you need the allow and out interface, otherwise traffic won't be returned to the correct place