Kerio VPN Client enables connection from a client's host to a remote private network via an encrypted communication channel (in the operating system, this channel is represented by a virtual network interface — Kerio VPN Adapter).

The client's operating system must be aware of routes to individual subnets of a corresponding remote private network. For this purpose, Kerio VPN Client performs automatic update of the client's routing table (it adds new routes directed to remote subnets). These automatic updates are performed:

During these updates, routes to all remote subnets (or a route to other networks defined in the VPN server configuration) are added except those IP addresses of which collide with IP addresses of the local network to which the client is connected. Kerio VPN Client never changes the default route (i.e. configuration of the default gateway). The encrypted traffic channel is used only for connection to a remote private network. For connection to the Internet, clients use their current Internet connections.