Comodo Firewall and Firefox/VLC localhost issue.

Comodo Internet Security - CIS Resolved/Outdated Issues - CIS
1

I feel like this may be a bug within Comodo Firewall. I have Comodo Internet Security Premium (Free Version) and have been very happy for years. However, recently I noticed that some of the messages from the firewall the come up are rather “odd”.
When I launch some of my programs. Specifically Firefox, VLC, THX Tru Stuio Pro; Comodo Firewall reports them as wanting to connect to locahost:xxxx where xxxx is a random port number. Clicking allow will let the application continue connecting to the internet without any further popups.
According to mozillazine,

Firefox and Mozilla use network sockets for communication between the browser and the separate module that handles connections to secure websites (among other things). It's a convenient way of doing the communication which works the same in Windows, Linux, and other versions of Mozilla and Firefox.

So I am assuming that VLC and THX do similar things. I believe this to be a bug because Comodo doesn’t warn about the internet connection that is being made! I have attached some files to show what I am talking about. Process Explorer reported that vlc was listening on 3539. If I click allow, vlc will connect to the update server, or wherever you told it to go. The other screenshot is a different instance of vlc and it shows the full connection through localhost to the update server (the ports seems to be random each time)

This is only half the story

If I de-select the “Filter Loopback Traffic” the message show up as intended where Comodo warns about connections to the internet but not localhost. So shouldn’t “Filter Loopback Traffic” allow me to see warnings for both 127.x.x.x AND internet addresses?

If you are confused of my question I will try to clarify :slight_smile:

Thanks

!ot! On a sidenote, I tried using Comodo Geek Buddy because I thought they would help me with my issue, create a bug report, etc, but they just wanted to sell me the full version of Geek Buddy. They asked for remote access to my PC and said I had 6k registry issues LOL. For a minute I thought they were one of those “Microsoft Certified Help Desks” scams. haha !ot!

[attachment deleted by admin]

2

Some more details in the proper format:

A. THE BUG/ISSUE

Can U reproduce the problem & if so how reliably?:
Yes, every time.

If U can, exact steps to reproduce. If not, exactly what U did & what happened:

  1. Launch firefox/vlc player
  2. Check for updates/direct to the web (google.com)

If “Filter loopback traffic” is checked,
“firefox is attempting to connect to localhost:xxx”

allow (do not remember)
…(allowed to proceed to xxx.xxx.xxx.xxx)

if “Filter localhost traffic” is NOT selected
“firefox is attempting to connect to xxx.xxx.xxx.xxx”

If not obvious, what U expected to happen:

if “Filter loopback traffic” is selected
“firefox.exe is attempting to connect to locahost:xxx”

allow (do not remember)
"firefox.exe is attempting to connect to xxx.xxx.xxx.xxx:80

if “Filter loopback traffic” is NOT selected
"firefox.exe is attempting to connect to xxx.xxx.xxx.xxx:80

Any software except CIS/OS involved? If so - name, & exact version:
Firefox 31.0
VLC Media Player 2.1.5
THX TruStudio Pro 1.03.01

Exact CIS version & configuration:
CIS 8.0.0.4344
Configuration - Internet Security

Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:
Firewall setting: Custom Ruleset
Alert Frequency - Low
All of the advanced options are selected
Additional global rules - stealth ports

Before I continue I think I found the issue: The alert frequency level was set too low. When the level is set to High or above Comodo warns about both the localhost connection AND the external IP which is what I wanted.
So Comodo was ignoring the external IP connection because I just told it the localhost connection was OK. The fix was to set the alert frequency to High.

I feel like this is not really a bug anymore but something to look at in a future version of Comodo. In other words, it may be beneficial to treat localhost connections apart from external IPs even if the frequency of alerts is set to low.

3

Since you have figured out the issue im going to move this to resolved/outdated. If you later think that this is a bug feel free to respond and we can continue processing it.

Thanks