Alert on localhost connections?

[Guest]

[amews_aj]

bump

[Toggie]

Have you upgraded to 3.0.14.276 yet? It now directly supports loopback networking in the firewall. However, it doesn't appear possible, yet, to create rules/alerts for inbound loopback networking.

[amews_aj]

Still not working as I would like it to.

[gibran]

Still not working as I would like it to.

Please would you mind to describe the actual beaviour and the desired one?

[amews_aj]

Whenever ANY program is trying to open a connection, I want an alert. Even though the connections are only localhost. This is not the case with comodo now.

Maybe some don't want it to, but I do. Make it an option.

[sded]

What version of CFP3 are you currently using?  Do you have a rule "allow access to loopback zone" under your predefined policies for web browser, email client, other applications that might access localhost?  Try editing by clicking the "log" function see if the connections are logged.  Works for me, but seems a bit erratic-will check a little further and play with my proxies a bit.

[sded]

OK, some further observations of some of the alert characteristics.  You need to try it with your particular applications of concern.  But you can generate alerts on localhost connections.
1) It looks like applications that make multiple localhost connections in a single run may not log them all.
2) With a proxy (like Avast!) in the connection path, what gets logged is the proxy address, not the destination path in the application.  (For Avast! that means the log will show 12110 and 12080 as the destination ports in local host).
3) Loopback to loopback stuff doesn't seem to get logged at all (Avast! to Stunnel in my case).

I have not tried to be exhaustive, but it looks like a place to start is by adding the log to whatever loopback you already have.  And the proxy ports all need to be part of the allowed ports.

[amews_aj]

I don't see any logs or alerts. I don't want logs really, I want alerts.
X is trying to connect to...

The application is not allowed.

I used the second public release, don't remember version number.

The big disappointment is that every other firewall I've tried DOES alert me. comodo doesn't.
I tried enabling highest security, remove all apps in firewall list, no change.

[sded]

You should be using version 3.0.15.277, which had a number of fixes from the initial public releases.  Are you using custom policy mode with very high alert settings for the firewall?  And have you set D+ to paranoid mode and set access rights for loopback networking to block?

[amews_aj]

I "USED" it, I uninstalled it due to this...

Due to the releasenotes .277 has nothing to do with this problem, I had the previous (275?) one.
I had anything on default, and then topped al settings to the highest possible.

Yes, I also tried blocking localhost connections, and this had no effect whatsoever.

[amews_aj]

Any more information?
Will it be changed in future releases?

[amews_aj]

Nobody knows ?

I thought that  (R)
but if comodo seems to be the only firewall not doing this, it would mean that comodo 

[sded]

Sorry; don't know what Comodos plans are- I don't work for them.  You might try posting in the feedback/comments section where Melih and some of the developers might read it.  Or I can move this thread for you.   You can try changing the block rules discussed in my previous post to "ask" and see if you get a popup for them-"ask" does not work in my system, so can't evaluate it.  Also new version 3.0.16.295 is out, but not change log.  You may want to try that also.

[amews_aj]

It did not work when I tried making ask rules.
I would like to see changelog before upgrading.
Please move this topic.

[egemen]

It did not work when I tried making ask rules.
I would like to see changelog before upgrading.
Please move this topic.

Can you tell me how you test please? You should have received outbound loopback connection alerts from the firewall.

Egemen

[Tags:]