LDS.org not working inside firewall

[craiggsmith]

Had a major problem with this on Saturday during stake conference, but unfortunately I didn't have time to call support. I couldn't even get a trace to complete.

[ShariCarnahan]

The issue is the Comcast modem. There is an internal firewall that is getting turned on during a modem refresh. LDS.org is apparently blacklisted in their firewall configuration. The workaround is to turn off the modem firewall. I have sent instructions with the login info to Global Services. I can PM the login info to people here, I am not comfortable putting the login credentials in the forums.

[craiggsmith]

Thanks, but how does that explain the fact that it's intermittent and works most of the time? At any rate, I've sent a PM for the login info and will check it out. You are correct in not posting it here.

[ShariCarnahan]

It is intermittent I believe because the modems are upgraded on rotating schedule.
When the modem is refreshed the modem resets.

I will send you a pm when I get to a location I can get to my notes.

[danpass]

... I am not comfortable putting the login credentials in the forums.

Caution is advisable when considering whether or not to post login credentials. However in this case, assuming you are referring to the default administrator credentials for Comcast business gateway products, these credentials are documented on Comcast support pages such as this one and not considered confidential. Because of this, it is advisable to change the administrator password to something other than the default. Any discussion on that point, however, should occur in new thread and not this one.

[craiggsmith]

I took a look at the modems and this is all I see:

comcast_firewall.JPG (28.6 KiB) Viewed 2045 times

I don't see the typically options, and nothing is set up on any of the other tabs either, so I'm not exactly sure what I need to do. But a search implies I should check the 2nd box. Any thoughts?

[ShariCarnahan]

I was told all three should be off. That we don't want to use the Comcast firewall settings in the modem. I do have a incident number with Comcast that you could try to reference.
I will be back in my office tomorrow with the notes I took.

[craiggsmith]

I'm not sure how to interpret everything, but the 3rd box does sound like it will enable a firewall feature when it's checked. The 1st box sounds like maybe the firewall is disabled generally and checking it will turn it on except for a static PI subnet, but I'm not sure. But the 2nd box sounds like it is disabling a firewall feature when it's checked. There are a number of comments out there that say that checking it will resolve problems with random external site access.

I don't know why there isn't a master enable firewall box. At any rate, they were already unchecked so I don't think that's the answer -- unless Comcast unchecked them between the time we got the error and the time I checked them (one day).

When I tried to do a tracert when we were having problems I couldn't even get a response beyond the first or second server, so I don't know what route it was trying to take.

[danpass]

I think what you really want is to get the modem configured to bridge mode. The settings you are working with will establish a pseudo or virtual bridge mode, but will not disable routing completely. Unless your particular modem's admin interface has this configuration option exposed, Comcast support will most likely need to be contacted. They can make this change remotely. See the 3rd post in this Comcast forum topic.

[ShariCarnahan]

The only problem with the modem in bridge mode is doing diagnostics with a computer (bridge mode disables all but one port on the back of the modem) if there is a problem.