Stealth Rule

[Prashan_Attanay]

Checkmates,

May be this question is bit stupid, But i want to know if stealth rule implemented like this we don't have access to firewalls (like ssh) right ?

BR

[Timothy_Hall]

Correct, typically prior to the Stealth Rule you'll have rules such as:

1) Admin. Access - SSH/HTTPS/4434 to the firewall from trusted internal hosts/subnets

2) Ping/Traceroute - Can internal hosts ping the firewall itself, and will the firewall hop show up in traceroute path or "star out"

3) SNMP Monitoring traffic from an NMS to the firewall itself

4) dhcp-request/dhcp-reply/DHCP relay services if needed

5) Allow for Dynamic Routing Protocols & VRRP if firewall is configured for those

There are some other corner cases (Legacy Client Auth, old versions of SecuRemote and such), but generally these are the only rules you should have in front of the Stealth rule.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.