This is the general description of the packet flow through the Host Security Appliance:
For additional information, see this thread on the Check Point CheckMates Community:
https://community.checkpoint.com/docs/DOC-3041-r80x-security-gateway-architecture-logical-packet-flow