:::<li>All outgoing traffic is allowed.</li>:::<li>Responses to any traffic the machine sends out are allowed.</li>:::<li>Traffic on the loopback interface is allowed.</li>:::<li>The host machine (and <b>only</b> the host machine) must be able to ssh to that cloning-source VM.</li>:::<li>ICMP traffic is allowed if it originated with the <b>local network only</b>.</li>:::<li>As this is acting as the secure basis for later machines, no other traffic should be allowed.</li>