CPF v2.x Installation - Step by Step. By Little Mac
There are a lot of questions answered or avoided entirely by using the following steps when you initially install and set up CPF.
Even if you are familiar with firewalls, CPF has a layered approach to security that is very different; using these steps will get you a working firewall, internet connection, and full security. If you try to create your own custom setup and rules from the ground up, you may unintentionally reduce CPF’s functionality, lose your internet connection, block applications, open your system up to hackers, and just generally give yourself a string of headaches. After you’ve used CPF for a while and get it all figured out, if you want to reinstall using your own custom settings, be my guest ~ but for now, it’s best to follow these steps:
- Uninstall any previous third-party (non-OEM) firewall; if you have WinXP, turn OFF Windows Firewall. Reboot.
1a. If you have a dedicated HIPS program running, I recommend turning it off temporarily while you install and set up CPF. It may block some components and not warn you, thus causing conflicts and improper installation. You can reactivate it once you have CPF up and running.
- Install CPF. Use Automatic - do not choose Manual/Advanced install. Follow the prompts. Reboot.
2a. When you open CPF after reboot, you are prompted to Activate. If you are on a LAN or behind a Router, you may have some difficulties connecting to Activate CPF. You can skip it until later, if you want; it will not impact functionality of CPF. (Note: As of v.2.3.6.81, you will now have 6 network rules)
-
If you are on a LAN, are using one computer to share internet connection, or are behind a router, run the Network Wizard (if these do not apply, you can skip this step). Go to Security/Tasks/Define a New Trusted Network (lower left). Follow the prompts. Reboot when finished. (Note: As of v.2.3.6.81, you will now have 8 network rules)
-
Run the Applications Wizard. Go to Security/Tasks/Scan for Known Applications. Follow the prompts. Reboot when finished.
CPF is now fully functional for the majority of users, and is fully secure.
I realize a lot of people want to create their own rules, and “tighten” things up. In order to do so effectively, you need to understand CPF, and how it works.
At the base of CPF is the Network Monitor - it controls how all applications are allowed to connect to the internet; everything occurs within the context of these rules.
Next in line is the Application Monitor - this defines what applications are allowed to connect (or not connect; you can block applications here as well), in the context of the Network Rules.
Finally comes the Component Monitor - this loads & approves all components within each application; it’s CPF’s way of saying, when you start an application, “Okay, all these pieces of the application check out; they’re good to go.” The Component Monitor will be a large list; the more Applications you have, the larger it will be. You can block components here if you want, or remove components altogether - just be sure to click “OK” after making your changes (by default, Component Monitor is set to “Learn”; do not change it to “On” until you’ve run the majority of your applications, or you will get a lot of popups).
That said, read m0ng0d’s post on Network Control Rules, Here. This will help you understand how to work with these rules better, when you do your tweaking.
If you use any P2P applications, or do online gaming, you will need to create special rules to allow the necessary ports, etc.
Here are a list of links to FAQs; read through these as well, for specific issues like the P2P, gaming, WIFI LAN, etc.
While following these installation steps will provide you the “out of the box” security that Comodo is already famous for, please be aware that this does not mean you won’t have any problems. This is the case with any and all computers, along with any and all software; there are a lot of variables involved, and some combinations of configurations just don’t play well together. That’s where this Forum, and Comodo’s Support site, are invaluable. Use the Advanced Search feature to narrow your results to the Firewall, to look for similar problems. If you have questions that aren’t answered, or need clarification, just ask; someone will be glad to help (Note: the Moderators are not Comodo employees, but volunteer users). When posting a new topic, please keep the Subject line concise and accurate to describe the problem (for example, “CPF blocks IE7” rather than, “Help! It doesn’t work!”).
Welcome to your new Comodo Personal Firewall ~ Happy Hunting!
Installation Video Tutorial - by AOwl
Here is a video guide for a basic install of Comodo Firewall Pro.
If you are new to Comodo this should hopefully help you.
Go to Nordic Nature - Home
and click the “noob” install guide link.
Good luck!
Remote Installation by pandlouk
Remote installation of CFP (through Remote Desktop, VPN, etc) can be done and it is quit easy to do it.
