Hello everyone, I have a “problem” with the firewall.
When I turn on the computer I have constantly intrusion attempts mainly on UDP port of uTorrent (destination port) and emule by the operating system that the firewall blocks.
The source IP and source port are always changing.
The destination IP is 87.15.255.86 and is not mine.
Obviously raskphone.pbk was read-only and has not changed.
I also tried to disable the UDP port of uTorrent and emule no the firewall and on the router, but nothing.
Can someone tell me what happens?
Thankyou
When you log off from a p2p network the other peers are not aware you logged off. That takes up to a a couple of hours.
Closing the port on your router should block the traffic from coming to your computer and getting flagged by the firewall.
Did you set up your router to make your computer Exposed Host or Demilitarized Zone (DMZ)?
What IP address does your computer have if it is not 87.15.255.86?
What is your network set up? Are you on ADSL or cable?
I DON’T use dmz, my ports are invisibles and closed ( shieldsUP ). I also tried to restart the router.
I think that somethings happens when I downloaded emule servers; ayway I’ m on ADSL.
What I don’t understand is that you are behind a router and have a public IP address. That is mutually exclusive. Hence my questions about DMZ/Exposed host.
I need to know more about your set up. Open the command prompt, type ipconfig and then push enter. What does it tell for IP address and Gateway address?
Can you show me a screenshot of the logs of the firewall so it will show both the uTorrent and eMule traffic?
Forgive my short absence; screenshots attached.
[attachment deleted by admin]
Try this and tell is it working:
In Global Rules in Network Security policy, is the last rule in the list “Block and Log IP In from IP Any to IP Any where Protocol is Any” !
When you edit this rule check the box “Log as a firewall event if this rule is fired” for the Firewall to log an intrusion attempt. I think it is unchecked by default.
This maybe fix your problem!
Ok, now I try, but before have a look at this and tell me if it’s right!
If I have understood: NEW RULE ( IP PROTOCOL ): origin adress: ANY; destination adress: ANY; IP protocol: ANY; action: BLOCK; ( and log ).
Intrusions come from another way!!!
[attachment deleted by admin]
May be I have found a solution, but it doesn’t fit well. I have cleaned the win log files with Ccleaner and the intrusion attemps stop, BUT I have lost COMODO GUI. The firewall is still working ( with all the services ), but I don’t have the icon in the tray. Let’s see jpg. In order to turn back to the previous state I have to: restore the system to a previous restore point ( with the log file ); delete COMODO(2) in C:\Programs, create by system restore; remove the firewall because it doesn’t work no more; reinstall the firewall. I think this beavior is due to a win log file but I don’t know which. Moreover it seems obvious that a win log file ( I don’t know which ) is necessary to the firewall gui ( the icon in the tray ).
[attachment deleted by admin]
May be I have found the solution! Since intrusion attemps began when I tried the rules for emule and utorrent, now, in Stealth Ports Wizard I have selected “Block all incoming connections …” and the intrusion attemps are finished.
However, I still don’t understand why moving the flag from “Block all incoming …” to “Alert me to incoming …” generates intrusion attemps.
Thankyou