1/3
443 port Unexpected open HTTPS port 443 investigation
  

George Fady Lv2  Posted 2026-Oct-21 14:30

Hello Sangfor Community,
I am George Fady, Technical Support Engineer, and I would like to share a practical troubleshooting case related to an unexpectedly open HTTPS port on Sangfor NSF.
Problem Description
A customer ran an external port scan against the firewall’s public IP and found TCP 443 open, although no firewall policy allowed inbound 443.
Environment:

  • Product: Sangfor NSF V8.0.85

  • Behind the firewall: a 3CX PBX using the same public IP

  • Symptom: 3CX links showed “Your connection isn’t private” (NET::ERR_CERT_AUTHORITY_INVALID)

The customer wanted to understand why the port was open without a policy and to use 443 for their 3CX mobile application.
Root Cause
The NSF web console (WebUI) was listening on its default HTTPS port, 443, on the WAN IP.

  • The certificate shown on the 3CX domain was issued to and by “SANGFOR”. This is the firewall’s default self-signed certificate, not the 3CX certificate.

  • Security policies only control traffic passing through the firewall. Traffic to the firewall’s own services is handled by its local services, so the port showed as open without a policy.

Resolution Steps

  • Confirm which device answers on 443 by checking the certificate presented on the public IP.

  • Rule out other causes: SSL VPN login port (Network → SSL VPN → Login Options) and DNAT rules (Policies → NAT → IPv4 NAT).

  • Before changing anything, create the object and policy required for the new WebUI port and make sure you have a management path you can still reach.

  • Change the WebUI HTTPS port from 443 to 11443:
    System → General Settings → Web UI

  • Access the console at https://[interface IP]:11443 and assign 443 to the 3CX service.

  • Rescan the public IP and confirm 3CX answers on 443 with its own certificate.

Key Takeaway
An open port with no matching security policy often means a local service on the firewall itself, not a policy problem. A “SANGFOR” certificate appearing on another service’s domain is a strong clue that the WebUI is answering.
Changing the WebUI port is a global setting. Prepare the object and policy first, as we lost console access in this case and had to recover locally through the management port.
When troubleshooting an unexpected open port, check:
Certificate Presented → WebUI Port → SSL VPN Port → DNAT Rules → Local ACL / Policies
Where possible, manage the firewall from the LAN or management interface rather than the WAN.
I hope this troubleshooting case helps other engineers working with Sangfor NSF.
Feel free to share your experience with WebUI port conflicts and publishing services behind the firewall in the comments.
#Sangfor #SangforNSF #NSF #Firewall #WebUI #Troubleshooting #TechnicalSupport #NetworkSecurity

Like this topic? Like it or reward the author.

Creating a topic earns you 5 coins. A featured or excellent topic earns you more coins. What is Coin?

Enter your mobile phone number and company name for better service. Go

Humayun Ahmed Lv4  Posted 2026-Oct-21 14:58
  
Thanks to share!