topic Re: Simple question about excluding address in VPM domains in General Topics

Simple question about excluding address in VPM domains

Gusa2727 — Wed, 10 Jun 2020 11:20:15 GMT

Hi, I have a simple question but I just need to confirm how this works. I need to exclude another destination IP in the VPN domains but I am not completely sure about how to do it. Currently I have this configuration:

#ifndef NON_VPN_TRAFFIC_RULES

#ifndef IPV6_FLAVOR
#define NON_VPN_TRAFFIC_RULES (dst=X.X.X.X,dport=80)
#else
#define NON_VPN_TRAFFIC_RULES 0
#endif

#endif

I need to add a new destination and port, and not totally sure if I should do it in this way:

#ifndef NON_VPN_TRAFFIC_RULES

#ifndef IPV6_FLAVOR
#define NON_VPN_TRAFFIC_RULES (dst=X.X.X.X,dport=80)
#else
#define NON_VPN_TRAFFIC_RULES (dst=Y.Y.Y.Y,dport=25)
#else
#define NON_VPN_TRAFFIC_RULES 0
#endif

#endif

Can you please confirm if this is the best way to do it or should I do it in a different way? Thanks.

Re: Simple question about excluding address in VPM domains

PhoneBoy — Sun, 14 Jun 2020 08:07:41 GMT

You should have one line defining NON_VPN_TRAFFIC_RULES.
You probably want something like:

#define NON_VPN_TRAFFIC_RULES ((dst=X.X.X.X,dport=80) OR (dst=y.y.y.y,dport=25))

Re: Simple question about excluding address in VPM domains

Gusa2727 — Sun, 14 Jun 2020 14:38:57 GMT

Yes, thank you. I did it in this way some days ago and it worked well. On the other hand, is there a way to exclude ICMP traffic? I tried something like this and it does not work:

#define NON_VPN_TRAFFIC_RULES (dst=X.X.X.X,prot=1)

Thanks!

Re: Simple question about excluding address in VPM domains

PhoneBoy — Mon, 15 Jun 2020 02:58:41 GMT

It's not prot, it's ip_p.
The language used in this is INSPECT, which used to be documented way back in FireWall-1 3.0.
Yes, I've been doing this...longer than that.

Re: Simple question about excluding address in VPM domains

PhoneBoy — Mon, 15 Jun 2020 04:22:39 GMT

See also the "fw monitor" expressions here if you want to get even more detailed.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk30583

Re: Simple question about excluding address in VPM domains

Gusa2727 — Mon, 15 Jun 2020 07:34:25 GMT

Really thanks for all the help!