Our take: Kerio Control VPN is business-grade network security software — not a consumer VPN. It supports two connection modes: its proprietary Kerio VPN protocol (IPsec-based, port 4090) and an SSL VPN option (port 443, Windows Kerio Control only), which is useful in restrictive corporate network environments where non-standard VPN ports may be blocked. This page previously claimed a specific in-house lab test (VMware environment, Palo Alto PA-220 firewall, “280 Mbps” throughput figure) that we did not actually run, so we’ve removed those specific unverified numbers and kept the accurate, publicly documented technical facts about how the protocol works.
Remote access has become essential for modern businesses, and choosing the right VPN solution can make or break your organization’s security posture. The Kerio VPN client stands out as a reliable option for businesses seeking secure remote connectivity to their corporate networks.
Whether you’re an IT administrator setting up remote access for your team or a remote worker connecting to your company’s network, understanding how to properly configure and use the Kerio VPN client is crucial. This comprehensive guide will walk you through everything you need to know about Kerio VPN client setup, configuration, troubleshooting, and optimization.
In this article, you’ll discover step-by-step instructions for installing the Kerio VPN client, learn about its key features, and explore best practices for maintaining secure connections. We’ll also compare it with other VPN solutions and help you determine if it’s the right choice for your remote access needs.
Table of Contents
Understanding Kerio VPN Client and Its Core Features
The Kerio VPN client is a powerful software application designed to establish secure, encrypted connections between remote users and corporate networks protected by Kerio Control. This enterprise-grade solution provides businesses with a straightforward way to extend their network security perimeter to remote locations.
Unlike consumer VPN services that focus on privacy and content access, the Kerio VPN client is purpose-built for business environments. It creates an encrypted tunnel between a user’s device and the company’s Kerio Control firewall, ensuring that all transmitted data remains confidential and protected from interception.
What Makes Kerio VPN Client Different
The Kerio VPN client operates specifically with Kerio Control VPN servers, creating a closed ecosystem that enhances security. This tight integration allows for centralized management and consistent policy enforcement across all remote connections.
Key distinguishing features include:
Native integration with Kerio Control firewall and security appliances- Support for multiple VPN protocols including IPsec and SSL VPN
- Cross-platform compatibility for Windows, macOS, Linux, iOS, and Android
- Automatic connection restoration after network interruptions
- Split tunneling capabilities for optimized bandwidth usage
- Comprehensive logging and connection monitoring tools
The client software maintains a persistent connection to the Kerio Control VPN server, automatically reconnecting if the connection drops due to network issues. This reliability makes it ideal for business applications that require stable, uninterrupted access to corporate resources.
How Kerio Control VPN Architecture Works
Understanding the underlying architecture helps you optimize your Kerio Control VPN deployment. The system consists of three main components that work together to provide secure remote access.
First, the Kerio Control firewall acts as the VPN server, managing authentication, encryption, and routing for all incoming VPN connections. It enforces security policies, performs traffic inspection, and maintains detailed logs of all VPN activity.
Second, the Kerio VPN client software runs on end-user devices, handling encryption, authentication credential management, and tunnel establishment. The client maintains the connection status and provides users with a simple interface to connect and disconnect.
Third, the authentication backend verifies user credentials against Active Directory, LDAP, or Kerio’s internal user database. This centralized authentication ensures consistent access control across all remote connections.
Supported Platforms and System Requirements
The Kerio VPN client supports a wide range of operating systems, making it suitable for diverse IT environments. However, system requirements vary depending on the platform and version you’re using.
For Windows systems, the client works with:
- Windows 11 (all editions)Windows 10 (all editions)Windows 8.1 and 8Windows 7 Service Pack 1 or later
Windows Server 2019, 2016, 2012 R2, and 2012
macOS compatibility includes:
- macOS Monterey (12.x)
- macOS Big Sur (11.x)
- macOS Catalina (10.15)
- macOS Mojave (10.14)
- Earlier versions down to OS X 10.11 El Capitan
Linux support extends to major distributions including Ubuntu, Debian, CentOS, Red Hat Enterprise Linux, and Fedora. Mobile platforms include iOS 12 and later, plus Android 5.0 and above.
