Check Point URLF for inbound traffic

[Arun_Malipatil1]

We use Check Point URL filtering for controlling the access to websites hosted outside the organization and we follow blacklisting mechanism to block access to a particular website. Now, in my scenario, I have a web server(behind the CHKP FW) hosting multiple websites using the same IP(10.10.10.100--NATed-to-a-public-IP-on CHKP) and port 80 for all the websites. The differentiation of each site can be done using the HTTP unique attribute called Host Header.

My Questions:

1. Is there a way we can use URL filtering to block access to a few of my webserver from the Internet?

2. If not, do we have any other way?

Note: As both IP addresses and Port numbers are same for all the internal web servers I cannot use NAT and FW rule base to block certain sites.

[G_W_Albrecht]

My first question is : what do you want to achieve with this setting ? You do have several virtual servers hosting websites on one server with identical IP and port, so if you do not want anyone from internet connect to some websites, just unpublish them. For having internal (blocked from internet access) and public servers i would just use a different configuration...

[Arun_Malipatil1]

As customer was performing internal audit which led us to such requirement and without making any changes on servers. 

[PhoneBoy]

You should be able to achieve this with Application Control, possibly using custom signatures generated with the Application Control Signature Tool.

[Arun_Malipatil1]

• Thank you PhoneBoy! Where I can find the AppCtrl signature tool? Do we need to contact support team? 

[Wolfgang]

Inbound URL-Filter works like outbound URL-filter. The same way you can block from your internal clients access to www.my-webserver.com you can do from external. Define your webserver as website in the URL-Filter-blade and configure a block rule with these website. You have to enable URLF-blade for this.

You don't need the  AppCtrl signature tool, it's all based on the URLs. 

Wolfgang

[PhoneBoy]

The only reason I suggested the ACST was because, depending on the requirements, it may not be sufficient.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...