diff --git a/cf/conf/config.xml b/cf/conf/config.xml
index 10c44dbc50..76259035ef 100644
--- a/cf/conf/config.xml
+++ b/cf/conf/config.xml
@@ -5,6 +5,11 @@
 	<lastchange></lastchange>
 	<theme>nervecenter</theme>
 	<sysctl>
+		<item>
+			<desc>Set the ephemeral port range to be lower.</desc>
+			<tunable>net.inet.ip.portrange.first</tunable>
+			<value>1024</value>
+		</item>
 		<item>
 			<desc>Drop packets to closed TCP ports without returning a RST</desc>
 			<tunable>net.inet.tcp.blackhole</tunable>
diff --git a/conf.default/config.xml b/conf.default/config.xml
index 0fe509505f..b94e2036b0 100644
--- a/conf.default/config.xml
+++ b/conf.default/config.xml
@@ -5,6 +5,11 @@
 	<lastchange></lastchange>
 	<theme>nervecenter</theme>
 	<sysctl>
+		<item>
+			<desc>Set the ephemeral port range to be lower.</desc>
+			<tunable>net.inet.ip.portrange.first</tunable>
+			<value>1024</value>
+		</item>
 		<item>
 			<desc>Drop packets to closed TCP ports without returning a RST</desc>
 			<tunable>net.inet.tcp.blackhole</tunable>