#
# the rules this machine runs behind, in card mode: everything ether0
# sends or receives is matched here, whoever sent it.  See fwrules(6).
#
# The local segment.  On a qemu NAT this is where the gateway and the
# resolver both live, so it has to come before anything else works.
allow=out	ip=10.0.2.0/24

# Name resolution and the web, for traffic leaving the segment.
allow=out	proto=udp	port=53
allow=out	proto=tcp	port=53
allow=out	proto=tcp	port=80
allow=out	proto=tcp	port=443

# Ping, so there is something to check the firewall with that does not
# need a name resolved first.
allow=out	proto=icmp

# The one port this machine answers on: rcpu.
allow=in	proto=tcp	lport=17019

# Anything not named above is denied, in both directions.  There is no
# rule for that; it is what happens when nothing matches.