Which blocking global rule do I need?

Help for v3
1

Hi!
Which is the right blocking rule for Global Rules?

  1. Block And Log ICMP In From IP Any To IP Any Where ICMP Message Is ECHO REQUEST
    or
  2. Block And Log IP In From Any To IP Any Where Protocol is Any?

Because the v.3.0.14.276 has the first, but the HELP file shows the second rule.

Thanks for the answer
Cheers
Gabor

2

The default rules are created based on parameters you input during installation, but that #2 rule should definitely be there.

That Block & Log IP In should be in the lowest/last position, as it is your safety net; the “Don’t allow if it’s not already approved” rule.

The ICMP rule is there to stop your computer from replying to an ICMP ping. However, as long as you don’t have a rule to Allow an ICMP Echo Request, the bottom rule should stop it.

LM

3

I see.
So do I need both blocking rules or any other extra blocking rule?

4

I’d have both. Make sure the BLOCK IP rule is at the bottom of the list and the BLOCK ICMP rule just above that.

Whether you need to have any other BLOCK rules is totally dependant on your system, your applications and your web habits. Unfortunately there is no one answer to this question.

Cheers,
Ewen :slight_smile:

5

Strange…
I only have the rule “Block And Log ICMP In From IP Any To IP Any Where ICMP Message Is ECHO REQUEST”.
But yesterday I still had the second rule. See here.
I don’t know why it disappeared??
I add it now manually.
Thanks

6

Thanks panic, I have it now. :wink:
And thank you too Little Mac. :wink:

7

I removed the rule again, because I can’t use the Internet with.
I mad a port-scan and it says I’m secure.
So I let it removed.

8

Do you use peer to peer (Skype, uTorrent etc) and installed accordingly? I think that’s why you got the Block And Log ICMP In From IP Any To IP Any Where ICMP Message Is ECHO REQUEST" as the only rule.

9

Correct! if you chose "yes I do use peer2peer apps option then the only rule you will get is Block And Log ICMP In From IP Any To IP Any Where ICMP Message Is ECHO REQUEST and I can now confirm that 100%

if you chose no you do not use any peer2peer app you will get this block rule instead
Block And Log IP In From Any To IP Any Where Protocol is Any

those are the only two rules i can guarantee confirmation on, i’ve grown tired for now digging deep into the firewall lol. we need a new user guide cos somethings none of us are gonna be able to figure out completely

oh if you got the first rule cos you chose Yes you use peer2peer, then you may want to tick the fire as an event rule log for it since the setup installation leaves it unchecked by default. also you might want to make sure the log size in miscellaneous settings is set to 2mb instead of 0mb

10

Hi little Mac, which rule are you suggesting one should defintely have, is it Block And Log IP In From Any To IP Any Where Protocol is Any ?

I only have one global rule and it is Block And Log ICMP In From IP Any To IP Any Where ICMP Message Is ECHO REQUEST I have a router though and my router already blocks pings to my PC so that rule is a bit redundant for me then eh.

I use peer2peer apps, etc, if thats the rule you was talking about
→ 2. Block And Log IP In From Any To IP Any Where Protocol is Any?
then can you tell me what will it do for me and should i add it? to my global rules, keeping in mind i have only one rule in global rules already so if I was to add it, it would be nice if you can tell me in what order to make sure the rules are in

thanks

Ron

11

I’d still like to know if I need to add any rules to use with public Wifi. (:SAD)

12

I believe if you use the stealth port wizard it will change the global rules.

13

The best thing to use with public wifi is Comodo’s TrustConnect. It’s like an SSL VPN to a Comodo anonymizing proxy. There’s a separate forum board for this.

Ewen :slight_smile:

14

Yes, this is the rule you should DEFINITELY have, IMO. I did not realize that the p2p wizard in v3 removed that instead of adding other rules to Allow only what you need. (IMO, that needs to be revamped.)

Basically, it’s the same as for 2.4, if you used that version of CFP previously. You need to define the TCP and UDP ports specifically within your p2p app, turn off UPnP features for automatic port assignment, and then create an individual rule for each port/protocol combination at the TOP of the Global Rules, to Allow In.

Pandlouk has written a detailed tutorial on it, here:
https://forums.comodo.com/frequently_asked_questions_faq_for_comodo_firewall/tutorial_for_utorrent_with_comodo_firewall_3-t15677.0.html

Hope that helps,

LM

15

Hi LM,

I use upnp and I’m keeping it enabled, main reason is because a few of my peer2peer apps, needs direct connection to certain ports, but because I’m behind a router they can’t, I could either open a port or a set of ports manually in my router, but i would still get limited results in such apps as dc++ and shareaza, shareaza is even worse, it uses port 6346 by default or any other port one wants to choose instead for that app, but every hub and network and there is about 4 different networks maybe more on shareaza all do not confirm to using just one port, the port ranges from 1037 - 65535 in general. it wouldn’t be a good idea i feel me setting up my router to open all them ports, so hence after extensive days of researching as much info i could find about Upnp i decided to enable it on my router and winxp, its been working aright CFP alerts me to anytime upnp ports wants to establish an outgoing connection, always for legit purposes, I’ve never encountered it misbahaving so far.

I use trueimage so i have a image backup of my system, so i don’t mind trying things out to see if they work and what they do for me.

Yep your right, p2p wizard only creates one global rule the → "Block And Log ICMP In From IP Any To IP Any Where ICMP Message Is ECHO REQUEST " one

taking into consideration i use upnp and i find it a benefit and that it doesn’t make my PC anymore insecure so i will be leaving it on, could i still use that global rule → “Block And Log IP In From Any To IP Any Where Protocol is Any” ?

I’m intererested in seeing if I can restrict Shareaza for instance to only use port 6346 on my machine, for data flow in and out to be restricted to that port, and that global rule you suggested looks like it may block any IP incoming connection unless its permitted by any app in application rules.

Pandlouk has written a detailed tutorial on it, here: https://forums.comodo.com/frequently_asked_questions_faq_for_comodo_firewall/tutorial_for_utorrent_with_comodo_firewall_3-t15677.0.html
i have been through these posts and all of them articles on here on creating such policies and was none i could get my head around or understand :-\ and worse of all I couldn't see how to implement such rules for myself and to get them to work, but that one global rule you've suggested, I am interested in trying to understand it and seeing what it can do for me and then to implement it and get it working right.

thanks for all the help :slight_smile: I’ll try and gather as much info as i can to help me better understand and get my head around this

16

I was new to Comodo, was only 3 weeks that I had been using 2.4 and I had it setup in the default mode, whatever that is, i can’t remember lol. and the only things i would do is click, what to allow or set to block in the pop up alerts.

such stuff as tcp/udp i didn’t have the required understanding on and only until CFP 3.0.14.276 have i started to mess with such stuff and creating firewall policies. So its all new to me lol only so much i can understand unless its explained in a way i can get my head around and i can implement it and see it working. :-\

17

Haven’t seen any postings on wifi with newer info than the thread at https://forums.comodo.com/help_for_v3/standard_block_all_rule_missing_in_v3-t16922.0.html;msg116449#msg116449 . I have no new comments, other than a reminder to ignore noncritical requests from the router-just because it sends a UDP to your nbname every minute or so doesn’t mean you shuld allow it. :wink: