How to Install Comodo Firewall

This guide was written for version 5.9, also known as 2012, of Comodo Internet Security (CIS). This guide will also work equally well for configuring Comodo Firewall, but the screenshots are from CIS.

Index

1. Overview of HIPS Programs

2. Installing Comodo Internet Security

3. Configuration

   • A) General Configuration

   • B) Configure Antivirus

   • C) Configure Firewall

   • D) Configure Defense+ / Sandbox

4. Further Questions

1. Overview of HIPS Programs

If you're concerned about your PC's security then using a Host Intrusion Prevention System (HIPS) is a great addition to your protection regime. A HIPS prevents unknown programs from altering any part of your system without permission. Therefore malware is automatically prevented from doing any damage.

In this way HIPS is superior to detection-based software, such as traditional antivirus applications, because it will stop any type of malware. It will even protect you against zero-day malware. A HIPS is able to do this because it automatically blocks any files that have not been verified as safe. It then asks you if you want to give them access to your computer. Of course the obvious downside to this approach is that just as there are many millions of malicious programs there are also millions of safe ones. Because HIPS vendors cannot instantly analyze every possible legitimate program it's quite possible that you may receive questions about some safe programs, as well as dangerous ones.

In response to this HIPS vendors have developed extensive whitelists. These are databases of known safe programs. If a program is known to be safe, or is produced by a trusted vendor, you won't have to answer any questions about it and the program will be allowed complete access to your computer. Thus the number of alerts you get for everyday applications is very small.

With the strength of a HIPS you may be wondering if you still need to run a traditional antivirus software alongside it. While you can theoretically do without one, assuming you know which programs to allow or block, my advice is to still use an antivirus. With a traditional AV in the loop most threats will be eliminated before the HIPS can even examine the suspect file. Thus if a signature for the particular malware already exists, which is not always the case, you will be protected from the possibility of making a bad decision. There are pros and cons to both HIPS and antiviruses but I find that they complement each other very nicely.

Comodo Firewall is one of the best known HIPS firewalls, and for good reason. In addition to providing rock solid protection it's also entirely free. If you like you can even download Comodo Internet Security, which comes with Comodo Antivirus. This is also completely free and very reliable. 

2. Installing Comodo Internet Security

Before installing security software designed to protect your computer I find it's best to first ensure that your computer is clear of malware. I know it sounds like strange advice but this can prevent many problems further down the road. For this please follow the advice that I give in my article about How to Know If Your Computer Is Infected.

If your computer is clean then there is one thing I'd do. As described in that article you can submit the safe programs, that are unrecognized, on your computer to Comodo. Instructions for how to submit programs, or individual files that belong to programs, can be found in this topic of the Comodo forums. Make sure you read through the first post entirely.  Only post download links for them if you are sure that the program is safe. Otherwise post links to the scanning results, as explained in the post. These submissions will be quickly analyzed by Comodo staff and, if appropriate, added to the whitelist. However, in order to submit programs you do need to have an account on the Comodo forums. If you don't already have one then it's very easy, and rewarding, to get one. There is an option to register on the top of any page on the Comodo forums. By doing this you will ensure that CIS will be very quiet on your computer. Once all the programs are trusted on your computer than the only time you will see an alert is the first time they try to connect to the internet or when they update. Thus CIS will become very quiet for you. After this is done you can proceed to download the installer. Here are the download locations for either Comodo Internet Security or Comodo Firewall. If, at a later time, you decide that you want to switch from one to the other than you can accomplish this by going to the start menu, finding Comodo, and selecting the option to "Add and Remove components".

During installation you will be given the choice to change your DNS servers to Comodo Secure DNS Servers. If you don't know what a DNS server does then I would recommend you read this article on What DNS Servers Do. Personally, I would recommend switching to the Comodo Secure DNS Servers because it will automatically block any websites that Comodo knows to be dangerous. However, if you would prefer to use another DNS server, or just use the default one from your ISP, then you can deselect that option. Also, I would leave the option to “enable 'Cloud Based Behavior Analysis' of unrecognized programs” checked. This will upload all active unrecognized programs to Comodo for analysis. It will only do this if they have not already been uploaded from someone else's computer. These files will then either be added to the safelist or added to the definitions for the antivirus. This is done entirely on Comodo's end so that you don't have to do any work.

