At 09:49 p.m. 02/03/2008, you wrote:
+1 on increasing the threshold, 1024 is way too low.
With the current patch, I agree. I'm planning to implement the scheme
described in the port randomization internt-draft I referenced, and
implement the array-of-bits thing. That way you can exclude whichever
ports you want, without "wasting" the 1024-9999 port range.
Also consider the folk who depend on the existing behaviour: a
predictable ephemeral port range is useful, if for some reason you
need to apply a NAT policy to that traffic, with no other
knowledge about how the applications you must NAT actually behave.
You can still set porthi or portlow to select whichever port range
you want. The patch just changes the default case.
As noted in one of the sections of the draft I referenced, turns put
that each TCP/IP stack chooses its own range for the ephemeral ports.
So unless you're tweaking the configuration of each of the systems
you have behind the NAT, I'm afraid you won't be able to implement
such a policy. FWIW, Windows used the range 1024-4999 or something...
at least W95 and XP. Vista probably still does the same thing.
Kind regards,
--
Fernando Gont
e-mail: [EMAIL PROTECTED] || [EMAIL PROTECTED]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
