topic Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version in General Topics

How to Block TOR NODE is Checkpoint Firewall R80.30 Version

Rabindra_Khadka — Fri, 01 May 2020 15:56:26 GMT

Please help me to Block the TOR node in checkpoint firewall which is running on R80.30 version.

We want to follow step:4 from the link below. But i could not find same configuration in the file IP-blacklist.sh and ip_block.sh in R80.30 version firewall.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103154

we want to block all the IP's in the below

https://secureupdates.checkpoint.com/IP-list/TOR.txt

Thank you for you kind co-operation

Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version

PhoneBoy — Fri, 01 May 2020 19:14:17 GMT

What leads you to believe the provided scripts won't work on R80.30?
Have you actually tried them and what were the precise results?

Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version

Rabindra_Khadka — Sat, 02 May 2020 04:05:27 GMT

I mean there is no such things to make changes in IP-blacklist.sh and ip_block.sh file on the checkpoint firewall running on r80.30.

like suggested on step:4 of below link
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103154#Known%20TOR%20Exit%20Nodes

Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version

Rabindra_Khadka — Sat, 02 May 2020 04:39:52 GMT

Do we need to configure both step:3 and step:4 to come in effect or can we choose one of them and configure one of the steps to come in effect.

Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version

Rabindra_Khadka — Sat, 02 May 2020 04:51:32 GMT

on the step:3 on the link below there is a scrip to download and that script has not mention the OS version of r80.30

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103154#Known%20TOR%20Exit%20Nodes

I have attached the screenshot herewith

Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version

PhoneBoy — Sat, 02 May 2020 15:27:51 GMT

Like I said, have you actually tried to run the script or are you hung up because the SK doesn't mention R80.30?
Try the scripts.

Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version

Rabindra_Khadka — Sat, 02 May 2020 15:35:03 GMT

Dear @PhoneBoy

Actually, it the requirement of the customer and i have tried this even in the customer environment, but when i go through the script in r80.30. The given SK doesn't match at all. The script are different in R80.30 then what is said in the SK.

So Maybe, the SK need to be updated or there should be different SK for Newer Version so that we can't be confuse. It will help us understand easier and help us to configure in simple way.

Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version

PhoneBoy — Sun, 03 May 2020 05:00:24 GMT

I'm not clear if you actually ran the scripts and got an error or won't run the scripts because the download link doesn't say it's compatible with R80.30.
Please clarify this point.

Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version

Rabindra_Khadka — Sun, 03 May 2020 05:10:51 GMT

So, If i dont modify the script as suggested by the SK and just run the default script which is already there in r80.30 version

Does it block the same IP's from the below link
https://secureupdates.checkpoint.com/IP-list/TOR.txt

Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version

PhoneBoy — Sun, 03 May 2020 05:22:11 GMT

The downloaded script should run as is.
However, you have to follow the instructions in the Step 3 of sk103154 to ensure that it's going to use the TOR list we maintain.
The modifications mentioned in Step 4 of the SK do not need to be done, and in fact, look wrong or maybe even inappropriate, at least in R80.40.
@Ronen_Zel can you have someone look at this?

Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version

Ronen_Zel — Sun, 03 May 2020 11:06:26 GMT

We did look into sk103154 and consulted R&D about this. Their reply was:

These are not steps, these are separate independent sections and as it says in the beginning of section [4]:

Important Notes:

It is recommended to use the solution from section "(3) How to block traffic from custom IP feeds (managed from Management Server)" with the Check Point's feed database https://secureupdates.checkpoint.com/IP-list/TOR.txt.

Re: How to Block TOR NODE is Checkpoint Firewall R80.30 Version

Rabindra_Khadka — Sun, 03 May 2020 11:14:00 GMT

Thanks @PhoneBoy Thanks @Ronen_Zel

I will try with step:3 only and update you about this. Thanks for your support.