf of the client, out to the location on the Internet using its public IP address (appearing to the outside world as though it is the computer that originated the request.)

When the Web or remote server sends back the information to the public IP address of the WinGate server, the WinGate server translates the address back to the private address of the relevant client on the LAN, and redirects the incoming data back to that client who originally requested the information.

• NAT provides fast and seamless low-level sharing of a connection to the internet. It is the simplest approach to sharing an internet connection as all clients Internet requests (regardless of the type of program or activity) are sent to the WinGate server for it to handle on behalf of the client. With little overhead, it is very reliable.
• It is also extremely flexible as it gives access to a shared Internet connection for any platform that supports TCP/IP (e.g. Windows, Mac, Unix, Linux) unlike the Windows Internet client that can on be installed on a Windows based machine. This makes it ideal when you have non-Windows operating systems on the network that need to use WinGate to access the Internet.
• Since all Internet requests will be sent to the WinGate (gateway) machine, virtually any TCP/IP based client application (web browsers, mail programs, newsgroups, FTP etc.) should be able to use it without having to configure that application itself.
• There is no software to install and no applications to configure.
• With transparent redirection there is easy integration with the power of WinGate proxy services.

Cons

• Because NAT is implemented as a low-level driver, there may occasionally be some compatibility problems with some hardware.
• Due to its light weight nature, NAT alone does not allow the access or policy control available when clients are using WGIC, or running applications directly through WinGate proxies. However this can now be alleviated by the use of transparent redirection.

Conclusion

For many, NAT is an excellent choice. It's particularly well-suited to LANs that contain a mix of Windows platform and non-Windows machines. It is also ideal in situations where you dont want to have to install client software or configure individual applications on many different machines.

Click here to return to the top

WinGate Internet Client (WGIC)

The WinGate Internet Client is small application that can be installed on client machines in order to communicate with the WinGate server.

When the WGIC is installed, all network/Internet requests from WinSock based applications (most Windows programs) on the client computer will be intercepted and serviced by the the WinGate Server. This allows administrators to have strong control over what applications clients use to access the Internet, and how they will access the Internet.

Pros

• Provides tight control over users Internet usage and allows the efficient running of server applications.
• Provides an elegant way for users to authenticate for Internet usage. It can be configured so the user has to enter username and password the first time they access the Internet making it ideal for tracking and auditing purposes.
• Allows policy control from just one place in WinGate (the WRP service, which is the service that intercepts the WGIC requests) rather then configuring policies per WinGate service.
• When used with a WinGate Enterprise licence, WGIC user Internet access and operations can be controlled from a central configuration menu in Gatekeeper on the WinGate server.
• With the WGIC software packaged in an MSI installer, system administrators in an Active directory can set automatic installation to client machines across the domain.

Cons

• You have to install client software.
• Can only be installed to Windows based machines, and used by Winsock based programs.

Conclusion

If you have a small to medium sized LAN of Windows clients or a domain scenario, where control of user Internet applications is required, we recommend using the WGIC.

Click here to return to the top

Proxy

The Proxy connection is one of the most direct client connection methods used by WinGate.

Rather then configuring the client machine to use WinGate for all Internet access, each application on the client machine such as web browser, mail program, chat program etc must be configured individually to connect through WinGate (proxy server) to the Internet.

Most TCP/IP based programs will have an option to use a Proxy server. This is where access through WinGate will need to be configured.

The WinGate Internet Client and NAT connection methods have decreased the importance of application proxies.

You may still choose to use proxies to exert per-service control over policies, however the advent of transparent redirection means that there is nothing you can do with proxies that you now cannot do with the other two client connection methods.

Pros

• Since the client application request is handled by the specific WinGate proxy service, it allows you the greatest control over data passing through your network as you can set policies and restrictions etc in the relevant proxy service used in WinGate. Although, with transparent direction, these benefits are now available through NAT and WGIC.

Cons

• Works only for existing protocols that each Proxy service in WinGate is designed for.
• If a new protocol is devised and used by a client application, you wont be able to set the application to use WinGate as a proxy server, since there will be no proxy service available in WinGate for it.

Click here to return to the top

Configuring WinGate clients to use NAT is relatively simple. NAT connections to the WinGate server require that the WinGate server has at least two network adapters, and there must be an internal and an external adapter listed on the network tab in GateKeeper.

To configure your client machines to use the NAT method:

On the client machine:

1. Open the network connection properties by accessing the Windows control panel and selecting the Network and Dial up connections icon.
2. Double click on the Local Area Connection icon that is the network interface for the LAN.
3. This will bring up the Local Connection Status dialog, click on the Properties button.
4. In the Local Connection's Properties window select Internet (TCP/IP) and click the Properties button.
Note: You can confirm that this is the correct interface to configure as the actual physical name of the adapter is listed at the top of the Local Connection Properties window.
5. On the TCP/IP properties window select the Default Gateway setting and enter the private IP address used by the WinGate Server.
6. In the Preferred DNS Server setting enter the private IP address used by the WinGate server.
7. No other configuration is required for this network interface.
8. Click OK through the open properties screens to save the changes.

1. Open Gatekeeper
2. Select the DHCP Service on the System tab of the Gatekeeper control panel.
3. Open the DHCP Modes screen and make sure this is set to Fully Automatic mode.
4. Click OK to apply the changes.

Click here to return to the Client Connection Methods article. ]]>
To use the Proxy method for clients connections, configure the particular application on the client machine to point at the IP address (and enter the appropriate port) of the WinGate server.

