Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Ana_11
Participant

block port 443 and 80 and 18264 on checkpoint external firewall

Hi 

Can someone tell how to block port 443. port 80.port 18264 on external interface of checkpoint firewall

5 Replies
Vladimir
Champion
Champion

You'd have to change the management port in Gaia, individual default portal ports in the properties of the gateway, manually define explicit rules for management access on top of your security policy, change Global Properties properties by disabling Implied Rules pertaining to management.

After it is done, implement NAT to Null IP as per @HeikoAnkenbrand answer in this post: https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/How-to-disable-Gaia-access-from-t...

 

Cheers,

 

Vladimir

PhoneBoy
Admin
Admin

If you have any VPNs (client or site-to-site) or gateways that you manage from the Internet, you cannot disable TCP 18264 (used for certificate revocation) and expect that to continue working.
HTTPS is used for Visitor Mode on Client-to-Site VPNs and for clients to obtain their initial configuration, thus this may break some clients ability to use VPN.
HTTP mostly just redirects to HTTPS but it should be blocked if you put in an explicit rule to do so.

Hi @Ana_11;

THX to  @Vladimir

Here the solution: Add an static NAT rule and NAT it to null IP:-)

src: internet
dst: portal ip
port: portal port
NAT src: internet
NAT dst: static NAT to null IP for example 127.0.0.99
NAT port: portal port

0 Kudos
ham2065
Explorer

Hi 

I have this issue as well (http/https open on external interface gateways). We used to use Mobile Access but I disabled the Mobile Access blade about a year ago and afaik have no use any Multi Portal functions on the external interface. 

I found this article sk155512 - 

How to determine which portal is causing MultiPortal to respond on external interface


Is this relevant in this case? The article states - "MultiPortal creates an implied rule and accepts traffic on port 443 or port 80 if a portal is set to be accessible from All Interfaces. This setting might persist even if the blade was later disabled. This can be changed in the following manner:"

The article is very vague with instruction such as - 5. Change the setting accordingly. I tried to follow the article along in GuiDBedit but could not work out what to do. 

A while back I opened a support ticket with Checkpoint but got nowhere with it. 

0 Kudos
PhoneBoy
Admin
Admin

If you're talking about ports 80/443 to the gateway itself, MultiPortal is definitely involved.
Screenshots of where precisely you're confused might help.

0 Kudos