Rule stops remote desktop from working

Help for v2
#1

I have just ditched ZoneAlarm in favour of Comodo. I have the latest version (2.4.18.184).
When I had just installed it and hadn’t added any rules myself there was already a rule in ‘Network Control Rules’ to block all IP in or out from any ip to any ip where the ipproto is any.
This rule prevents incoming remote desktop connections. I can create outgoing ones but I can’t connect to this machine from another one via rdp.

If I delete this rule or set ‘Allow all’ I can then use rdp.

Obviously allow all isn’t an ideal solution but does anyone know if deleting this rule puts me at risk as if I had allowed all?

I’ve searched this forum and tried all the combinations of settings I could find before deleting the rule. None of them worked.

I would be grateful if someone could suggest a rule I can add that will allow rdp and allow me to recreate the rule above at the same time…or at least can someone tell me if I’m now at serious risk by deleting this rule?

#2

Hey fooboo,
welcome to the forum (:HUG).

Please do NEVER EVER delete this rule. YES, it puts you at a great risk.

Let me explain:
Network control rules (NCR) are ordered hierarchically, i.e. CPF parses the rules from TOP to BOTTOM. Thus, the block IP In/Out rule blocks everything that hasn’t been allowed by the rules above.
All you have to do is create a rule to allow incoming remote desktop connections and put it ABOVE the generic block rule.

You could either consult mOngOd’s excellent “Understand & create Network Rules” tutorial: https://forums.comodo.com/index.php/topic,1125.0.html or post back and we’ll help you create a rule.
Cheers,
grampa.

#3

Oops…I’ve put it back :stuck_out_tongue:

I did try moving the rule to the bottom to no avail but I’ll read that guide and have another go.
Thanks.

#4

Cheers mate,

Just right-click on the rule nearest to the botton and coose “add after”. The rule will be the put last. Do you remember the exact rule?
Cheers,
grampa.

#5

Wahey! It’s sorted.

For anyone reading this with the same problem, once I put back the rule I shouldn’t have deleted (I knew as I deleted it that it’d be important…typical) I created a new rule that allows TCP in and out from Any source to any destination where source port is Any and destination port is 3389 (as per settings in the help section of this forum).

Thanks again grampa.

#6

You should put the IP address of the machine that you are using as the source. Otherwise you are allowing anyone in thru port 3389.

Just change the Source IP to whatever the IP address is of the PC that you are using to access the other PC. This will only let the PC with that IP address IN on port 3389 of the other PC.

jasper

#7

I need to be able to log in from any machine wherever I am. I have a few machines/IPs I use regularly but if I get a call when I’m visiting friends or whatever I need to be able to use their pc to access my works desktop.

#8

I didn’t do anything. You sorted it out in no time ;D (:NRD) ;D (took me a lot longer to understand the workings of NM). Congrats.

You should, however, be aware of the risks Jasper pointed out.

Cheers,
grampa.

#9

Just to add to grampa’s reply, if someone gets in that port then they can access whatever you access. You are also exposing any other PC’s that are accessed from that machine.

If you use it to access your company’s servers then so can anyone else that might use your PC. I know that I might be a little overzealous here but it happens everyday.

jasper