You will need to check with specific Application documentation on how this is done for your particular program.

There is no other configuration required for the client workstation.

Note: Whenever an application is configured to use the Proxy method, that application(program) will be directed through the appropriate proxy service in WinGate. The application will not use any other connection method (NAT or WGIC) even if they are installed and working on the the same machine.

Since the introduction of using NAT and Transparent Redirection abilities in WinGate, there are now very few occasions where you should need to use a proxy directly.

Click here to return to the Client Connection Methods article.



]]> Before installing the WinGate Internet Client(WGIC), you should setup the WinGate server and make sure that the Winsock Redirection Service is enabled and running on the WinGate server before you begin installing the WGIC. You should also check that the machines that the WGIC is to be installed on meet the minimum requirements. The requirements for installing the WGIC are as follows:

• Running Windows 95, 98, NT4, 2000 or XP
• The computer is NOT running the WinGate server
• If running Windows 95 then WinSock 2 must be installed

Once your computer satisfies these basic requirements, you can install the WGIC:

1. Run the installer program on your client computer. Wingate.exe (This is the same installer you used for the WinGate server) or WGIC.msi (Client installer found in the WinGate\Client directory on the WinGate Server machine)
2. The installer should detect the WinGate server on the network and default to the client install. If it does not you can select to install the WinGate Internet Client manually.

Configuring Applications to Use the WGIC:

Once the installer has finished, your applications will connect to the Internet with no further configuration (the Winsock Redirection Service must be running on the WinGate server). The WGIC will seamlessly provide all outgoing and incoming access to and from the Internet. If you were using proxies before you installed the WGIC then you should remove any old proxy settings because your applications should be configured to connect directly to the Internet (rather than through proxies). If you do not remove these settings, your applications will still work but they will be using the WinGate proxies, not the WGIC.

Click here to return to the Client Connection Methods article. ]]>
As long as you have NAT set up properly it should require very little configuration or management. If you are having problems with your NAT connections you can check the following:

1. Is the Extended Networking driver installed?

When you install WinGate you can decide whether you want to install the "Extended Networking Service" (ENS). ENS is required for NAT, VPNs, Firewall, Routing etc. If you did not install ENS when you installed WinGate then you won't have an Extended Networking menu on the system tab in GateKeeper, you will need to reinstall WinGate to add ENS services.

The screenshot below shows the Extended Networking menu, with the status of the driver as "installed and active". In the Extended Networking menu there is an option to enable/disable NAT, this should be checked to allow NAT connections from the LAN.




2. Have your network adapters been correctly identified by WinGate?

NAT connections require an internal and an external adapter in the WinGate server to work properly. Often if you're behind a DSL router your external adapter will have a private IP address, so you may need to change the adapter settings in WinGate.

WinGate determines whether an adapter is internal or external based on the IP address of the adapter. An adapter with a public IP address is seen as external and firewalled, an adapater with a private IP address is seen as internal and services are bound to this adapter.

Therefore the network adapter pointing at the Internet should be marked as "External" and the network card pointing towards your private network should be marked as "Internal"; as shown in the image below. If you need to change the adapter usage just double click the adapter and choose the appropriate setting.





3. Network settings

Having more than one default gateway in your WinGate server can cause you routing problems and we recommend that you don't do this. Your WinGate server should have its network cards configured as below. We have chosen the 192.168.0.* subnet for our example, but any private IP address range is fine.

WinGate server:

External adapter:
IP address : (Assigned by ISP/router)
Subnet mask: (Assigned by ISP/router)
default gateway: (Assigned by ISP/router)
DNS server : (Assigned by ISP/router)

Internal adapter:
IP address : 192.168.0.1
Subnet mask: 255.255.255.0
Defaulte gateway: (left blank)
DNS server : (left blank)

Your LAN clients should have an IP address on the same subnet as the WinGate server, ie 192.168.0.*. They should have their default gateway and DNS server pointing at the WinGate server.

LAN Client:
IP address : 192.168.0.2
Subnet mask: 255.255.255.0
Default gateway: 192.168.0.1
DNS server : 192.168.0.1

Subsequent LAN clients will be on the same subnet, but their IP address will change.

For more information on setting up NAT on the clients please see this Knowledge Base article.



Additional considerations:

If you are running third party security applications on the WinGate server then you may see a driver conflict with the WinGate driver. For the purposes of testing you can uninstall the third party applications and see if that solves the problem. If it does please contact support for further information by submitting a support request here

If you are using Windows XP(SP2)/Windows 2003 on your LAN, then we recommend turning off the Windows Firewall. The only way to make sure it stays off is to disable it from the services applet.

If you have a Realtek 8029 network card please navigate to (Windows) Start menu-->Programs-->WinGate-->Advanced Options-->Hardware Specific-->Check the box "Realtek 8029 Chipset in use".
]]>
Most web browsers allow the user to specify whether the proxy settings will be:

• Automatically Detected
• Configured via a Script
• Manually Specified

• Using "Automatically Detect Settings" can give inconsistent results with different Internet Explorer versions; contact Microsoft if you believe there is an issue.
• The WPAD files are automatically created if they do not exist. They are located within C:\Progam File\WinGate\Resources and can be edited.
• When creating a WPAD file we suggest turning off caching of the WPAD file on the LAN Client as per the Microsoft Knowledge base article below. Caching the WPAD file may result in any changes to the WPAD file taking 30 minutes to become evident. http://support.microsoft.com/kb/271361/en-us