Comodo Firewall assuming allow status

I noticed this behavior on another program, then i tested it on my browser and it worked !!!
I was trying to make an ask rule for each new IP.

So I edited my web browser rule FROM “predefined - web browser” TO “use custom policy”,
then copied the “predefined web browser rules” but changing the second rule “allow outgoing HTTP request” TO “ask” while keeping everything in this “allow outgoing HTTP request” rule the same. and all other copied rules stayed untouched.

when I go to an http site I get an alert of that site ip, after allowing that when I go to another http site, I get no alert and the site is assumed allowed with no alert.

again if I go to an https site I get an alert the first time, after allowing it then there will be no more alerts from other https sites and all will be allowed automatically.

so Comodo here is acting as port sensitive not as IP sensitive…

What is your alert frequency level? Are you using Remember my answer when answering the alerts? Could you try doing the same test again but this time make sure you don’t tick in Remember my answer and when you get an alert but no more alerts then close all processes of that application, open it again and see if you get an alert again but not subsequent alerts?

It sounds to me like this could be a result of alert frequency level, perhaps if it’s set to High or lower and not Very High but it could be something else. (From my understanding Very High is the only setting that is also based on IP addresses and not only ports)

Actually before posting I decided to try it out myself, for Google Chrome I changed it from the pre-defined web browser rule to custom and copied from web browser and then changed the second rule, i.e http requests to Ask from Allow and then clicked OK on all relevant windows. (note I have alert frequency on Very High) I then started Google Chrome which tried to go to PayPal for some reason, got tons of IP alerts, allowed all of them without having Remember my answer ticked and then changed website to sweclockers.com, was alerted about all IP addresses and allowed them in the same way, then moved on to forums.comodo.com and again got alerts for IP addresses and allowed them.

So as you can see from the above I am unable to replicate, as I mentioned before, please check your Alert Frequency Level setting, it’s in the advanced settings for the firewall.

I always make sure that I don’t tick in Remember my answer.
I always have the alert frequency to very high.
edit (adding): by the way, the firewall is in custom mode and comodo in proactive.

Now you told me. I see that high is port based and very high is port and IP based.
apparently on my case very high is acting like high !!!

I’ll do some reinstalling and try some fixes, because it looks like I’m the only one affected by this.
Be right back soon…

Alright, hope it works out!

Another thing you could do is to also tick Remember my answer and then look at what rules are created when you answer the alert.

The bug exist only on comodo version 5.x
there is no bug using versions 6.x and 7.x

I tried everything but couldn’t make it to work on version 5.x (high = very high)

There is NO venerability when using the latest version of comodo 7 regarding this issue.
Thank you for your help and Sorry for any inconvenience.

It is working now in version 5.x as long as I tick every alert Remember my answer then all subsequent alerts will show, and the very high level is a real very high, IP based.

but after each session I need to delete the rules, still it is working. thanks very much for the work around.