> Source: [sk24600](https://support.checkpoint.com/results/sk/sk24600)

# sk24600 - X11 traffic and "Other" service types dropped, even with "Any, Any, Accept" rule

| Property | Value |
|----------|-------|
| Solution ID | sk24600 |
| Date Created | 2004-01-11 |
| Last Modified | 2019-05-21 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- X11 traffic is dropped, even with an "Any, Any, Accept" rule.

## Solution

There are two reasons why it is not enough to uncheck the "Match for Any" box in the Advanced Properties of the X11 service:

1. Unchecking the "Match for Any" box does not imply that X11 connections (i.e., TCP port 6001) will not match an "Any" rule. It only means that if X11 connections match an "Any" rule, X11 connections will not get the specific treatment they would have gotten if X11 connections had matched a rule with the X11 service. For example, if the FTP service did not have "Match for Any" box checked, then TCP connections on port 21 would have still gone through if they matched an "Any" rule. The Security Gateway would not have been able to analyze PORT or "227" commands and translate the IP address/port number sent inside those commands.  

   If the service is defined with a specific timeout, the connection will get the default timeout (unless it matches a rule with this specific service). If "Match for Any" box is checked, this "special treatment" is applied, even when the connection is matched against an "Any" rule.   

2. Even if Check Point created a mechanism that acts differently, it would still have certain drawbacks. Take the following Rule Base for example:   

   |-----------|-------------|---------|-----------|--------|
   | Source    | Destination | Service | Action    | Track  |
   | VPN_group | VPN_group   | `Any`   | `Encrypt` | `Log`  |
   | `Any`     | `Any`       | `X11`   | `Accept`  | `None` |

   <br />

   In this case, X11 connections between two machines in the VPN_group may pass unencrypted, if X11 connections do not match an "Any" rule, and would continue going over the Rule Base. Note that this is a schematic Rule Base, and there may be many rules in between.

The rule number for the rejected X11 packet is not stated in the SmartView Tracker, because of the following:   
The X11 connection is in fact "Accepted" by the Rule Base, but is later rejected by another mechanism (called the Session Handler), which does not have any information about rule numbers.   

The log it generates explains why this connection is rejected:   
"X11 is not allowed through service 'Any'. To enable, create an earlier rule that explicitly allows X11."   

**Note:**   
All services of type "Other" and X11 (which is a very special case) require a specific rule, since these services run specific INSPECT code, and are not just "Accepted".

*** ** * ** ***

**Related solution:** [sk41749 (X11 traffic is being dropped, even with "Any, Any, Accept" rule)](http://supportcontent.checkpoint.com/solutions?id=sk41749).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content