Rules for loopback - help required please [RESOLVED]

Help for v2
1

Comodo 2.4.18.184

I wonder if I may ask for some help?

I’m trying to put together a definitive answer to the question regarding ‘loopback’, and various applications that insist upon using this feature, such as Firefox and Thunderbird.

The first question is with regard to the security implications of enabling the ‘skip loopback (127…)’ for TCP and UDP under Advanced\Misc. Having read various threads on this forum, I still cannot answer, with authority, that by enabling these check boxes, one either increases or decreases the overall security of Comodo.

If the assumption is, that enabling these check boxes, in pursuit of an easy life, decreases security then another solution must be sought.

This leads me to the second question, which regards rule creation for each application to allow for ‘loopback’

Let us use, as an example Firefox, although one may assume that what ever rules are created for this application, would also pertain to similarly inclined applications.

what then, in seeking to create a highly secure rule set, are the steps needed to cater for these applications?

Having followed the information posted by jp1971 in his post https://forums.comodo.com/index.php/topic,4040.msg30686.html#msg30686 as I am also a user of Proxomitron, I still find I receive ‘pop-ups’ for Firefox, such as the one shown below.


http://img184.imageshack.us/img184/7254/ffconnect1ge3.th.jpg

My current Application Rules are as follows:

Firefox.exe 127.0.0.1 1024-4999 TCP In Allow
Firefox.exe 127.0.0.1 1024-4999 TCP Out Allow
Firefox.exe ANY 443 TCP Out Block (I use the Proxomitron Cert to filter HTTPS)

Proxomitron.exe 127.0.0.1 8080 TCP In Allow
Proxomitron.exe 127.0.0.1 1024-4999 TCP Out Allow
Proxomitron.exe ANY 80,443 TCP In Allow
Proxomitron.exe (MY ISP DNS1) 53 UDP Out Allow
Proxomitron.exe (MY ISP DNS2) 53 UDP Out Allow

Let me explain:

From what I understand, the two loopback (127.0.0.1) entries for Firefox, should, in theory, negate the need to check the ‘skip loopback (127…)’ for TCP and UDP under Advanced\Misc. In addition it should allow Firefox to communicate with Proxomitron, which listens for connections on 127.0.0.1:8080. Personally I would prefer to allow Firefox to communicate with Proxomitron, only on that port, so the rule would be:

Firefox.exe 127.0.0.1 8080 TCP Out Allow

Alas, these leads to a great many ‘pop-ups’ from Comodo with ‘skip loopback (127…)’ disabled.

So, with Firefox configured (Options\Advanced\Network\Connection\Settings\Manual Proxy Configuration) to use 127.0.0.1:8080 and Proxomitron configured to do DNS etc. I still receive requests from Comodo to allow Firefox to connect to the Internet?

As you may be wondering about my Network Monitor rules, I will add those here:

Allow & log UDP Out ANY 255.255.255.255 68 67 (DHCP)
Allow & log UDP Out ANY (My ISP DNS1) 1024-4999 53 (DNS)
Allow & log UDP Out ANY (My ISP DNS2) 1024-4999 53 (DNS)
Allow & log TCP Out ANY ANY 1024-4999 21,25,80,110,119,443,587,995 (Allowed Ports)

I also have the default ICMP rules.

All of the above also applies to Thunderbird for which I have similar rules defined i.e. UDP for DNS and TCP for mail ports.

Finally, I do not allow any application to update automatically, which includes Firefox and installed extensions. Also I am on dial-up, single PC, no other network connections. My system is also free of any malware.

I appreciate the aforementioned is a little long, I will, therefore, summarise my question here:

Without enabling the ‘skip loopback (127…)’ for TCP and UDP under Advanced\Misc. what specific rules do I need to create in Network Monitor and Application Monitor to cater for loopback so that ‘pop-ups’ are eliminated?

I have another question but I’ll create a new thread for that.

Thanks for any help.

2

I don’t know any advanced rules for loopback, but this recent thread might be worthy to look at.

3

Hello soyabeaner, thanks for the response.

As I said in my first post on this thread, all I am trying to do is come up with a definitive set of rules that will eliminate ‘loopback pop-ups’ whilst leaving the ‘Skip Loopback’ options in Advanced\Misc unchecked. So far, however, I have been unsuccessful.

Having read these threads:
https://forums.comodo.com/index.php/topic,4040.msg30686.html#msg30686
https://forums.comodo.com/index.php/topic,2405.msg18800.html#msg18800
As well as the one you mentioned, I still receive prompts from Comodo with regard to loopback. (see the picture in my first post)

To reiterate my current Application rules are:

My current Application Rules are as follows:

Firefox.exe 127.0.0.1 1024-4999 TCP In Allow
Firefox.exe 127.0.0.1 1024-4999 TCP Out Allow
Firefox.exe ANY 443 TCP Out Block (I use the Proxomitron Cert to filter HTTPS)

Proxomitron.exe 127.0.0.1 8080 TCP In Allow
Proxomitron.exe 127.0.0.1 1024-4999 TCP Out Allow
Proxomitron.exe ANY 80,443 TCP In Allow
Proxomitron.exe (MY ISP DNS1) 53 UDP Out Allow
Proxomitron.exe (MY ISP DNS2) 53 UDP Out Allow

I have subsequently added an additional rule to Network Monitor:

Allow & log UDP-TCP In-Out ANY 127.0.0.1 1024-4999

So the questions are:

  1. Are these rules correct?
  2. Do I need any additional rules

Thanks again.

