Answer
Whenever a user tries to access the Internet via a Guest Interface, he has to authenticate as a guest via a Welcome Screen. The welcome page is located at https://<IP_address_or_hostname>:4081/nonauth/guest.cs
If the welcome page is not displayed, the user is not able to browse, as all packets are dropped, and the below can be seen in the debug logs with Packets dropped for some reason messages enabled:[01/Aug/2023 10:16:08] {pktdrop} packet dropped: Guest has not visited Welcome screen.
To fix this issue follow these steps:
- Instead of redirecting the users to an IP address of the Welcome screen, the Kerio Control can be set up so that it redirects to a name, rather than an IP. The full details of doing that can be found in the article below: https://manuals.gfi.com/en/kerio/control/content/troubleshooting-kerio-control/redirecting-users-to-the-authentication-page-does-not-work-the-page-cannot-be-displayed-418.html
- Make sure that the Protocol Inspector for the Guest Traffic is set to default in the web admin console, as shown in the picture:
After applying the above changes, the Welcome Screen for guests should prompt for authentication.