Yes sure 
Thanks a lot 
so now i have some settings which seems to work…
i mean i get a IP and i can access the internet
here is my hardware setup…
[Cable-Modem with dynamic IP]
^
[Router serving dynamic IP’s]
^^^^^
[Network-Printer] [Network-Storage] [PC1 over wireless] [Laptop1 over wireless] [Laptop2 over wireless]
the local network settings are as following…
Address: 192.168.0.0 11000000.10101000.00000000.0000 0000
Netmask: 255.255.255.240 = 28 11111111.11111111.11111111.1111 0000
Wildcard: 0.0.0.15 00000000.00000000.00000000.0000 1111
=>
Network: 192.168.0.0/28 11000000.10101000.00000000.0000 0000 (Class C)
Broadcast: 192.168.0.15 11000000.10101000.00000000.0000 1111
HostMin: 192.168.0.1 11000000.10101000.00000000.0000 0001
HostMax: 192.168.0.14 11000000.10101000.00000000.0000 1110
Hosts/Net: 14 (Private Internet)
The router gets his IP automaticaly (and i guess his DNS settings too) from the cableModem or in other words from my internet provider.
now the router is serving dynamic IP’s to all his clients and provides him self as a DNS server.
in a client PC when i go to my wireless adapter > status > details i see…
DHCP server: 192.168.0.1
DNS server: 192.168.0.1
So i decided to bypass the router DNS function and use the manual DNS settings under network connections > wireless adapter > internet protocol TCP/IP > Properties > advanced > DNS
I added all four DNS servers from my internet provider and at the buttom i also added the DNS address from my router for just in the case of what ever.
i thoght in that way the router has less to work and maybe it will save me a microsecond of time
(a tutorial on that is found here SG :: Router Configuration Guide )
Now i would like that all traffic in my local area network (LAN) is allowed
this means that netBIOS, Remote, File and Folder sharing, and what ever is permited, but only if it comes from a PC in my LAN and never if it comes from the internet!
but in the other hand i would like that my own requests on such dangerous services to the internet will be permited, so that i can “see” into the “internet” but that the “internet” cant “see”/spy me 
And i did fool around with all the standart setings of the comodo firewall
so i have to do them now all manualy 
I did rename all the zones by comodo…
and i added a bunch of zones by my own manualy
to setup all possible zones i did use a reference from wiki found at Internet Protocol version 4 - Wikipedia
and 3. Summary Table found at http://www.rfc-editor.org/rfc/rfc3330.txt
to convert the zones properly i did use the IP calculator at IP Calculator / IP Subnetting
to setup the zones means not that they are permited or restricted, they are just definied at this point.
the next i did was to define a port set for “evil”-ports and named it [EVILPORTS]…
Remote Procedure Call (RPC) (TCP/UDP: 135)
PROFILE Naming System (TCP/UDP: 136)
NETBIOS Name Service (TCP/UDP: 137)
NETBIOS Datagram Service (TCP/UDP: 138)
NETBIOS Session Service (TCP/UDP: 139)
MS Networking access (TCP/UDP: 445)
as i got it from IT Service Management (ITSM) | Information and FAQs from Wiki Comodo
Both application rules and global rules are consulted when the firewall is determining whether or not to allow or block a connection attempt.
For Outgoing connection attempts, the application rules are consulted first then the global rules.
For Incoming connection attempts, the global rules are consulted first then application specific rules.
and rules are applyed from up to down (first rule to last rule) as i guess
in example…
if i allow all and then deny some-thing, some-thing will never get blocked
if i deny some-thing and then allow all, some-thing will get blocked an all other things will be allowed
right?
… now i have some global rules…
block ICMP from IP any to IP any where ICMP message is protocol unreachable
block ICMP from IP any to IP any where ICMP message is 17.0
block ICMP from IP any to IP any where ICMP message is 15.0
block ICMP from IP any to IP any where ICMP message is 13.0
block ICMP from IP any to IP any where ICMP message is echo request
now i added some global rules to it looks like…
Allow IP In/Out from in [LAN] to in [LAN] where protocol is any
Allow IP In/Out from in [Loop] to in [Loop] where protocol is any
Block TCP or UDP In from NOT In [LAN] To IP any where source port is any and destination port is in [EVILPORTS]
Block TCP or UDP In from NOT In [LAN] To IP any where source port is in [EVILPORTS] and destination port is any
block ICMP from IP any to IP any where ICMP message is protocol unreachable
block ICMP from IP any to IP any where ICMP message is 17.0
block ICMP from IP any to IP any where ICMP message is 15.0
block ICMP from IP any to IP any where ICMP message is 13.0
block ICMP from IP any to IP any where ICMP message is echo request
so i think now all the LAN traffic is permited
as also the Loopback traffic
and all access trough evil ports from the internet to my PC is blocked
Under application rules i did also some rules…
All Applications
Allow IP In/Out from in [LAN] to in [LAN] where protocol is any
Allow IP In/Out from in [Loop] to in [Loop] where protocol is any
since i have basicaly the same rule for all applications as i allready have globaly i guess this rule is not needed anymore, i think this rule has to be in the global section or for all applications in the application section but not in both sections.
is this right?
the other question is if this rule is good or not?
i did read about this allowing all traffic on LAN rule some where in this forum
but now i ask my self what happens if one PC is maybe infected or attaked, if someone gains control over one PC in the LAN, he will maybe be able to invade any PC in the LAN through one infected PC
is this right?
now i also added some special zones like…
DNS (all my DNS server provided by my internet provider + my LAN brodcast address)
LAN (TCPIP Netmask for my LAN)
Loop (TCPIP Netmask for 127.0.0.0/8)
LocalHost (Local host name)
Internet Clock (All time servers in use by IP)
MS-Update (All microsoft update server IP's hat did occour)
on svchost i have now the rule…
Allow TCP or UDP Out from in [LocalHost] to in [DNS] where source port is any destination port is 53
Allow TCP or UDP Out from in [LocalHost] to IP 255.255.255.255 where source port is any destination port is 67
Allow TCP or UDP Out from in [LocalHost] to in [LAN] where source port is any destination port is 67
Allow TCP Out from in [LocalHost] to in [MS-Update] where source port is any destination port is in [HTTP Ports]
Allow TCP or UDP Out from in [LocalHost] to in [Internet Clock] where source port is any destination port is 123
Ask
and on system…
Allow TCP or UDP Out from in [LocalHost] to IP any where source port is in [EVILPORTS] and destination port is in [EVILPORTS]
Ask
for DHCP and Internet-Time i need only UDP but somewhere on this forum i did read that DHCP will try on TCP if UDP fails, and the NTP seems to work the same way as i guess after reading about port 123 on this site Port 123 (tcp/udp) :: SpeedGuide
so are theese rules now looking fine?
is it too much or too less?
is some thing missing?
or something totaly wrong?
additional i maybe can mentoy two tools which i found while all my research which maybe can be interessting to some people who wanna shut down the port 135 and 445 completely
GRC | DCOMbobulator (135)
GRC | Shoot The Messenger (445)
thanks a lot in advance