Here are the steps to take:
- Install CFP with the default settings
-
IMPORTANT Uncheck Restart the computer at the final step and select finish
- Import the setting from the AllowAll.reg included in the AllowAll.zip file that is attached at the end of my post.
- Reboot the machine and you will see that CFP will start in Allow All mode.
This way you can remotely reconnect to the computer after reboot and complete the configuration of the firewall.
Hope it helps,
Panagiotis
ps. Here is the registry entry that is included in the reg.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo]
[HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo\Personal Firewall]
“SecurityLevel”=dword:00000002
Moderator’s Note: The referenced attachment (AllowAll.zip) can be found on pandlouk’s original post.
CFP v3 Installation - Step by Step by Little Mac
There are a lot of questions answered or avoided entirely by using the following steps when you initially install and set up CFP v3.
For those users familiar with CFP 2.x, this version of the firewall should be a breath of fresh air. Gone are the days of endless OLE Automation and other Application Behavior Analysis alerts. Wink
Section 1: Preparing for Installation
1a. Uninstall any previous third-party (non-OEM) firewall; if you have WinXP, turn OFF Windows Firewall. Reboot. In general, I recommend uninstalling in SafeMode to avoid driver and service conflicts that may otherwise occur.
1b. If you have a dedicated HIPS program running, I recommend turning it off temporarily while you install and set up CFP v3 (I would include registry protection applications in this category as well). It may block some components and not warn you, thus causing conflicts and improper installation. You can reactivate it once you have CPF up and running.
1c. If you have an active/real-time antivirus or antispyware applications running, I recommend turning these off (completely disable all real-time function) temporarily while you install CFP v3. Although they should not conflict directly, the load on the system may result in installation problems.
Section 2: Installing Firewall and Defense+ (HIPS module). During installation, you have the option to install both FW and HIPS, or just FW. We’re going through a “basic” installation of both. We’re not choosing any “advanced” options such as allowing inbound connections (for p2p, file/print sharing, ICS), custom configurations, etc. There are other tutorials geared toward these things, which can be accomplished later on.
2a. Install CFP. For you visual types, I have captured screenshots for every step of the way. Rather than post 12 screenshots, I’ve attached a PDF file of this tutorial with all screenshots contained therein. So to see the screenies in context, please download and read through that. The first one simply reflects the need for step 1a.
2b. The next picture simply starts the Installer. Obvious, yes?
2c. The EULA. Read it, run EULALyzer on it, etc. If you don’t agree with it, don’t install the product… By the way, if you click “I Decline” you won’t be able to install. I wouldn’t mention any of this except there are have been questions in the past about EULAs. Basically you just need to be aware that if you don’t agree, don’t install. If you install, you’re agreeing to the EULA. A note about Comodo’s EULA – the language in it is chosen to protect Comodo, and does not mean that you cannot install the application on more than one computer. Comodo would appreciate you doing a separate download for each installation, as this helps them track the usage, but Melih has stated more than once that it’s not mandatory; it’s to protect them against people redistributing the software in a manner not approved by Comodo.
2d. Where to install? It’s best to choose the default location. If you go with a custom filepath for the installation, it might cause problems (not saying it will, just that it may).
2e. The start of the Configuration Wizard. This is where our options will start showing up.
2f. Like I said, we’re doing both FW and HIPS, so we’ll take the top option. Just choosing “Basic Firewall” means that the HIPS won’t be installed, you won’t have protection against trojans, keyloggers, leaktests, etc (all the things a HIPS module would do). Even though you install HIPS now, you can still disable it later; for those who only want to install the FW, you can still enable the HIPS module later on, as it will be there.
2g. This next option is where we enable the built-in, fully digitally signed and encrypted safelist (or whitelist). This is a list of applications which Comodo has fully analyzed in their labs and is known to be safe and legitimate. Comodo creates a digital cryptographic signature for the application, and placed in their encrypted safelist. When an application on the computer runs, it is matched against this list; if the cryptographic signature is an exact match, the program is allowed to continue; if it doesn’t match, you will be given an alert in accordance with your security settings, so that you can take appropriate action. If the application has been tampered with, or merely has the same name as a known application, it won’t match. As of mid-January 2008, there are more than 1 million signed applications in Comodo’s safelist database, and it continues to grow based on user submissions (please do use the Submission feature to send more apps to Comodo for analysis, even if you consider/know them to be safe).
