program slipping through local proxy??

I use a very old program, URLywarning, for monitoring websites for any changes. This program is launched manually, it checks and then I close it. It connects through the Proxomitron (a local web filtering proxy) in order to filter out ads.
The question is why CPF doesn’t ask permission for URLywarning. It’s such an old and unknown program, I’m sure it’s not on the Comodo safelist. And I don’t use the “Do not show any alerts for the applications certified by COMODO” option anyway. So there seems to be no reason for not showing a pop up on first connection.
This happens with the current beta and the one before that. I don’t remember older CPF versions.

What’s up? It wouldn’t be slipping through the local proxy unnoticed, would it?

In security->Advanced->Miscellaneous section, there are 2 options called Skip loopback TCP and Skip loopback UDP.

Make sure TCP is not enabled. I dont think it will be related to UDP but you can also try to disable it and test.


I was using the default settings. Therefor “Skip loopback UDP” was enabled and “Skip loopback TCP” wasn’t. Disabling UDP did the trick. Immediately after disabling it CPF showed a pop up for URLywarning. Thanks very much for you help.

However, I happened to notice the fact that no pop up was show for this application. Does this mean any program could have used the local proxy to connect unnoticed? In other words, does the default situation (UDP enabled, TCP disabled) create a hole in the firewall for anyone running a local proxy? If yes, why are that the default settings? It is very dangerous for people who don’t understand those things (like me).

YEs. Skipping local loopback addresses can create security risks if local proxies are used. Since UDP proxying is not very much common, this threat can be neglected. But for TCP, we dont enable by default.

In kerio, was trusted/allowed by default. Was that a security risk aswell?

latest CPF beta:

Avast webshield asks for loads of loopback TCP connections when “Skip loopback TCP” is disabled. I prefer High alert levels, so would it be better to allow all TCP out for Avast webshield. Or could I enable “Skip loopback TCP” without risk?

I set avast webshield to: remote [] port [Any] protocol [TCP] Allow

It is better to allow all TCP out for Avast. Do not enable “Skip loopback TCP”

I agree with Pandolouk. Dont disable loopback TCP. A big security risk really. Loopback should not be trusted.