syslog-conn 601/tcp Reliable Syslog Service syslog-conn 601/udp Reliable Syslog Service

Really? QOTD is blocked? What big threat is there from quote of the day? Did some nerd just sit down and arbitrarily pick antiquated unix services and mark them as "unsafe?"

  static const int kRestrictedPorts[] = {
  1,    // tcpmux
  ..
  587,  // stmp?
  601,  // ??
  636,  // ldap+ssl
  .. };