# $Header: /global/src/etc/cl-manage-scripts/patches/RCS/P-ip6tables-dont-allow-32768-61000+syn,v 1.3 2010/10/21 05:32:49 pb22 Exp $
# patch to not by default allow ports 32768 to 61000
# patch-file multipatches
# patch-file ~atches : 32768:61000.!.--syn
# patch-file hasno : tcp.--dport.32768:61000.-j.ACCEPT
# Fedora Core 6 does not have 32768:61000 at all :-(
# patch-file distmatches = Fedora|CentOS|Red.Hat.Enterprise.Linux
# Process using /usr/bin/cl-patch-file unless matching the above
--- /etc/sysconfig/ip6tables	2008-03-06 06:52:52.000000000 +0000
+++ /etc/sysconfig/ip6tables	2008-03-06 06:55:47.000000000 +0000
@@ -21,1 +21,1 @@
--A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 -j ACCEPT
+-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 ! --syn -j ACCEPT
--- /etc/sysconfig/ip6tables	2009-07-19 05:41:20.000000000 +0100
+++ /etc/sysconfig/ip6tables	2009-07-19 05:42:22.000000000 +0100
@@ -20,3 +20,2 @@
-#2 cl.cam.ac.uk: we do not want to open up a wide set of ports by default
-#A RH-Firewall-1-INPUT -p udp -m udp --dport 32768:61000 -j ACCEPT
-#A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 -j ACCEPT
+-A RH-Firewall-1-INPUT -p udp -m udp --dport 32768:61000 -j ACCEPT
+-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 ! --syn -j ACCEPT
