While working T429563: Put cloudvirt10[77-80] in service I accidentally tried to put cloudvirt1077 in service with firewall (nft) in place, whereas regular cloudvirts don't run a firewall at all.

As it turns out, the set of ports to open is not a whole lot, I found the following while testing VM connectivity and live migration:

1. tcp 16514 for libvirt tls communication to/from cloudvirt (cloud-private)
2. tcp 49152-49215 to/from cloduvirt for libvirt migration (right now happens on prod network, though we can/should change it to cloud-private with live_migration_inbound_addr (T430129)
3. udp 4789 for vxlan/neutron, unclear to me if we can restrict it to a set of cloud hosts (cloud-private)
4. tcp 5671 for cloudrabbit (cloud-private)
5. tcp port range TBD for ceph (prod)