No internet connectivity when phorm.com is blocked (split from monster phorm thread)

[Heed]

Originally Posted by tony

I,ve posted on comodo forums about this, will see if any answers are forthcoming, a bit sceptical re comodo forums due to the excessive fanboy attacks from previous questions placed.

---------- Post added at 20:00 ---------- Previous post was at 19:58 ----------



I have opendns setup in router, so don't use ntl dns.

And even using opendns you lost connectivity when you blocked phorm in Comodo?

That's interesting. Switching to opendns fixed the issue for me. I don't use a router, though. Just modem into LAN port.

---------- Post added at 20:07 ---------- Previous post was at 20:06 ----------

Originally Posted by kt88man

When I tested this earlier today it was using NTL's DNS servers (194.168.4.100 194.168.8.100) and I was unable to duplicate the problem when blocking phorm.com in hosts, or at router.

Does the same thing happen if you block webwise.net?

Nope, just phorm.com.

Originally Posted by Heed

And even using opendns you lost connectivity when you blocked phorm in Comodo?

That's interesting. Switching to opendns fixed the issue for me. I don't use a router, though. Just modem into LAN port.

---------- Post added at 20:07 ---------- Previous post was at 20:06 ----------

It seems that even though opendnds is setup in router when checking on opendnds website it says i am not using opendns.
Will have to checkout the router to ensure that all is setup ok

[Fobic]

I'm getting the same behaviour with Comodo.

I _think_ it's to do with the phorm.com hostname resolving to multiple IPs :-
88.208.250.66
88.208.250.85 and
207.44.186.90

I suspect Comodo isn't blocking the individual IPs, it's blocking the whole range from 88.208.250.66 to 207.44.186.90 - which encompasses the VM DNS servers (were your alternate DNS servers outside this range ?) and also the modem config page (192.168.100.1).

I tested this by blocking news.ntli.net (resolves to 62.253.170.163 and 80.5.182.99) and that stops me accessing www.google.co.uk (uses IPs 64.233.167.##) and www.namesdatabase.com (IP = 67.129.97.31) but DNS still works as does the modem config page and most other web pages.

Not an exhaustive test , but i think that's the problem.

BTW, adding the 3 individual IPs that phorm.com resolves to (not as a range!!) does block phorm.com without the adverse effects.

Originally Posted by The Jackal

Well I gave this a try

#$iptables -I POSTROUTING -t nat -s 0/0 -d 88.208.248.0/24 -p all -j DROP -v
#$iptables -I POSTROUTING -t nat -s 0/0 -d 88.208.249.0/24 -p all -j DROP -v
#$iptables -I POSTROUTING -t nat -s 0/0 -d 88.208.250.0/24 -p all -j DROP -v

And all seems to work so I'm still with the dodgy DNS servers theory. Block phorm should not block internet access completely.

That is blocking way more than phorms 3 ip addresses, not a very good idea.

Just block 88.208.250.85, 207.44.186.90 & 88.208.250.66

[kt88man]

Originally Posted by Fobic

I'm getting the same behaviour with Comodo.

I _think_ it's to do with the phorm.com hostname resolving to multiple IPs :-
88.208.250.66
88.208.250.85 and
207.44.186.90

I suspect Comodo isn't blocking the individual IPs, it's blocking the whole range from 88.208.250.66 to 207.44.186.90 - which encompasses the VM DNS servers (were your alternate DNS servers outside this range ?) and also the modem config page (192.168.100.1).

I tested this by blocking news.ntli.net (resolves to 62.253.170.163 and 80.5.182.99) and that stops me accessing www.google.co.uk (uses IPs 64.233.167.##) and www.namesdatabase.com (IP = 67.129.97.31) but DNS still works as does the modem config page and most other web pages.

Not an exhaustive test , but i think that's the problem.

BTW, adding the 3 individual IPs that phorm.com resolves to (not as a range!!) does block phorm.com without the adverse effects.

Well done that man... That looks a very plausible reason...

Just tried again after resetting router (seems config was corrupted somehow) and now am using opendns, with phorm.com set in blocked address in comodo no problems.
So this only occurs when phorm is blocked in comodo and ntl dns is used.

Originally Posted by tony

Just tried again after resetting router (seems config was corrupted somehow) and now am using opendns, with phorm.com set in blocked address in comodo no problems.
So this only occurs when phorm is blocked in comodo and ntl dns is used.

Fobic (above) has the answer - the OpenDNS servers are on 208.... - above the range bounded by the phorm.com addreses.

