hmmmmmm ok, firewall rules sounds like a good bet then. Have you taken a look to see if the ports are changing back to a different value on the interface?