topic How to disable http redirect on multiportal/visitor mode in Spark Firewall (SMB)

How to disable http redirect on multiportal/visitor mode

Soenke_Weiss1 — Fri, 25 Jul 2025 11:52:09 GMT

Hello,

My customer is using visitor mode so multiportal is running on the external interface. traffic to https://pu.bl.ic.ip is dropped on multiportal correctly. All good so far. But curling http://pu.bl.ic.ip we receive a redirect to the internal IP address like this:

master@myhost:~# curl -v -k -H "Host:" http://pu.bl.ic.ip
* Trying pu.bl.ic.ip:80...
* Connected to pu.bl.ic.ip (pu.bl.ic.ip) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.88.1
> Accept: */*
>
* HTTP 1.0, assume close after body
< HTTP/1.0 301 Moved Permanently
< Location: https://in.ter.nal.ip
<
* Closing connection 0

Traffic is still dropped on multiportal and port 80, all good, but:

Problem is that Nessus is reporting this as a really old IIS related vulnerability (refer to Solved: CVE-2000-0649 Vulnerability - Check Point CheckMates ) plus my customer understandably doesn't want his internal IP disclosed externally.

This is on a Spark 1900 appliance, I don't know whether it'S specifically for this appliance or if 'Real' GAiA has the same behaviour.

How can I disable this redirect?

Thanks,

Soenke

Re: How to disable http redirect on multiportal/visitor mode

the_rock — Fri, 25 Jul 2025 13:20:44 GMT

What does mpclient list command show?

Andy

Re: How to disable http redirect on multiportal/visitor mode

PhoneBoy — Fri, 25 Jul 2025 14:08:31 GMT

SMB devices don't have multiportal @the_rock but they do have the redirect on port 80.
The first part of this (setting the multi_portal_allow_redirect kernel variable to zero) should fix this.
https://support.checkpoint.com/results/sk/sk165937

Re: How to disable http redirect on multiportal/visitor mode

Soenke_Weiss1 — Wed, 30 Jul 2025 14:06:13 GMT

Thanks PhoneBoy, this works on SMB appliances as well.

Re: How to disable http redirect on multiportal/visitor mode

the_rock — Wed, 30 Jul 2025 14:15:15 GMT

Good to know!