I am not wanting to make that the default way of running the firewall (just an option). Also the part about common exploits being known for "services" running on ports 1-1024 doesn't apply, as this isn't going to be one of the services. An attack on the firewall itself would work, considering the fact it is going to be open source, it would be trivial for someone to find a coding mistake in it, and exploit it, BUT since it is open source it would be just as easy for anyone on the net to patch that hole and keep that exploit from working.

Cheeseball