Originally Posted by JohnHorb

Fobic (above) has the answer - the OpenDNS servers are on 208.... - above the range bounded by the phorm.com addreses.

Yep, just read that, after i posted doh.

[The Jackal]

Originally Posted by Fobic

I'm getting the same behaviour with Comodo.

I _think_ it's to do with the phorm.com hostname resolving to multiple IPs :-
88.208.250.66
88.208.250.85 and
207.44.186.90

I suspect Comodo isn't blocking the individual IPs, it's blocking the whole range from 88.208.250.66 to 207.44.186.90 - which encompasses the VM DNS servers (were your alternate DNS servers outside this range ?) and also the modem config page (192.168.100.1).

Well spotted - Guess this forum is not full of dunces afterall.

Can the OP try just blocking the IPs instead of FQDN.

---------- Post added at 20:53 ---------- Previous post was at 20:51 ----------

Originally Posted by Paul M

That is blocking way more than phorms 3 ip addresses, not a very good idea.

Just block 88.208.250.85, 207.44.186.90 & 88.208.250.66

OP quoted he was trying to block a whole range so I replicated it as a test

[Heed]

Originally Posted by Fobic

I'm getting the same behaviour with Comodo.

I _think_ it's to do with the phorm.com hostname resolving to multiple IPs :-
88.208.250.66
88.208.250.85 and
207.44.186.90

I suspect Comodo isn't blocking the individual IPs, it's blocking the whole range from 88.208.250.66 to 207.44.186.90 - which encompasses the VM DNS servers (were your alternate DNS servers outside this range ?) and also the modem config page (192.168.100.1).

I tested this by blocking news.ntli.net (resolves to 62.253.170.163 and 80.5.182.99) and that stops me accessing www.google.co.uk (uses IPs 64.233.167.##) and www.namesdatabase.com (IP = 67.129.97.31) but DNS still works as does the modem config page and most other web pages.

Not an exhaustive test , but i think that's the problem.

BTW, adding the 3 individual IPs that phorm.com resolves to (not as a range!!) does block phorm.com without the adverse effects.

Nicely done!

Yes, that does seem to be the issue.

I tried your test of blocking news.ntli.net and those sites you listed are unreachable.

Just blocking the 3 phorm IP's doesn't cause any problems.

I'm glad that seems to solve the mystery.

The odd thing is this just began happening last night, so I'm guessing Comodo did an auto update last night that introduced the bug. I've had phorm.com blocked for over a week now.

Thanks to all for their input.

[Deko]

You might wan't to delete the cap files now

As it does seem its a SW fault of that firewall.

[monkey2468]

Fobic, nicely spotted!!

[NTLVictim]

If there was a category for "Most fascinating thread if you're a Techie", then this one would win!

[atsa2]

Read this thread with a great amount of interest - just finished setting up my laptop after a complete nuke and re-install. Symptoms were the same-ish, could connect to network (wired or wireless), get an IP address, then nothing. Couldn't even log into router. Phorm.com had been blocked for several weeks. After shutting down all programs like Comodo, Spybot, and AVG problem still remained.
As other machine on network (not running Comodo) worked fine , assumed it was a tcp/ip error. After an attempted repair using a borrowed disc failed, bit the bullet and used the recovery partition, and all now is fine. I eliminated the firewall as the problem remained after I had shut down the firewall... Is it possible that Comodo was still having an effect after being shutdown, or started in safe mode? Just interested as it all adds to my knowledge...

[Fobic]

Originally Posted by atsa2

I eliminated the firewall as the problem remained after I had shut down the firewall... Is it possible that Comodo was still having an effect after being shutdown, or started in safe mode? Just interested as it all adds to my knowledge...

It's very likely Comodo was still having an effect even though you had shut it down.

Most firewalls leave processes running when you close the user interface down (by clicking on the "quit" or "exit" menu items from the tool tray icon). In the case of Comodo , it leaves a process named cmdagent.exe running, and this seems to keep on blocking whatever the firewall was blocking before you quit it.

I've not tried starting in Safe Mode so I have no clue how Comodo behaves in that instance.

One thing that surprised me :- there is an option in Comodo Settings to "automatically start the application with Windows (Recommended)". Unticking this , I expected the firewall not to start up on a reboot and thus not block anything. However, cmdagent.exe still gets started and continues to do its blocking - it's just the user interface that isn't started. Weird.

Looks like the only way to test if unexpected behaviour is down to Comodo, is to uninstall it (unless anyone knows how to kill protected processes in XP ?)