Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
mraogon
Explorer

Stealth rule vs Management Rule

Jump to solution

AFAIK, management rule to allow/block certain hosts to manage the firewall itself and Stealth rule is to allow/deny To the box traffic.

 

Why do we have 2 different rules when they seem to inherently mean the same? 

 

Pardon my ignorance, I am only starting off with checkpoint.

 

Regards,

F/W enthusiast

0 Kudos
Reply
1 Solution

Accepted Solutions
Nick_Doropoulos
Advisor

Hi mraogon,

Welcome to the forum!

The two rules differ in what they try to accomplish as follows:

- The Management Rule is meant to match "management" traffic to the box from trusted sources. The purpose of the management rule is to ensure that only the specified sources can access the firewall. It would be typically placed towards the top of your rulebase.

- The purpose of the Stealth Rule, which would typically follow the Management one, is to drop traffic to your firewall initiated from any source. This is something you want since the authorised administrators' traffic will have been matched by the management rule.

I hope this helps.

View solution in original post

3 Replies
Nick_Doropoulos
Advisor

Hi mraogon,

Welcome to the forum!

The two rules differ in what they try to accomplish as follows:

- The Management Rule is meant to match "management" traffic to the box from trusted sources. The purpose of the management rule is to ensure that only the specified sources can access the firewall. It would be typically placed towards the top of your rulebase.

- The purpose of the Stealth Rule, which would typically follow the Management one, is to drop traffic to your firewall initiated from any source. This is something you want since the authorised administrators' traffic will have been matched by the management rule.

I hope this helps.

View solution in original post

mraogon
Explorer
Thank you very much Nic, that makes sense now.

Doesn't default rule have the same nature or it only applies for through-the-box traffic? Or is it that I am placing stealth rule just to keep track of attacks etc with the help of logging?
0 Kudos
Reply
PhoneBoy
Admin
Admin
I assume by default rule you mean the implicit drop rule.
First, it's best practice to put an explicit drop rule at the end of a policy layer with track set to log.
This will ensure you can see all traffic not permitted by the policy.
Second, your stealth rule should be logged as well.
Logging them at different rules does generally help with finding entries specifically directed at your firewall.
0 Kudos
Reply