Forbidden from external, when MultiPortal / UserCheck is active

[morris]

Hey guys,

GaiaPortal is configured for port 4434.
UserCheck is active on port 443.

Internetaccess on port 443 results in "Forbidden - You don't have permission to access this resource.". No Log is created. Neither access nor drop.

Internetaccess on port 4434 results in a timeout and a log is created on the stealth rule.

The Accessibility is configured according to the firewall policy. If it is changed to "internal interfaces only" nothing changes. The forbidden messages still shows.

I assume that this has something to do with the MultiPortal feature. Is there any way to make it a timeout from external? I found no other options to configured.

Shodan shows a lot of information which should not be available imho.

[Chris_Atkinson]

Presume that you're not logging "implied rules" in global properties or similar?

The following articles may be helpful for you:

sk105740 - HTTP and HTTPS requests to external interfaces create implied rule 0 accepts in Logs & Mo...

sk180808 - Security Gateway accepts HTTP/HTTPS traffic by an implied rule for its HTTP/HTTPS Web Por...

[Lesley]

Maybe traffic hits in the IPS/AV blade etc. Traffic from the internet towards you sometimes can also show user check portal.

I made 2 rules to exclude public IP ranges from this.