Controlling ports used by natd

[Brett Glass]

At 05:19 PM 12/12/2003, Barney Wolff wrote:
  
>For most systems, the coarse granularity of sysctl net.inet.ip.portrange
>would seem sufficient.

This brings up an interesting point. I just typed

sysctl -a | grep portrange

into a recently minted 4.9 box, and got:

net.inet.ip.portrange.lowfirst: 1023
net.inet.ip.portrange.lowlast: 600
net.inet.ip.portrange.first: 1024
net.inet.ip.portrange.last: 5000
net.inet.ip.portrange.hifirst: 49152
net.inet.ip.portrange.hilast: 65535

Why is "lowfirst" greater than "lowlast" above?

It is also interesting that natd doesn't respect the
"hifirst..hilast" settings here. Shouldn't it look at
these variables and avoid assigning ports that the
machine on which it's running would not use? Or should
there be a "net.inet.alias.portrange.first", etc., so 
that one could specify the ranges or lists for everything 
in one place? 

>I have a real philosophical problem with ceding ports to worms, viruses
>and trojans.  Where will it stop?  Portno is a finite resource.

In theory, it stops when all Windows users have patched their machines.
Alas, this will happen when a very warm place freezes over. :-( 

In practice, I think we need to come up with something better than the
notions of "well-known" and "privileged" ports. Something that, unlike
portmap, is easy for firewalls to work with.

--Brett