New user + question

Help for v2
#1

Hello, my first visit and first post here.

After many, many years with the free ZoneAlarm firewall, I have finally booted it off my computer!

I heard many good things about the Comodo firewall, so I decided to give it a try. So far, so good.

However…

I have an application, kind of a telnet (Host Explorer by Hummingbird) that I use to run things on a remote Unix system. No problem to start it, Comodo prompted me, I clicked ‘Remember’ and ‘Allow’, and the thing allowed me to login. Next I started to run a long-running job, but when I went to check its status after about an hour, the session was gone!

This has never happened before, so I can only suspect the new firewall. Question: where can I check what happened, and why it happened? Nothing in the Windows Event Viewer.

In Application Control I see:

HOSTEX32.EXE - [Any] - [Any] - TCP/UDP Out - Allow.

In Logs I can see only one entry related to this:

High - Application Behavior Analysis - Suspicious Behaviour (HOSTEX32.EXE) - time & date

I can see a number of other log entries, such as

Blocked by Protocol Analysis (Fragmented IP Packet
or
Outbound Policy Violation (Access Denied, ICMP = PORT UNREACHABLE)

What should I be looking for?

#2

P.S. The Unix system I connect to is on A corporate network on a 10.x.x.x address. I have specified

[b]ALLOW TCP or UDP IN or OUT[/b] FROM IP [b]MASK 10.0.0.0/255/0/0/0[/b] TO IP [b][Any][/b] WHERE SOURCE PORT IS [b][Any][/b] AND DESTINATION PORT IS [b][Any][/b]
#3

G’day,

In the application monitor, double click the hostex32.exe rule and on the MISCELLANEOUS tab, select “Skip advanced security checks”.

If this doesn’t work, try turning off “Block fragmented IP datagrams”. This is found in SECURITY - ADVANCED - ADVANCED ATTACK DETECTION AND PREVENTION - MISCELLANEOUS.

Disabling “Skip advanced security checks” was needed on our systems to get an SSH connection to Sun servers working, but other environments have required disabling fragmented IP datagrams.

Hope this helps,
Ewen :slight_smile:

#4

Thanks! I didn’t know about the double-clicking to modify a rule - knowing that makes the whole thing much easier to manage!

I made the suggested modification, and I’ll see how it goes.