How many port ranges are typically made available? One.. Two? Sounds like a trivial problem. In terms of concurrency, there are issues either way. Someone can open a port while it is being closed, and whether that works or not depends purely on timing. gustavo @ <a href="http://niemeyer.net">http://niemeyer.net</a> <div class="gmail_quote">On Aug 6, 2014 9:41 AM, "roger peppe" <<a href="mailto:roger.peppe@canonical.com">roger.peppe@canonical.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On 5 August 2014 19:34, Gustavo Niemeyer <<a href="mailto:gustavo@niemeyer.net">gustavo@niemeyer.net</a>> wrote: > On Tue, Aug 5, 2014 at 4:18 PM, roger peppe <<a href="mailto:rogpeppe@gmail.com">rogpeppe@gmail.com</a>> wrote: >> close ports 80-110 -> error (mismatched port range?) > > I'd expect ports to be closed here, and also on 0-65536. I'm not sure. An advantage of requiring that exactly the same ports must be closed as were opened, you can use the port range as a key, which makes for a very simple (and trivially concurrent-safe) implementation in a mongo collection. I'd suggest that this compromise is worth it. We could always make an initial special case for 0-65535 too, if desired. </blockquote></div>