topic Re: Close Default Open Ports in General Topics

Close Default Open Ports

Lockout888 — Fri, 08 Nov 2019 07:48:02 GMT

I have a Cleanup Rule any/any to drop traffic from the Internet, but a Shields Up scan from grc.com shows I have several ports open by default: 80, 264, 443 and 444.

What configuration changes do I need to "stealth" these ports?

Re: Close Default Open Ports

PhoneBoy — Sat, 09 Nov 2019 07:55:06 GMT

80/443 is Multiportal.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105740
Port 264 is related to a Remote Access implies rule, go to Global Properties > Firewall > Accept Remote Access Control Connections, uncheck this, and install policy.
Port 444 is not one of our standard ports and may be related to your specific configuration.

Re: Close Default Open Ports

Lockout888 — Thu, 09 Jan 2020 22:41:03 GMT

I set the Platform Portal Accessibility settings to "Through internal interfaces" with no options checked per the SK solution. I verified my Topology settings are correct (eth1 = external and Mgmt = Internal).

I am still getting implied Rule 0 accepts for 443 and 80 in the logs. This is a Standalone configuration if that matters.

The SK other solution says: "In case you do not want to allow any connections to the Security Gateway's portals , add a rule that drop this traffic."

How do I add a rule that will drop the traffic of an implied rule?

Re: Close Default Open Ports

PhoneBoy — Thu, 09 Jan 2020 23:00:14 GMT

Re: Close Default Open Ports

KernelGordon — Thu, 09 Jan 2020 23:29:49 GMT

You can follow sk115600 to disable the implied rules. I would not recommend doing this however as you will have to create explicit rules to replace the implicit rules and this usually just leads to a lot of headaches.

Re: Close Default Open Ports

Lockout888 — Fri, 10 Jan 2020 02:27:13 GMT

Thanks PhoneBoy, I think that did the trick.

SecurePlatform and UserCheck were both set to "internal_interfaces" but SmartView was set to "all_interfaces".

I set that to internal_interfaces, saved and installed policy.

The implied rule 0 accepts on 443 and 80 seem to have stopped, and now GRC Shields Up reports those ports as Stealth 🙂