Date: Sun, 6 Nov 2005 12:32:30 +0100 From: Marco Trentini <mark@remotelab.org> To: freebsd-doc@freebsd.org Subject: A little question in the config chapter (handbook) Message-ID: <20051106113230.GD14434@einstein.lab>
next in thread | raw e-mail | index | archive | help
While reading the chapter I met up in this section:
.....
<sect3>
<title><varname>net.inet.ip.portrange.*</varname></title>
<indexterm>
<primary>net.inet.ip.portrange.*</primary>
</indexterm>
<para>The <varname>net.inet.ip.portrange.*</varname> sysctl
variables control the port number ranges automatically bound to TCP
and UDP sockets. There are three ranges: a low range, a default
range, and a high range. Most network programs use the default
range which is controlled by the
<varname>net.inet.ip.portrange.first</varname> and
<varname>net.inet.ip.portrange.last</varname>, which default to
1024 and 5000, respectively. Bound port ranges are used for
outgoing connections, and it is possible to run the system out of
ports under certain circumstances. This most commonly occurs
when you are running a heavily loaded web proxy. The port range
is not an issue when running servers which handle mainly incoming
connections, such as a normal web server, or has a limited number
of outgoing connections, such as a mail relay. For situations
where you may run yourself out of ports, it is recommended to
increase <varname>net.inet.ip.portrange.last</varname> modestly.
A value of <literal>10000</literal>, <literal>20000</literal> or
<literal>30000</literal> may be reasonable. You should also
consider firewall effects when changing the port range. Some
firewalls may block large ranges of ports (usually low-numbered
ports) and expect systems to use higher ranges of ports for
outgoing connections — for this reason it is recommended that
<varname>net.inet.ip.portrange.first</varname> be lowered.</para>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
</sect3>
.....
The question is about last sentence of this section ("Some
firewalls may block ...."). While net.inet.ip.portrange.first
should be lowered when some firewall in general may block
ranges of low-numbered ports? I think it should be increased,
or not?
--
Marco Trentini mark@remotelab.org
http://www.remotelab.org/
pgp public key at:
http://www.remotelab.org/~mark/share/mark.asc
Key fingerprint = 2EBB 1F84 0FE4 FDB2 A40A D8DC B487 6AAD D755 239D
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051106113230.GD14434>