Minimum hardware requirements are modest. You’ll need at least 512 MB of RAM, 100 MB of free disk space, and a network adapter capable of at least 100 Mbps throughput for optimal performance.
Security Protocols and Encryption Standards
Security forms the foundation of any VPN solution, and the Kerio VPN client implements industry-standard protocols to protect your data. Understanding these protocols helps you configure the most secure connection for your needs.
The Kerio Control VPN supports two primary protocols:
IPsec (Internet Protocol Security): This suite of protocols operates at the network layer, encrypting and authenticating all IP packets. Kerio implements IPsec with IKEv2 (Internet Key Exchange version 2), which provides excellent security and performance. IPsec uses AES-256 encryption for data confidentiality and SHA-2 for authentication.
SSL VPN: This protocol operates at the transport layer, creating encrypted tunnels over HTTPS connections. SSL VPN offers advantages in restrictive network environments where IPsec might be blocked. It uses TLS 1.2 or higher with strong cipher suites.
Authentication methods include pre-shared keys, digital certificates, and username/password combinations. Certificate-based authentication provides the strongest security by eliminating the risks associated with password compromise.
The encryption strength is configurable, but Kerio defaults to AES-256-GCM (Galois/Counter Mode), which provides both confidentiality and authentication. This cipher is considered unbreakable with current technology and is approved for protecting classified information up to the SECRET level by the U.S. National Security Agency.
Installing and Configuring Kerio VPN Client Step by Step
Setting up the Kerio VPN client requires careful attention to detail, but the process is straightforward when you follow the proper sequence. This section covers everything from downloading the software to establishing your first connection.
Before beginning installation, ensure you have the necessary credentials and information from your IT department. You’ll need the VPN server address, your username and password, and any certificates or configuration files required by your organization.
Downloading the Correct Kerio VPN Client Version
Obtaining the correct version of the Kerio VPN client is your first step. The client version should match or be compatible with your Kerio Control server version to ensure optimal functionality and security.
Your IT administrator should provide you with the download link and version number. Typically, organizations host the client installer on their internal portal or provide direct download links. If you’re an administrator, you can download clients from the GFI/Kerio website or directly from your Kerio Control administration interface.
The Kerio Control web administration interface includes a dedicated page where users can download the appropriate client for their operating system. This ensures version compatibility and simplifies distribution.
For Windows users, the installer comes as an .exe file typically ranging from 10-30 MB. macOS users receive a .dmg disk image, while Linux users get either .deb packages for Debian-based systems or .rpm packages for Red Hat-based distributions.
Always verify the digital signature of the installer before running it. Legitimate Kerio installers are digitally signed by GFI Software, providing assurance that the file hasn’t been tampered with.
Windows Installation Process
Installing the Kerio VPN client on Windows is straightforward, but administrative privileges are required. The installation process modifies network settings and installs virtual network adapters, which require elevated permissions.
Follow these steps for Windows installation:
Step 1: Right-click the installer executable and select “Run as administrator.” This ensures the installer has the necessary permissions to complete all configuration tasks.
Step 2: When the User Account Control prompt appears, click “Yes” to allow the installer to make changes to your device.
Step 3: The Kerio VPN Client Setup Wizard opens. Click “Next” to proceed past the welcome screen.
Step 4: Review the license agreement. Select “I accept the agreement” and click “Next” to continue.
Step 5: Choose the installation location. The default path is typically C:Program FilesKerioVPN Client. Unless you have specific requirements, accept the default and click “Next.”
Step 6: Select additional tasks such as creating a desktop shortcut. These options are convenience features and don’t affect functionality.
Step 7: Click “Install” to begin the installation process. The installer will extract files, install the virtual network adapter, and configure system services.
Step 8: During installation, Windows may prompt you to install the Kerio Virtual Network Adapter driver. Click “Install” to allow this. The adapter is essential for VPN functionality.
Step 9: Once installation completes, click “Finish.” You may need to restart your computer for all changes to take effect.
After installation, the Kerio VPN client icon appears in your system tray, and the application is accessible from the Start menu. The first launch will prompt you to configure your VPN connection settings.
macOS Installation and Configuration
Installing the Kerio VPN client on macOS follows Apple’s standard application installation process but includes additional steps for security extensions required for VPN functionality.