4

In view of the information contained in this thread:

https://forums.comodo.com/index.php/topic,6630.0.html

I believe identifying a solution to this problem is quite important.

5

Hey toggie,

Your ruleset for Proxo looks spot on - great work!

In a nutshell, it appears the following are required for Proxomitron to eliminate skipping loopback connections;

PROXOMITRON SPECIFIC RULES
These four application monitor rules are requried for the Proxo app itself
Proxomitron.exe 127.0.0.1 8080 TCP In Allow
Proxomitron.exe ANY 80,443 TCP In Allow
Proxomitron.exe (MY ISP DNS1) 53 UDP Out Allow
Proxomitron.exe (MY ISP DNS2) 53 UDP Out Allow

PROXOMITRON CONTROLLED APPLICATION RULES
These are generic and need to be tailored for specific apps.
Inbound
“application name.exe” 127.0.0.1 “Required port, ports or port range” TCP In Allow
Outbound
“application name.exe” 127.0.0.1 “Required port, ports or port range” TCP Out Allow

The two rules shown in RED in the above quote can be modified slightly by substituting ANY for the the port range. I believe this is safe as ports above 1024 are generally software assignable, and setting it as ANY is slightly (but only slightly) faster than nominating a specific port range.

Out of curiousity, what sort/quantity of logs are you getting using these rules?

Thanks for your tenacity on this issue. While local proxies are not a huge segment of the market, they are vital to those who use them and Scott’s Proxo is one of the best.

Can someone else please verify these settings? TIA

Cheers,
Ewen :slight_smile:

6

Hello Panic, thanks for the reply :slight_smile:

Out of curiousity, what sort/quantity of logs are you getting using these rules?

Right now I am getting a lot of log entries, as I have been testing and so have the Alert Frequency Level set to very high. I have also unchecked ‘Do not show any alerts for applications certified by Comodo’

Most of the log entries are straight forward allow Network Monitor info, with the odd ICMP alerts thrown in for good measure. I assume the current logging system doesn’t record Application based events?

As for the rules, they are now as discussed above, but one question still remains. Do I need a rule/s in Network Monitor to support loopback or are the Application rules enough?

Thanks again

7

DOH!

I have subsequently added an additional rule to Network Monitor:

Allow & log UDP-TCP In-Out ANY 127.0.0.1 1024-4999

Yes, you need to have a network monitor rule to cater for the allowed proxomitron ports for each app configured to run under proxomitron.

Quoted above is your NM rule to allow Firefox traffic through the network monitor via proxomitron.

I wouldn’t recommend setting a NM rule that allows all ports out for proxomitron, as this would have the same net effect (pardon the pun) as disabling checking loopback connections.

Hope this helps,
Ewen :slight_smile:

8

DOH! Indeed. I guess I could have asked that question a little differently :slight_smile:

One final question…please :slight_smile:

In my previous post I asked about application events in the log files. Am I right in thinking, that at the present time I will not seen any log entries that identify, specifically, which application caused the event?

Thanks.

9

Open CFP, click on ACTIVITY - LOGS and do a right click in the log window. Select “Log events from” and make sure all four options are selected.

Cheers and thanks again for your tenacity.

Ewen :slight_smile:

10

All four options are ticked but the only events I have in the log files are Network Monitor events, such as:

Date/Time :2007-02-25 09:00:12
Severity :Low
Reporter :Network Monitor
Description: Information (Access Granted, IP = REMOVED, Port = http(80))
Protocol: TCP Outgoing
Source: REMOVED:2859
Destination: REMOVED:http(80)
TCP Flags: SYN
Reason: Network Control Rule ID = 6

11

If you click on a log entry, full details should be shown in the DETAILS section, including app and parent.

Ewen :slight_smile:

12

That’s what I would have assumed, but even though I have all four options ‘ticked’ under ‘Log events from’ I am not seeing any information other than that described above.

All of the entries I can see, either directly within Comodo or as an exported HTML file are missing both application and parent identifiers.

From what you have said it seems something is amiss.

Out of interest should the ‘Reporter’ always be the same i.e. Network Monitor as that’s all I have?

You’ll be getting fed up with me soon :wink:

13

Don’t sell yourself short - I was fed up with you ages ago. :smiley: Only kidding.

I’ve just had a closer look at my logs and have found the same thing as you - only NM and Component Monitor entries. My NM log entries, however do show app and parent details.

Can anyone else shed any light on this?

Ewen :slight_smile:

14

Same here. No application & parent shown on net mon alerts.

15

From the help file:

“The Second Column (Reporter) states which subsystem generated the attack report. (Application Monitor, Network Monitor, Component Monitor or Application Behaviour Monitor.”

That seems to suggest that we should be seeing events being generated by the different monitors.

Having just been through several hundred log entries in both Comodo and the HTML report I can say I definitely don’t have any information related to which applications generated the event.

Should I start a seperate thread for this as its unrelated to my original query?

16

I think that’s a good idea, Toggie :slight_smile:

17

New thread created here:

https://forums.comodo.com/index.php/topic,6717.0.html