Rules for all undefined types?

Comodo Internet Security - CIS Firewall Help - CIS
#1

Hello,

I need to define some custom firewall rules so I referenced the predefined rules.

Frequently, I need to

  1. Allow requests matching certain criteria
  2. Block all unmatching requests

Whereas for (1) one can specify individually each specific criteria, how about (2)? (2) essentially is “everything other than (1)” so there are

  1. Numerous types of protocols
  2. Numerous possible source and destination, port.

How can they all be included with a single rule?

With this question I looked at some predefined rules, and found they seem all to use

  1. Protocol “IP”
  2. Direction “In/Out”
    To define the scope of all remaining types of communication.

So what does “IP” here refer to? Does it mean Internet Protocolhttp://en.wikipedia.org/wiki/Internet_Protocol which is a superset of protocols including {TCP, UDP, ICMP, etc.}? Does using this protocol means “for all remaining types of communications”?

And what is the priority of rules? If I define rule (1) followed by (2), is it like a case statement in C:

Switch (type)
{
Case (1)
Statement;
Break;
Case (2)
Statement;
Break;
}

When (1) and (2) are mutually exclusive, changing order makes no difference. But in case that they have a non-empty intersection:

  1. (1)∩(2)≠∅
  2. (1)⊂(2) or (2)⊂(1)

Does different order of rules result in different result?

And regarding the “IP” protocol, since it is all-inclusive (probably), is it like

Switch (type)
{
…

Default:
Statement;
Break;
}

In C language?

Jim

[attachment deleted by admin]

#2

Yes

And what is the [b]priority [/b] of rules? If I define rule (1) followed by (2), is it like a case statement in C:

Rules are processed from the top down, for example:

Application name - abc.exe
Rule 1 = Allow TCP OUT Port 80
Rule 2 = Allow TCP OUT Port 443
Rule 3 = Block TCP Out

Will allow TCP out to ports 80 and 443 but will block TCP out to any other ports. Likewise, if you moved Rule 3 above Rules 1 and 2, TCP Out would be blocked, because outbound TCP requests would not be processed beyond this rule.

And regarding the “IP” protocol, since it is all-inclusive (probably), is it like...

Jim

No idea, I have no interest in programming languages, sorry. Perhaps you could ask the question without resorting to programming syntax.