pandlouk’s rules might be a bit safter, since he limits the port numbers used. And as for PeerGuardian, both rule should make it go crazy, as most of the time, the connections are incoming to your port. But as long as PeerGuardian blocks them, there’s nothing to worry about. Also, the risk of actually going to court if you download something is almost 0%. They usually go after people that upload lots of stuff.
Anyways, no matter what firewall or rules you use, they’ll always be able to track you down. Not even PeerGuardian offers 100% protection.
So you have a choice. Either use pandlouk’s rule that offers bit more security, at the cost of lower download speed, or use mine with higher download speed, but maybe a bit less security.
Not really. Trusted application is more like Allow IP In/Out.
you don’t trust a ninja? >:(
i dunno (what do i know? ;D ), like i said, Soya (the vegetarian ninja) & vette (the supercop who use cracked software) once said it ;D .
hey, what’s the worst that could happen ??? i think it’s normal to “trust” utorrent. it’s not malware.
I think the idea here is to create an ideal traffic thoroughfare - just like any highway - and allowing infinite lanes from anywhere to anywhere is chaotic at best, even dangerous.
Myself, I want several designated lanes moving in opposite directions [actually to be honest, it’s the inbound traffic I’m most concerned with] at high rates of speed to determined destinations.
The now infamous pandlouk 5 along with Ragwings (my rules are borrowed from both, then tweaked over time) do this well. I’m able to easily monitor everything on both sides of the road while PG and PW act as the Highway Patrol; pulling over the dangerous drivers.
To give Utorrent (or any variation thereof) an Allow All In/Out policy, frankly flies in the face of what I spend most of my time trying to accomplish: securing and guarding the boundaries of my private network.
oh, and:
Trust a ninja?
What do you mean you mean you don’t trust faceless stalkers, hidden in black, moving silently through the night, climbing walls, able to garrote you in your sleep without a whisper? What, are you paranoid?
I use uTorrent with PeerGuardian2 (you just gotta block those pesky Uni students ;D). I use pand’s rules with some extra bits (which are probably useless… but, I can’t help but fiddle with things like that). As per pand’s set-up, I do not allow uT to use privileged ports (although there are some exceptions) & I don’t allow nutta’s to connect to me using privileged ports either (unclean!). One thing I have discovered… is that when uT says my connection is red (poor) it is lying like a dog with no legs. It thinks it’s poor and I’m DLing at 300KB/s on a HSDPA USB dongle-thingy (which is almost maxed out for where I am).
This forums great, you always get a response with useful information.
“Also, the risk of actually going to court if you download something is almost 0%. They usually go after people that upload lots of stuff.”
Ahem… not much danger of that then. (I’m looking for an emoticon for “hit” and “run”, to no avail)
“Anyways, no matter what firewall or rules you use, they’ll always be able to track you down. Not even PeerGuardian offers 100% protection.”
Sage Advice indeed.
“So you have a choice. Either use pandlouk’s rule that offers bit more security, at the cost of lower download speed, or use mine with higher download speed, but maybe a bit less security.”
Hmm. So what rules does comofo use, i am interested in knowing?
Me? Well, ehem (:NRD) first I always run PG and PW with fresh lists…an addition I’ve taken the time to include some of the blocked ranges (I double check these) to My Blocked Network Zones.
Allow tcp/udp In from ip any to my ip 1025-65535 to Utorrent Port
Allow tcp Out from my ip to ip any 1025-65535 to 1025-65535
Allow udp Out from my ip to ip any Utorrent Port to 1025-65535
Allow (& log) tcp (http) Out from my ip 1000-5000 to 80
Allow (& log) udp (dns) Out to my ip 1000-5000 to 53
Block and Log everything else
On my 1.5M Adsl I usually hover at 175-195k down and 35-50k up.
I went with just Ragwinds rules, though I had to make a slight change, where he has:
Allow TCP OR UDP In From IP Any To [Your MAC/IP] Where Source Port Is Any And Destination Port is In [uTorrent port]
I had to use ANY in place of [Your MAC/IP] since my IP changes. This won’t cause me any loss in security will it?
Otherwise, it works as it should. I ran Utorrent, went to Shield Up and probed the Utorrent port, which said it was open like it should. Once I stopped Utorrent, Shields Up stated the port was Stealthed.
The only odd thing is I went to another Port probing site and it said my ports 135 and 1080 were open, yet at the same time Shield Up satated these ports were stealth, who should I trust?
Hang on… without checking the context of the rule (or the implications)… MAC/IP for Any? That’s not right… granted the IP can change, but the MAC shouldn’t change since it’s device orientated (unless this is a virtual system?). MAC should be OK. Shouldn’t it?
Yes, MAC doesn’t change unless you do it yourself (easy way to bypass routers MAC filter…). Was a bit tired, so didn’t think of it. You can obtain the MAC adress (physical adress) by running the built-in ipconfig utility with the parameter ‘/all’.
Ahh, thanks for the information on getting my MAC address, I was wondering how to do that…I will change my rule asap.
(:CLP)
EDIT: Just because I am curious, I did try the other rules and didn’t really see any difference between the two. I do have one question though. When I am running Utorrent the port is open. When I stop Utorrent, the port closes but does NOT stealth. Is there a way to automatically stealth the port in Comodo after using Utorrent?
I followed the first post, edited march17 2008, exactly, but my torrents would not connect.
I then followed the ragwigs post, edited may06 2008, and now they connect fine.
Which one should I stick with, for security reasons, and why didn’t the first method work, but second one did?
pand’s rules specifically prohibits uTorrent’s use of, what are called, privileged ports (1 - 1024). Rule 4 is exclusion to that rule to allow uTorrent access to port 80 (a privileged port). uTorrent sometimes uses port 80 (HTTP) for accessing trackers.
If you see a pop-up & it is consistent with a Tracker site of an active download, then answer yes. Otherwise, if it’s a normal torrent user who is using port 80 (which is really dumb), then you should say no.
Some people believe it is not necessary to exclude/control uTorrents use of priv ports, others do. Myself & pand are in the latter group.
Hi, I would like to use pands rules, but they do not work for me, whereas ragwigs rules do. What is the main difference between the two that would allow one to work and the other not, as I’d rather be more secure (see 2 posts above)
just use rag’ rules then.
i know a supercop who didn’t use any specific rules for torrent app, he just choose “treat this app as trusted”.
don’t forget to open firewall/common tasks/stealth port wizard and choose: “alert me to incoming connection-stealth my ports on per case basis”
to create global rule. :■■■■
Hey guys im new to all this so please bare with me…
Padlouk I followed your steps to configuring the firewall with utorrent and everything went fine, i got the green light etc.
When I have gone on it today defense + keeps warning me that utorrent.exe is accessing the COM interface and the DNS/RPC Client Access. What do I select for these? I selected trusted application. I started using utorrent and i was back to the orange warning light and when I had already fowarded my port yesterday (everything working fine) now the portfoward site is telling me my port is not open.
Sorry one last thing I forgot to add was that yesterday I had none of these defense + alerts. Can you please help me on what I need to do?
(Padlouks rules are already setup with the utorrent on the firewall configuration)
Forgive me if this has been covered somewhere in the thread, but well…15 pages; you know.
Couldn’t we just go to Firewall-> Network security policy → application rules, and then add all these rules to utorrent? Wouldn’t that make them only active while running uTorrent (which I’d think would be ideal)?
