Very Unhappy Now [Resolved]

willas00 · February 19, 2007, 1:08pm

nope still went down,

ive had enought if this cant be sorted im of to find another firewall its annying me to hellp now >:(

pandlouk · February 19, 2007, 3:09pm

Hi willas00,

I’m sorry to see you have trouble with CFP. How do you connect in internet? What is the model of your modem?

willas00 · February 19, 2007, 3:13pm

I Connect via USB Its a Webstart Modem From Telewest (Virgin Media) I know its not the modem and its defo Comodo Firewall

pandlouk · February 19, 2007, 3:25pm

I didn’t say that it is the modem. I asked for the model for checking it’s settings.

Have you tried to disable “Do protocoll analysis”? Sometimes it gives troubles.

willas00 · February 19, 2007, 3:28pm

sorry i know u say its not the modem was just making it clear

how do i disable “Do protocoll analysis”?

and would this work?

pandlouk · February 19, 2007, 3:37pm

You will find it at:
Security → Advanced → Advanced Attack Detection and Prevention → Configure → Miscelanous

Give it a try and we will see.

willas00 · February 19, 2007, 3:41pm

ok ive done that

from IP Config:

    Lease Obtained. . . . . . . . . . : 19 February 2007 13:02:31
    Lease Expires . . . . . . . . . . : 20 February 2007 02:02:46

So its due to renew 2night at 02.02.46 so we shall see

any other ideas in the mean time let me know i really want to sort this out

pandlouk · February 19, 2007, 3:48pm

Lets hope it will work.

ps.Can you provide a link with the instructions/manual of your modem? I 'll take a look at it and try to understand what is causing this problem.

willas00 · February 19, 2007, 4:03pm

Modem Manual

http://www.sciatl.com/products/consumers/userguidepdfs/webstar_userguides/DPC2100A.pdf

pandlouk · February 19, 2007, 4:13pm

Thanks I did not found a clue. But you can try this to check if CFP let the pc to renew the IP. Do the following:

To renew the IP address for Windows 2000, NT, XP systems

Open a Command Prompt (DOS) window.
At the C:/ prompt, type ipconfig/release and press Enter. The system
releases the IP address.
At the C:/ prompt, type ipconfig/renew and press Enter. The system
displays a new IP address.
To close the Command Prompt window, click on the X in the upper right
corner of the window. You have completed this procedure.

if it renews the IP, with CFP on, you should be ok.

willas00 · February 19, 2007, 4:18pm

i remember doing this a few days ago and it would not do it

pandlouk · February 19, 2007, 4:22pm

Yes, but you did not have the “do protocoll analysis” disabled. I asked you to do it, for checking what happens when this feature is disabled.

willas00 · February 19, 2007, 4:30pm

yes it worked!

my ip stayed the same but all connection came back

i was asked to let svhost out to the DCHP i clicked allow and it done!

pandlouk · February 19, 2007, 4:35pm

:BNC Now you should be ok. :■■■■

willas00 · February 19, 2007, 4:38pm

well its due to renew at 16.26 UK Time 2morrow so we shall see (:HUG)

willas00 · February 26, 2007, 11:39am

Well just to let you know every thing has been running fine no porblems what so ever… IP renewing perfect with CFP on! :BNC :BNC (S)

Triplejolt · February 26, 2007, 3:57pm

I figured allowing the outbound svchost.exe connection on UDP 68 would do the trick

pandlouk · February 26, 2007, 5:34pm

OK. Thanks willas00. Now I can add this solution at the faq section. ;D

Actually since CFP allows by default the outbound of svchost.exe it did not make any deference. svchost.exe send the data but the feature Do Protocol Analysis blocked the information that arrived from the dchp server. Disabling Do Protocol Analysis did the trick.

Triplejolt · February 27, 2007, 8:31am

Really?
I’ve always had to allow outbound svchost.exe on port UDP 68/67. Blocking it denied the DHCP to retrieve any IP’s. Protocol analysis or not

rebel69 · March 3, 2007, 11:49am

I tried adding the additional rules, but there were already rules in place on the server for svchost.exe so I changed them per the above instructions. Then I disabled and enabled the nic on the workstation forcing a dhcp request. The two alerts that appeared on the server were for c:\windows\system32\tcpsvcs.exe. I allowed and remembered both of them and now the workstation is able to acquire an IP address.

The rules are:

application: C:\WINDOWS\system32\svchost.exe
parent: C:\WINDOWS\system32\services.exe
action: Allow
protocol: TCP/UDP
direction: In
destination IP: Any
destination port: Any

application: C:\WINDOWS\system32\svchost.exe
parent: C:\WINDOWS\system32\services.exe
action: Allow
protocol: TCP/UDP
direction: Out
destination IP: Any
destination port: Any

application: C:\WINDOWS\system32\tcpsvcs.exe
parent: C:\WINDOWS\system32\services.exe
action: Allow
protocol: TCP/UDP
direction: In
destination IP: Any
destination port: Any

application: C:\WINDOWS\system32\tcpsvcs.exe
parent: C:\WINDOWS\system32\services.exe
action: Allow
protocol: TCP/UDP
direction: Out
destination IP: Any
destination port: Any