Port 80, 443, 500 and 18264 are open on external interfaces, how to block it?

[Deepraj_Patil]

Hi All,

Our vulnerability scanner shown port 80, 443, 500 and 18264 are open on external interfaces of our firewall. We are not using SSL VPN or remote access VPN on this firewall but we have IPSec Site to Site VPN Tunnel on it. I have disabled few settings 

- VPN Clients > Desktops / Laptops Windows and Mac clients

- VPN Clients > Authentication > allow older client to connect this gateway

- VPN Client > Remote Access > Allow remote clients to route the traffic through this gateway

- Mobile Access > Web - SSL vpn with Web Browser

But still the above mentioned ports are open and as per SOC team they are insisting me to block access to this ports from the external word. I need help here can anyone please suggest what needs to be done fix this. 

[Chris_Atkinson]

If you have S2S VPN you probably don't want to block 500.

Solutions for the others are readily searchable.

[PhoneBoy · Accepted solution]

If you have any VPNs, port 18264 needs to be open for the CRL to validate VPN certificates.
If you do NOT have any Remote Access VPN users, then you could theoretically disable access on port 80/443.
UDP 500 is needed for any sort of VPN.

[CheckPointerXL]

Make a fake NAT rule to any sort of 127.0.0.x 🙂

[HeikoAnkenbrand · Accepted solution]

HI @Deepraj_Patil,

The following overview shows all open ports used by a Check Point gateway and management server.
https://www.checkpoint.tips/doc/Ports.pdf

Here is a picture (the same one can be found in the PDF)


Open Ports:
80        -> You should check this out (Static NAT to a web server , ...)
443      -> Multi Portal Daemon, Mobile Access Blade, Remote Access VPN, (Static NAT to a web server , ...)
500      -> IPSec VPN
18264  -> VPN Cert. fetch

In addition to UDP 500, the UDP port 4500 may also need to be open for NAT-T, ensuring VPN connections work properly when endpoints are behind NAT devices.

Here's what you can do:

• Change the position of rule processing under "Global Properties → Firewall" to "befor last" (Please proceed with caution)

• Create stealth rules on the firewall to block specific ports and access attempts.

[Deepraj_Patil]

Hi Heiko,

Thank you for the detailed information about the open ports.

Regards,

Deepraj