Close Default Open Ports

[Lockout888]

I have a Cleanup Rule any/any to drop traffic from the Internet, but a Shields Up scan from grc.com shows I have several ports open by default:  80, 264, 443 and 444.

What configuration changes do I need to "stealth" these ports?

[PhoneBoy]

80/443 is Multiportal.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
Port 264 is related to a Remote Access implies rule, go to Global Properties > Firewall > Accept Remote Access Control Connections, uncheck this, and install policy.
Port 444 is not one of our standard ports and may be related to your specific configuration.

[Lockout888]

I set the Platform Portal Accessibility settings to "Through internal interfaces" with no options checked per the SK solution.  I verified my Topology settings are correct (eth1 = external and Mgmt = Internal).

I am still getting implied Rule 0 accepts for 443 and 80 in the logs. This is a Standalone configuration if that matters.

The SK other solution says:  "In case you do not want to allow any connections to the Security Gateway's portals , add a rule that drop this traffic."

How do I add a rule that will drop the traffic of an implied rule?

[PhoneBoy]

See also: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Lockout888]

Thanks PhoneBoy, I think that did the trick.

SecurePlatform and UserCheck were both set to "internal_interfaces" but SmartView was set to "all_interfaces".

I set that to internal_interfaces, saved and installed policy.

The implied rule 0 accepts on 443 and 80 seem to have stopped, and now GRC Shields Up reports those ports as Stealth 🙂

[KernelGordon]

You can follow sk115600 to disable the implied rules. I would not recommend doing this however as you will have to create explicit rules to replace the implicit rules and this usually just leads to a lot of headaches.