This safelist is one of the strong features of v3, and is there to make using a powerful HIPS as easy as possible. You may choose not to use the safelist, but you will have 1000 popups a minute (or maybe more…)!
2h. If you use ICS, p2p applications, or file/print sharing (such as on a corporate LAN), you need to allow unsolicited inbound connections. Since we’re doing a “basic” setup here, we’re choosing “No, I don’t”; there are tutorials for ICS, p2p applications, and so on here in the forums to help you set it up later on – don’t worry about not being able to get it going if you skip the step here.
2i. Here’s another place we’re going with “basic” rather than a custom setup. This is the best way starting out, as you can still refine your settings as you go. If you were to choose Custom Settings here you’d be given more options (and it would be quite easy for you to lock the HIPS module down way too tight to be easily used.
2j. Now you’re done, and just need to reboot! Yay!
- After rebooting, CFP v3 will start with Windows. Firewall will be set to “Train with Safe Mode” which means that the safelist discussed earlier will be used to allow known applications to access the internet as needed (including Windows updates, etc). Defense+ (HIPS) will be set to “Clean PC Mode” which presumes that every application (executable) on your machine is safe (not to be confused with the safelist, which is a different thing). This is fine, since you shouldn’t be installing the FW if your computer isn’t “clean” anyway. However, this means that if you have proof of concept applications already on your machine (such as leaktests) and run them, they will be allowed! In order to test v3 against such things, you must change to Train with Safe Mode before running them.
3a. Shortly after logging into Windows, you get the following popup from CFP, that it has detected a new network, and provides options to either be visible to the network (you will need this for corporate LAN and/or file/print sharing), or not have CFP tell you when new networks are detected. It states that you may close the window to skip it. I will tell you that you have to at least click OK (without choosing anything) or this will reappear every time the FW starts.
You may tell it not to detect networks, but that is actually a security feature – if someone physically added a 2nd network card, or wormed their way into your wireless network and started changing things, attempted to subvert your system by running a virtual network adapter, etc, this will help you be warned. So just a quick explanation about that.
- Installation Mode. On v3’s Summary page, toward the bottom in the Defense+ section you will see a line that says, “Switch to Installation Mode”, right next to an icon commonly used for installation packages. Before you install any new application, click this to switch modes. This allows v3 to monitor the installation process so that the HIPS won’t interfere with the install, but still protect your machine from other unrelated processes running which shouldn’t be.
When you do this and run the installation package, you will first get an alert that explorer.exe is accessing the installation executable; you may respond with Allow (but not Remember). The next alert will be that the installation executable is attempting to run (and access something); select in the dropdown to “Treat as an Installer” but not Remember (see screenshot). This will allow the installation to occur several levels deep (such as a completion after reboot, as some applications do). But if something new unrelated to the installation attempts to run, v3 will alert you.
- While following these installation steps will provide you the “out of the box” security that Comodo is already famous for, please be aware that this does not mean you won’t have any problems. This is the case with any and all computers, along with any and all software; there are a lot of variables involved, and some combinations of configurations just don’t play well together. That’s where this Forum, and Comodo’s Support site, are invaluable. Use the Advanced Search feature to narrow your results to the Firewall, to look for similar problems. If you have questions that aren’t answered, or need clarification, just ask; someone will be glad to help (Note: the Moderators are not Comodo employees, but volunteer users). When posting a new topic, please keep the Subject line concise and accurate to describe the problem (for example, “CPF blocks IE7” rather than, “Help! It doesn’t work!”). Also please look, and post, in the v3 section of the firewall boards, as 2.4 is still an active supported application; if you post in the wrong area, it will confuse the matter and interfere with our ability to answer your question.
Welcome to your new Comodo Firewall Pro v3 ~ Happy Hunting!