Firewall settings not working - pleas help!

kavakava · July 10, 2011, 12:14pm

Hi there,

I am having some problems with the Firewall. I’ve set it to “Custom Policy” security level. However, it’s NOT asking me to allow connection for apps trying to phone home or connect to the internet. It automaticallly allows the connection WITHOUT asking me!

What has happened?

Thanks!

:o ??? 88)

Radaghast · July 10, 2011, 1:12pm

This is interesting, you’re the third or forth person to see this effect. Would you mind laying out step by step exactly what you have done by way of configuration and applications tested to observe the Custom Policy mode’s incorrect behaviour. Also, which installer did you use?

Thanks

kavakava · July 10, 2011, 1:50pm

Hi there

Many thanks for your reply.

I resinstalled my whole system, and downloaded the free version installer from here:

I then went into the firewall config and changed it to “Custom Policy”. I am installing and running apps that I know Comodo should ask about, but it allows them access without my permission.

If I go into “trusted files”, I can see it’s added a whole bunch of them that it did not ask me about.

I even tried importing my old config, but that did not change anything.

Let me know if you need any more details.

What has happened here?
Thanks!

Boris_3 · July 10, 2011, 2:07pm

Will you please check in Firewall Behavior Settings if you haven’t the option “create rule for safe applications” enabled.

kavakava · July 10, 2011, 2:14pm

Hi there,

“create rule for safe applications” is definitely UNCHECKED.

Many thanks!

Radaghast · July 10, 2011, 2:40pm

Can you give me an example of an application that you believe CIS should ask about, please.

kavakava · July 10, 2011, 2:50pm

Hi there,

It should ask about, for example:

Firefox
OpenOffice
Steam
Secunia

Etc, etc, etc. I got notifications for ALL of these in my previous installation.

Thanks!

LvR · July 10, 2011, 3:05pm

https://forums.comodo.com/firewall-help-cis/1383-doesnt-respect-custom-policy-firewall-selectionsetting-t74129.0.html

riggers · July 10, 2011, 3:31pm

Hey kavakava, could you please look under Firewall->Network Security Policy and see if a rule has been created for “All Applications” Allow all outgoing requests.

Also what configuration are you guys using and what are your Firewall Behaviour Settings->Alert settings set to? I seem to remember something from ages ago that the slider had to be on at least High. Also can you check that all the Enable alerts for boxes are ticked.

Im also trying to reproduce this but dont seem able to!

Matty

Boris_3 · July 10, 2011, 3:35pm

I have made a fresh install of FW (5.5.195786.1383) for another topic and I can confirm that there is a problem with FW custom policy. It allows clearly everything without a single alert even if Def+ is set in parano mode. This problem doesn’t occur with my usuall installation which was made through update.

riggers · July 10, 2011, 3:43pm

Cheers Boris, could you check in Network Security Policy to see if the All Applications rule is there. I f not that can be eliminated as the cause.

Matty

Boris_3 · July 10, 2011, 3:44pm

Matty,

I just set the alert level on very high and nothing changes. The only alert given by FW is for IE and quite a strange one :
action : ask
protocol : TCP
source IP : 0.0.0.0
source port : 1086
destination IP : 127.0.0.1 (loopback zone)
destination port : 12080

After allowing this request, IE connects to google without another popup

Boris_3 · July 10, 2011, 3:46pm

No definitively the “all application” is not there. Only applic. rules : Comodo, windows system application and windows updater.

kavakava · July 10, 2011, 3:48pm

Hi there

“All Applications” Allow all outgoing requests does NOT seem to have been created.

My settings are EXACTLY the same as with my previous installation.
Weird.

@LvR - Where is the “old” installer you used, as a workaround?

Thanks

riggers · July 10, 2011, 3:58pm

Thanks Boris and kavakaka :-TU going to try doing a clean install from the link in this post and see what happens. Have you just been moving to Custom while staying in Internet Security as your configuration?

Just wan`t to know so i do the exact same routine.

Cheers,
Matty

p.s. At least we know it`s not creating an all applications rule (which i think happened in an early 5 Beta)

kavakava · July 10, 2011, 4:02pm

Hi - Yes, I did a clean install, on a brand new system from the link I posted earlier, free version. Once installed and restarted, I change the Firewall to Custom.

Let us know how you get on!
Thanks

Radaghast · July 10, 2011, 4:33pm

Just not seeing this at the moment. Fresh install, change the firewall to custom and reboot. Launch any application and get an alert, as I would expect…

Really no idea right now ???

Boris_3 · July 10, 2011, 4:35pm

Matty,

In the test installation I have done, the installer seemed to have been corrupted. cmdagent is running but Comodo drivers have not been installed! The diagnostic tool freeze the computer.

riggers · July 10, 2011, 4:51pm

Ok guys, heres what i did. Uninstalled with Revo, re-booted twice so the Control set was sorted. Installed CIS premium from the link, let it do its initial AV update then noticed the “Fix It” sign asking for a re-boot.
Let the AV update, re-booted then set the Firewall to Custom policy.
Tried to update Malwarebytes and no alert! Looked at Network Security Policy and a rule for All Applications (Allow all outgoing requests) had been created (top of pic 3).
Removed this rule, tried again and got the desired alert.

So why is this All Applications rule being created and does it only happen in the Internet Security configuration?
More investigation to follow, either way it`s not good :-TD

Matty

p.s. Didn`t install the Geekbuddy part.

p.p.s Windows 7 Pro 32Bit - no other security software running.

[attachment deleted by admin]

Citizen_K · July 10, 2011, 4:55pm

Boris and Kavakaa. Can you tell us what OS are you on and if it is a 32 or 64 bits version?