topic Re: Check point "Internet" object in General Topics

Check point "Internet" object

Mikula83 — Tue, 08 Jul 2025 08:27:17 GMT

Hello,

I have found in logs that Check Point doesn't include all public ip addresses when using "Internet" object in policy.

Can you give me explanation about this behaviour.

Instead of using "Internet" object I have made a workaround using public IP address ranges:

1.0.0.0 - 9.255.255.255

11.0.0.0 - 126.255.255.255

128.0.0.0 - 169.253.255.255

169.255.0.0 - 172.15.255.255

172.32.0.0 - 192.167.255.255

192.169.0.0 - 223.255.255.255

Re: Check point "Internet" object

Tal_Paz-Fridman — Tue, 08 Jul 2025 08:47:25 GMT

Please look at this SK

https://support.checkpoint.com/results/sk/sk64543

Re: Check point "Internet" object

Chris_Atkinson — Tue, 08 Jul 2025 09:55:09 GMT

How are you using this object in your policy and what is the topology of the gateway defined like?

More information will assist us in clarifying the behavior for you, further to the resource provided by @Tal_Paz-Fridman

Re: Check point "Internet" object

_Val_ — Tue, 08 Jul 2025 10:03:29 GMT

As @Tal_Paz-Fridman already mentioned, the "Internet" object is a function of your GW topology.

Re: Check point "Internet" object

Mikula83 — Tue, 08 Jul 2025 14:17:39 GMT

I have attached to you "Topology" and "Policy" picture for better understanding. When I used "Internet" object as destination in Internet inline layer instead of public IP ranges (on picture red rectangle) some ntp services were dropped although rule 6.4 says "Permit all" so I have to create rule id 7 and permit ntp service.

Where is mistake?

It works before but not for all public ip addresses.

Re: Check point "Internet" object

Timothy_Hall — Tue, 08 Jul 2025 18:32:43 GMT

Exactly, one quirk with object Internet is that traffic entering a VPN tunnel will not match it, even if the traffic is leaving on the External interface.

Re: Check point "Internet" object

PhoneBoy — Tue, 08 Jul 2025 19:06:37 GMT

The various ways to describe the Internet are discussed in this thread: https://community.checkpoint.com/t5/Management/Properly-defining-the-Internet-within-a-security-policy/m-p/10561

The object "Internet" can only be used with App Control/URL Filtering rules.
The rules you showed in the screenshots below can all be matched on simple TCP/UDP services.