AFAIU, the port range refers to the ports used to the client. If so, why would the web100srv ports need to be added?
If not, I misread the documentation of the policy files.