From df23ccfe824eb2d6ea579d4ecd0e56483a5f3c37 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Thu, 5 Jul 2007 16:13:38 +0000
Subject: [PATCH] Set the ephemeral port range starting port to 1024 instead of
 49152.

On a busy firewall it is possible to run out of ephemeral ports and
 then the system will block new connections until a port is available.

---
 cf/conf/config.xml      | 5 +++++
 conf.default/config.xml | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/cf/conf/config.xml b/cf/conf/config.xml
index 10c44dbc50..76259035ef 100644
--- a/cf/conf/config.xml
+++ b/cf/conf/config.xml
@@ -5,6 +5,11 @@
 	<lastchange></lastchange>
 	<theme>nervecenter</theme>
 	<sysctl>
+		<item>
+			<desc>Set the ephemeral port range to be lower.</desc>
+			<tunable>net.inet.ip.portrange.first</tunable>
+			<value>1024</value>
+		</item>
 		<item>
 			<desc>Drop packets to closed TCP ports without returning a RST</desc>
 			<tunable>net.inet.tcp.blackhole</tunable>
diff --git a/conf.default/config.xml b/conf.default/config.xml
index 0fe509505f..b94e2036b0 100644
--- a/conf.default/config.xml
+++ b/conf.default/config.xml
@@ -5,6 +5,11 @@
 	<lastchange></lastchange>
 	<theme>nervecenter</theme>
 	<sysctl>
+		<item>
+			<desc>Set the ephemeral port range to be lower.</desc>
+			<tunable>net.inet.ip.portrange.first</tunable>
+			<value>1024</value>
+		</item>
 		<item>
 			<desc>Drop packets to closed TCP ports without returning a RST</desc>
 			<tunable>net.inet.tcp.blackhole</tunable>