Other than that I advise that you select the small option near the bottom of the window that says "Customize Installer". This will give you the option to change some parts of the program before it is even installed. Assuming you're installing both the antivirus and firewall, and will be following the rest of my advice, then I would consider the option to install Comodo GeekBuddy. This is a free trial program with which Comodo technicians can remotely diagnose, but not fix, problems with your computer. This trial period will only start once you first use it. If you decide to purchase the product then the technicians can also remotely fix any problems with your computer. However, if this does not sound useful then you can choose to not install it. Also, if you do choose to install it you can always choose to uninstall it later. Personally I choose not to install it, but the choice is yours. You are also given the option to install the Comodo Dragon browser. If you do not wish to install this then deselect this option.

After installation is complete, assuming you installed CIS, it will begin scanning your computer. If you followed my advice above, and your computer is not infected, you can cancel this scan. You may also choose to disable User Account Control (UAC). Personally I do disable it. However, there are some reasons to leave it enabled if your computer has more than one user. One problem is that disabling this will turn off protected mode in Internet Explorer. It will also disable file/registry virtualization for Windows Vista and 7. In general, UAC controls who can run specified applications that require elevated Administrator privileges. For more information please read this article.

UAC can be very useful for computers that have more than one account. If this is the case then instead of disabling it you may prefer to use a program like TweakUAC to disable it on one account or switch it to 'quiet mode'. This program  is reviewed in this article. My advice would be that if you only have one user account then disable it. However, as always, the choice is yours.

3. Configuration

Configuring Comodo Internet Security, or Comodo Firewall, actually isn't that difficult. The default configuration is quite robust. However, there are some changes that can be made to increase this protection even further.

A) General Configuration

First you should change the default configuration to Proactive Security. To do this right click on the icon for CIS, in the taskbar, and select the option for "Configuration". Select "Proactive Security". It will prompt you to restart. Restart your computer. "Proactive Security" is the most secure configuration of Comodo Internet Security.

B) Configure Antivirus

Assuming you chose to install Comodo Internet Security you also installed the antivirus component. Open the program and go to the Antivirus tab. Click on “Scanner Settings” and select the tab for “Manual Scanning”. Under this tab I would recommend selecting the option to “Enable cloud scanning” and also to “Submit unknown files for analysis. What this will do is always check files against the very latest definitions and send all unknown files to Comodo for analysis. This will not only help increase their databases of malware and safe files, which will help you and everyone else in the community, but your scans would also be more likely to catch the latest malware. The problem with this setting is that your scans will take longer to complete.

Also, for those who are sure that their computer is clean, there is a trick to get rid of the message telling you that you have to scan your computer. For this follow these steps. Go to the tab for “Exclusions” and select the button for “Add” and then “Browse Files”. In the box where it asks to “Add new item” just put a (*). Type this without parenthesis. This will tell it to exclude all files. Select Apply. After this make sure that you select "OK". This will save your settings. If you don't do this then all of your changes will be lost. Now run the full scan. After it has finished, which shouldn't take long, you need to go back to the “Exclusions” tab and remove that exclusion. It's very important that you remove this exclusion. If it is left in then the antivirus component will not warn you about any dangerous files. To remove it simply go back the the antivirus excusions tab, left click on the (*) exclusion, and click remove. Then select "OK".

C) Configure Firewall

There are also some changes that can be made to the Firewall component. Open the program and go to the Firewall tab. Click on "Stealth Ports Wizard" and select the option to "Block all incoming connections and make my ports stealth for everyone". In general this is the best choice but it may interfere with some programs. If you have problems getting a program to connect to the internet instead select the option to "Alert me to incoming connections and make my ports stealth on a per-case basis". This will configure the firewall to ask your permission any time there is an incoming connection that Comodo Internet Security doesn't already know to allow or block.

