Matthew Dillon committed changes from Andreas Hauser that makes the default firewall setup (in /etc/rc.firewall relatively normal and usable.