In some email I received from Manuel Bouyer, sie wrote:
> 
> In fact the previous behavior was a bug :)
> The new behavior cause problems only if you use ftp or rsh proxy (that is,
> protocols that need incoming TCP connections to dynamic ports).
> But the rigth thing to do here would be to have to ftp or rsh proxy
> dynamically update the filters when required. Darren, are you listening ? :)

hmm ?  They should be setting up keep state things to let through the
other connection automatically, if you use them.

Darren