While still under the Firewall tab go to the "Firewall Behavior Settings". Select the tab for "General Settings" and select the option to "Enable IPv6 filtering". Also, if you are not using TrustConnect you can deselect the options to "Show Trustconnect alerts for unsecured wireless networks" and to "Show Trustconnect alerts for public networks". This way it will not warn you about it. TrustConnect is a very useful tool but not everyone is willing to pay for it. If you're one of those people, but still spend a lot of time connecting through unsecured wireless networks, then perhaps you would be interested in the free version of TrustConnect. It can be found on this page and inserts ads for Comodo products at the top of your pages. Also, it does require creating an account, but it's definitely worth it.

Now open the tab for "Alert Settings". Unless you are using Internet Connection Sharing on your network, and this PC is the "gateway", you can safely uncheck the box that says "This computer is an internet connection gateway". You can read more about Internet Connection Sharing on this site but if you don't already know what it is the chances are very high that you don't have it enabled.

Now open the "Advanced" tab and check the box to "Do protocol analysis". If your computer is part of a network, such as a wireless network, you should also check the boxes to "Protect the ARP Cache" and "Block Gratuitous ARP Frames". If you are not part of a network then you do not gain any security by checking them. You can check the other two boxes if you like, but they may affect performance. As before, you need to select "OK" in order to save your settings. If you don't do this then all of your changes will be lost.

After configuring the firewall portion of Comodo Internet Security this is what your configuration may look like.

D) Configure Defense+ / Sandbox

Now open the tab for "Defense+" and go to "Defense+ Settings". Open the tab for "Execution Control Settings". I would recommend changing the option to "Treat unrecognized files as" from "Partially Limited" to "Untrusted". Each time a program is sandboxed you will get a popup that asks you if you want to never sandbox it again. If you select not to then it will be added to your trusted files list. Only allow a program if you are 100% sure that it is safe. You can check the files by following the methods described in How to Tell if a File is Malicious. Select "OK" to save your changes.

In order to be protected from all malware that I am aware of you need to make one more change to your configuration. Please go to the "Defense+" tab and select "Computer Security Policy". Ignore the warning that pops up and continue. Inside of this select the tab for "Protected Files and Folders" and hit the edit button. Select yes and scroll down the list. Left click where is says "3rd Party Protocol Drivers". Click "Add" and then from the drop-down menu click "Select From". Then choose "Browse". In the box for "Add new item" just copy and paste in the following path "\Device\KsecDD". Be sure that when you do this you do not include the quotes. Click "Apply" and then click "yes". Select "Apply" again and then click "OK" to save these changes. What you have just done is cut off the access that unknown programs have to the Windows encryption tool. This could have been used by some malware to encrypt your files. Thus, since you have cut off their access to it, you are protected.

There are also other options for how to treat unrecognized files. You can read more about these on this page of the online help files.  To learn more about how Comodo's Sandbox works you can read this Introduction to the Comodo Sandbox. Also, if you do ever notice malicous behavior on your computer then restart the computer and the malicious processes should be gone upon reboot. That's the way the sandbox was designed.

4. Further Questions

Now Comodo Internet Security should be configured for maximum protection and maximum usability. At this point restart your computer and see if there are any problems. If you do have any questions then please peruse these FAQ's. If you still find your questions unanswered then you can search the Comodo Forums for a solution. If someone hasn't already created a post with the same problem please feel free to join the forum and create a post of your own. The community will do their best to help you with any problems that you may encounter.

If you believe this article deserves anything less than 5 stars please leave a comment below explaining how you think it can be improved or where you find fault. In fact I would appreciate any feedback, positive or negative, so that I can improve the article. Your opinions and advice are much appreciated.

If you found this article useful then perhaps you'd like to check out some my others.

How to Know If Your Computer Is Infected

How to Stay Safe While Online

How to Tell if a File is Malicious

How to Protect Your Online Privacy

How to Avoid Getting Spammed

How to Report Spam

This software category is maintained by volunteer editor Chiron. Registered members can contact the editor with any comments or suggestions they might have by clicking here.