Let’s see if I have understood correctly a few things and maybe also able to help clear some concepts to others.
First the clock update preliminary information that are same with any firewall:
- When starting the update from the systray clock, the svchost.exe sends an UDP packet from local port 123 to time server (default IP 207.46.130.100) port 123.
- The time server responds to that packet by sending an UDP packet back containing the time value from remote port 123 to local port 123, svchost.exe.
Notice that the sent and received packets are not usually belonging to the same internet connection, but they are related in a sense that it is a request and a reply.
Step 1 in CPF needs to allow in Application Monitor svchost.exe to connect to timeserver IP, UDP port 123. Besides the default allow UDP out to any ip and port network rule.
Now to step 2.
Most CPF users have the default Network Monitor rules of not allowing incoming connections unless running some server type applications.
It is not needed either with time synchronization. Thanks to Network Monitor’s SPI, Stateful Packet Inspection.
The incoming reply connection is passed in despite the no explicit UDP incoming allowed rule.
Then CPF Application Monitor that is in my knowledge not implementing any SPI bookkeeping comes to play.
There needs to be a rule allowing svchost.exe allow incoming UDP for local port 123 to your computer IP (or your PC’s hostname).
Notice that CPF application incoming rules are more limited than with firewalls like Sygate or Kerio 4 since these allow to specify the remote source server IP). But I see this not as a serious risk if any since normally only SPI matching incoming connections are passed in.
Kerio 4 has pseudo UDP SPI in application rules and thus no incoming rule is needed.
Older firewalls like kerio 2.1.5 or Sygate 5.5 have no pseudo UDP SPI.
Comodo has decided to be very uninformative how their firewall is actually really working, but above are the conclusions I have come to so far.
Hope this helps others besides me, if above is correct.
Jarmo