Hello.
Today after closing Steam, Comodo blocked 8 intrusions from Windows Operating System, normally this process try to connect to the internet from my personal IP, but today it tried to connect to my computer from an external IP, it was 205.185.220.133 from the door 27018 to my IP and the door 54792.
This is the first time Comodo blocked something like this, and I would like to know if there is someone trying to access my computer.
Edit: I used steam again and after closing it, the number of intrusions blocked changed from 8 to 14 and the IP too, its an UDP connection from 72.165.61.185 from the door 27018 to my IP and the door 26901.
I was using Comodo in game mode.
When you see WOS logged it means that CIS cannot see the process. In case of incoming traffic it sees no program listening and then CIS will log that the traffic was blocked by WOS.
In case of outgoing traffic and CIS cannot see the process generating it it will log that WOS is trying to connnect. This is caused by another program’s driver blocking the view for CIS.
Is Steam using port 54792 for incoming traffic? I think what you see if the Steam servers trying to connect for 8 times and after that 8 times Steam servers figured out you were off line and stopped connecting to you.
The IP address is from a big hosting company. I guess the Steam servers may be hosted there.
That may be it, a few moments ago I started Steam with the Firewall menu open to see the IPs the program was connecting and I found one of them, the 205.185.220.133, probably the other one is too from Steam.
Thank you for your help. ;D
so this is the reason why i cant get my openVPN IP replaced by my real ISP ip ?
i got a firewall alert telling Windows Operating system : Blocked : UDP in : dest ip is VPN ip : dest port is the one i’m connected to the VPN server : and my source ip is my local ip on my real NIC : and port is 443.
okay, how is it possible that comodo is using a process that doesnt exist and decide to use it to block my traffic ?
is there a bug somewhere in the firewall ?
I had this windows operating system alert thousand times on all kind of programs.
So i created a rule with a process called Windows operating system (that we just dont know anything about what can it be,) UDP in on source port 443 and now it works !
is it me or how can we allow a thing unknown with a generic name and the unknown thing is not blocked anymore ??
and what if something else unknown but that should not be allowed uses the same UDP in on port 443 ?
it will be allowed I imagine ?
this windows operating system alert is a problem, how can I create a rule as the process is unknown ?
that gives no sens to me.
I don’t know what to do with this.
I’m not going to use another firewall, they’re all… well i don’t like them, comodo is the only one we got for windows that is really a great firewall (there’s no serious competitors for PC users, it’s just my opinion but I tried all others for long time until I found comodo team in 2007, at this time I was sure that online armor was the best FW then we started to test firewalls with other people at comodo forum and after a lot of tests coded to bypass firewalls using all kind of approach, I woke up from my certainty based on no real fact except my stupidity, I thought I was so smart that my firewall choice couldn’t be wrong…
My so great firewall was bypassed by tests without any alert at all… lol, as comodo was blocking all that.)
okay, sorry about this useless part above but there is a possibility that comodo will be able to create an alert with the real process instead of windows operating system in the future or it’s not possible because of a driver used by some app blocking comodo view.
so there will be no work around for that ?
This has always been the case with CIS firewall.
If you see a connection you want, allow it. Otherwise block it until you can determine what it was/is. This is a safe process to protect you and your computer.
Its a placeholder word for blocked things which even got not concidered important enough to be looked up about their destination by using resources.
Blocked before given a name.
You should not allow things that you dont know. Nothing that is not necessary (you will know if you need something).
Especially nothing ingoing.