Here’s the complete macOS installation procedure:
Step 1: Double-click the downloaded .dmg file to mount the disk image. A Finder window opens showing the installer contents.
Step 2: Double-click the Kerio VPN Client installer package. macOS will verify the package before opening the installer.
Step 3: The installer welcome screen appears. Click “Continue” to proceed.
Step 4: Read the software license agreement and click “Continue,” then “Agree” to accept the terms.
Step 5: Select the installation destination. For most users, installing for all users on the computer is appropriate. Click “Continue.”
Step 6: Click “Install” to begin installation. macOS will prompt you to enter your administrator username and password.
Step 7: The installer extracts and installs files. This process typically takes 1-2 minutes.
Step 8: After installation, macOS may display a security warning about system extensions. Click “Open Security Preferences” or manually open System Preferences > Security & Privacy.
Step 9: In the Security & Privacy pane, click the lock icon to make changes. Enter your password when prompted.
Step 10: Click “Allow” next to the message about Kerio Technologies system software. This permits the VPN client to create and manage network connections.
Step 11: Close System Preferences and launch the Kerio VPN Client from your Applications folder.
On macOS 10.15 Catalina and later, you may need to grant additional permissions for the VPN client to function properly. Navigate to System Preferences > Security & Privacy > Privacy tab, and ensure Kerio VPN Client has permissions for Full Disk Access if prompted.
Creating Your First VPN Connection Profile
Once installed, you need to create a connection profile containing your VPN server details and authentication information. This profile stores all settings needed to establish a VPN connection.
Launch the Kerio VPN client. On Windows, find it in the Start menu or system tray. On macOS, open it from the Applications folder. The main window displays an empty connection list on first launch.
Click “Add Connection” or the plus (+) button to create a new profile. A configuration dialog appears with several fields to complete:
Connection Name: Enter a descriptive name like “Company VPN” or “Office Network.” This name appears in your connection list and helps you identify the profile if you maintain multiple VPN connections.
Server Address: Enter the hostname or IP address of your Kerio Control VPN server. Your IT department provides this information. It might look like “vpn.company.com” or “198.51.100.50:4090” if using a non-standard port.
Protocol: Select either “Kerio VPN” (IPsec-based) or “SSL VPN” depending on your server configuration. Most deployments use the default Kerio VPN protocol for optimal security and performance.
Authentication: Choose the authentication method required by your server:
- Username and password: Standard authentication requiring credentials at each connection
- Certificate: Uses digital certificates for authentication without passwords
- Pre-shared key: Uses a shared secret for authentication (less secure, not recommended)
Username: Enter your VPN username provided by your IT department. This may differ from your computer login username.
Password: Enter your VPN password. Check “Save password” if you want to avoid entering it each time, but only do this on secure, personal devices.
Domain: Some organizations require a domain specification. Leave blank unless instructed otherwise.
Click the “Advanced” button to access additional settings:
Port: The default VPN port is 4090 for standard connections. Change this only if your IT department specifies a different port.
Enable split tunneling: When enabled, only traffic destined for the corporate network routes through the VPN. Internet traffic uses your local connection. This option improves performance but may be disabled by company policy.
Use VPN for DNS queries: Routes DNS queries through the VPN, preventing DNS leaks and ensuring corporate DNS policies apply.
Reconnect automatically: Automatically reestablishes the VPN connection if it drops. Recommended for stable remote work.
After entering all information, click “OK” to save the profile. Your new connection appears in the main window’s connection list.
Establishing Your First Connection
With your connection profile configured, you’re ready to establish your first VPN connection. This process varies slightly depending on your authentication method and server configuration.
Select your connection profile from the list and click “Connect.” The status indicator changes from “Disconnected” to “Connecting” as the client negotiates with the server.
During connection establishment, several things happen behind the scenes:
- The client contacts the VPN server at the specified address
- SSL/TLS handshake occurs to establish a secure channel
- Authentication credentials are exchanged and verified
- Encryption keys are generated and exchanged
- Network routes are configured on your device
- Virtual network adapter is activated