topic Re: Redirect public port 443 to internal 443 server. in Spark Firewall (SMB)

Redirect public port 443 to internal 443 server.

PaCuS — Wed, 30 Apr 2025 20:40:47 GMT

Redirect public port 443 to internal 443 server.

Firewall: Checkpoint Quantum Spark 1800 Appliance

I need to publish an internal web service 443 to public IP 443, it can not be another port due to project specifications.

The first problem is that the remote access via VPN “takes over” the 443. If I change the port 443, then the next service that “takes over” is the “SSL Network Extender”, so I can never be able to serve a web server via 443 with access through the internet.

Can anyone help me?

Thanks.

Re: Redirect public port 443 to internal 443 server.

Chris_Atkinson — Thu, 01 May 2025 11:26:14 GMT

So you've already manipulated the following option?

Device > Advanced > Advanced setting: "Remote Access VPN - Reserve port 443 for port forwarding"

Re: Redirect public port 443 to internal 443 server.

the_rock — Thu, 01 May 2025 11:37:34 GMT

For what is worth, below are steps from chatgpt.

Andy

**********************

To redirect public port 443 to an internal server on port 443 using a Check Point SMB appliance (such as a 1400/1500 series), you need to configure Port Forwarding (NAT Rule) and Access Rule (Firewall Rule). Here's how you can do it via the Web UI:

✅ Step-by-Step: Port Forward 443 to Internal Server

🔧 1. Log into the Web UI

Open a browser and go to: https://<firewall-ip>
Log in as admin

🔁 2. Create a Port Forwarding (NAT) Rule

Go to Network > NAT
Click Add
Fill in:
- Name: HTTPS-Forwarding
- Service: HTTPS (TCP 443)
- Incoming Interface: Choose the external WAN interface
- Destination IP: Leave blank or use the firewall's public IP
- Translated IP: Enter the internal server's IP (e.g., 192.168.1.100)
- Translated Port: Leave blank (or use 443 if needed)

This tells the firewall to forward traffic hitting port 443 to the internal IP.

🔥 3. Add a Firewall Access Rule

Go to Firewall > Access Policy
Click Add Rule
Set:
- Source: Any or specific source IP/range
- Destination: Firewall's external IP
- Service: HTTPS
- Action: Accept
- Install On: This Gateway

✅ 4. Save & Apply Changes

Click Apply Changes at the top

🧪 Optional: Test It

From outside your network, open a browser and go to https://<your-public-IP>
It should forward you to your internal server

Re: Redirect public port 443 to internal 443 server.

PaCuS — Thu, 01 May 2025 16:41:37 GMT

And how do I configure the VPN client connections to work?

Re: Redirect public port 443 to internal 443 server.

PaCuS — Thu, 01 May 2025 16:46:53 GMT

And how do I configure the VPN client connections to work?

Re: Redirect public port 443 to internal 443 server.

the_rock — Thu, 01 May 2025 18:28:04 GMT

Might also be worth open TAC case to verify.

Re: Redirect public port 443 to internal 443 server.

PaCuS — Thu, 01 May 2025 18:37:07 GMT

They have not been able to give me a solution of any kind. (It's no joke).

Re: Redirect public port 443 to internal 443 server.

the_rock — Fri, 02 May 2025 23:18:53 GMT

I cant say for sure unless I saw why its failing and do some troubleshooting/debug. I would test port 18234, which is tunnel test packets.

fw monitor -e "accept port(18234);"

Andy

Re: Redirect public port 443 to internal 443 server.

Chris_Atkinson — Sat, 03 May 2025 02:01:03 GMT

Per the advanced option I mentioned above did you both change the port and tick the option to reserve 443 for port forwarding?

Also is this a centrally or locally managed device...

Re: Redirect public port 443 to internal 443 server.

the_rock — Sat, 03 May 2025 02:22:49 GMT

Hey Chris,

I believe that option you mentioned initially is for locally managed, I saw it on demo point lab...what would be equal if its centrally managed one?

Andy

Re: Redirect public port 443 to internal 443 server.

PaCuS — Sat, 03 May 2025 15:40:57 GMT

I didn't quite understand what you mean by local or centralised management.

My question is the following, once I change the port for VPN.
How do I configure the VPN client with the new port? For example 444.

PS: This Monday I plan to try all this again.

Re: Redirect public port 443 to internal 443 server.

the_rock — Sat, 03 May 2025 16:11:50 GMT

What we mean is is it managed by management server or on its own? You could try delete the site on client and then re-create it as vpn.mycompany.com:444 or whatever new port is and try, BUT, not sure if that would work if you change it on gw side, but give it a go.

Andy

Re: Redirect public port 443 to internal 443 server.

PaCuS — Sun, 04 May 2025 23:39:40 GMT

I have only managed to do the 443 redirection through one of the 2 WANs.

I can't do it with the 2nd WAN. 😕 (it only shows "This Gateway" and defaults to the first WAN)
VPN is overridden... I can't configure any vpn client with any different port. Example used vpn.compañia.com:444 (not working)

Re: Redirect public port 443 to internal 443 server.

the_rock — Sun, 04 May 2025 23:41:14 GMT

Does it even let you create a site using port 444?

Andy

Re: Redirect public port 443 to internal 443 server.

PaCuS — Mon, 05 May 2025 06:53:28 GMT

I've tried at least hehe But he hasn't left me. I don't care about the VPN issue. What really matters to me is the initial topic of the post and that it doesn't let me do it through the second WAN, only in the first.

Re: Redirect public port 443 to internal 443 server.

the_rock — Mon, 05 May 2025 01:12:41 GMT

K, hang on, now Im little confused. Are you trying to get this working via custom port or 2nd wan link?

Andy

Re: Redirect public port 443 to internal 443 server.

PaCuS — Mon, 05 May 2025 06:55:04 GMT

I have 2 WANs, I want to use one of the 2 WANs (public ip that corresponds to the second WAN, not the first). It's only working for me with the first one.

Re: Redirect public port 443 to internal 443 server.

PhoneBoy — Mon, 05 May 2025 20:58:59 GMT

Central Management: using a Smart-1 and SmartConsole.
Local Management: using device's WebUI and/or SMP

As far as I know, SMB devices only support "Visitor Mode" (used for Remote Access VPN) on TCP 443 only and cannot be changed.

Re: Redirect public port 443 to internal 443 server.

PaCuS — Thu, 08 May 2025 09:28:00 GMT

Hello,

It can be changed, I changed it to 444 and I could use the 443 for the internal service I was interested in (for one of the 2 WAN I have, but it only lets me for one of the two), but this has caused that it has been cancelled to be able to use VPN, even if it is for 444, it is dropping the requests for 444.

There are two problems here right now.

1. VPN does not work.
2. I cannot use 443 redirection with the 2nd WAN.

Re: Redirect public port 443 to internal 443 server.

the_rock — Thu, 08 May 2025 10:45:29 GMT

1) When you say does not work, does that mean site cant be created or it can be but then people cant connect to anything internally?

2) 2nd WAN, are you even able to create site on that IP to begin with?

Andy