Avast 7 and Comodo Firewall

[Hellion]

Hi Hardov,

No Solution yet... Not even a response from a Avast team member.

Two work-arounds:

Disable Webshield. - Comodo will work perfectly, but no web traffic will be scanned.
Enable "Scan traffic from well-known browser processes only" - This will allow Most connections to be blocked by Comodo, but popular software like Mozilla and Thunderbird will go through unhindered.

[hardov]

Hi Hardov,

No Solution yet... Not even a response from a Avast team member.

Two work-arounds:

Disable Webshield. - Comodo will work perfectly, but no web traffic will be scanned.
Enable "Scan traffic from well-known browser processes only" - This will allow Most connections to be blocked by Comodo, but popular software like Mozilla and Thunderbird will go through unhindered.

Ok thanks so muchs for the help!

[Hellion]

Hi All,

Updated to the latest version today.

Cleared my rules and tried again.

Firefox still connects like there isn't a care in the world even though it is explicitly blocked and Comodo logs it as blocked.

[lukor]

Hi guys,

this is really very interesting. Matousec's leak tests show 100% for COMODO, yet, apparently the firewall is not able to catch a Web proxy which our WebShield is.

I am not saying that Comodo is a bad firewall, on contrary, it is highly regarded, but maybe this might be a contribution to the relevancy of the leak tests -- as I see it from my brief glimpse on this issue, any program acting in the same way as avast does can overcome the firewall rules. Somewhat surprising for a product with such high leak-test "certification".

Concerning the fix from avast! side: I doubt we would fix this, making changes in the code, so that other firewalls block our traffic is exactly the opposite what we try to do.

Nice comment on the Comodo forum from the moderator though:

   
Re: Comodo Does not work with Avast 7!
« Reply #3 on: February 24, 2012, 06:27:55 AM »
This seems like an issue with Avast.
They changed the code. They will have to fix it.

I only hope that malware and unwanted programs follow the same guideline.

Lukas.

[true indian]

Well,no problems here...my firewall is on medium....and i have turned on block fragmented IP [since i dont use printers]...

[Hellion]

Hi Lukor,

Thanks for your comment on this!

Regarding Matousec... I do not trust in the legitimacy of those tests anymore.
According to them Comodo is the only FW that works and everything else is crap... Different firewalls work in different ways and I believe their testing to favour certain Firewalls more than others....

But Comodo is a good and very popular FW.

That being said, I believe there to be a very large number of users affected by this and it's a serious issue.

I bug report has been submitted to Comodo, but there has been no sign of a fix anywhere.

[lukor]

Hi Hellion,

we have changed one driver in the v7. We abandoned the old and not supported TDI interface and started to use the new one (well, its already a few years old, but still newer) - WFP. I bet this is why Comodo has now troubles filtering our proxy requests and while at the same time allows traffic from the avastsvc.exe (where WebShield is hosted) these things together create that hole.

I would love to help Comodo understand the method we currently use and help them change the firewall in such a way that they are able to see and block that - should I be contacted by anyone.
The method we use is fully supported and documented and from several meetings with other companies I know for sure there are several (if not many) major products out there that use the same - so I guess such fix in Comodo will help not only Avast users but also many others.

L.

[Hellion]

Hi Lukor,

Thanks, that was very clarifying.

Here is the Comodo forum discussion - https://forums.comodo.com/firewall-help-cis/comodo-firewall-and-avast-7-t82382.60.html

Here is the Comodo Bug report - https://forums.comodo.com/bug-reports-cis/cis-firewall-fails-to-block-connections-for-blocked-applications-with-avast-7-t82440.0.html

[Hellion]

Hi All,

Well,no problems here...my firewall is on medium....and i have turned on block fragmented IP [since i dont use printers]...

@ Winmaltech,

You do know that streaming video also uses Fragmented IP packets

[Asyn]

Nice comment on the Comodo forum from the moderator though:

   
Re: Comodo Does not work with Avast 7!
« Reply #3 on: February 24, 2012, 06:27:55 AM »
This seems like an issue with Avast.
They changed the code. They will have to fix it.

I only hope that malware and unwanted programs follow the same guideline.

Lukas.

LOL

[DogStar]

Thanks for posting lukor. I'm not sure if you noticed my earlier post, but this is not confined to Comodo, it also affects Windows 7 built in firewall, which obviously uses the Windows Filtering Platform. So, the question is, as I asked earlier, does Comodo use WFP and, if so, does this mean that any firewall, also using WFP, can be bypassed by this change?

By the way, the Matousec tests are HIPs tests, not firewall tests, which is why they're completely irrelevant. 

[cyberrufus]

PrivateFirewall is also affected.

[mesamit]

No issues with online armor...

[Hermite15]

Nice comment on the Comodo forum from the moderator though:

   
Re: Comodo Does not work with Avast 7!
« Reply #3 on: February 24, 2012, 06:27:55 AM »
This seems like an issue with Avast.
They changed the code. They will have to fix it.

I only hope that malware and unwanted programs follow the same guideline.

Lukas.

LOL

yeah I already had a good laugh about that ROFL 

[hardov]

Hi guys,

this is really very interesting. Matousec's leak tests show 100% for COMODO, yet, apparently the firewall is not able to catch a Web proxy which our WebShield is.

I am not saying that Comodo is a bad firewall, on contrary, it is highly regarded, but maybe this might be a contribution to the relevancy of the leak tests -- as I see it from my brief glimpse on this issue, any program acting in the same way as avast does can overcome the firewall rules. Somewhat surprising for a product with such high leak-test "certification".

Concerning the fix from avast! side: I doubt we would fix this, making changes in the code, so that other firewalls block our traffic is exactly the opposite what we try to do.

Nice comment on the Comodo forum from the moderator though:

   
Re: Comodo Does not work with Avast 7!
« Reply #3 on: February 24, 2012, 06:27:55 AM »
This seems like an issue with Avast.
They changed the code. They will have to fix it.

I only hope that malware and unwanted programs follow the same guideline.

Lukas.

What about Online Armor Free? can we use Online Armor free?