Stealth rule vs Management Rule

[mraogon]

AFAIK, management rule to allow/block certain hosts to manage the firewall itself and Stealth rule is to allow/deny To the box traffic.

Why do we have 2 different rules when they seem to inherently mean the same? 

Pardon my ignorance, I am only starting off with checkpoint.

Regards,

F/W enthusiast

[Nick_Doropoulos · Accepted solution]

Hi mraogon,

Welcome to the forum!

The two rules differ in what they try to accomplish as follows:

- The Management Rule is meant to match "management" traffic to the box from trusted sources. The purpose of the management rule is to ensure that only the specified sources can access the firewall. It would be typically placed towards the top of your rulebase.

- The purpose of the Stealth Rule, which would typically follow the Management one, is to drop traffic to your firewall initiated from any source. This is something you want since the authorised administrators' traffic will have been matched by the management rule.

I hope this helps.

[mraogon]

Thank you very much Nic, that makes sense now.

Doesn't default rule have the same nature or it only applies for through-the-box traffic? Or is it that I am placing stealth rule just to keep track of attacks etc with the help of logging?

[PhoneBoy]

I assume by default rule you mean the implicit drop rule.
First, it's best practice to put an explicit drop rule at the end of a policy layer with track set to log.
This will ensure you can see all traffic not permitted by the policy.
Second, your stealth rule should be logged as well.
Logging them at different rules does generally help with finding entries specifically directed at your firewall.