iptables for bfgminer and eligius

[libertas]

I've set an INPUT policy of DROP and have written these rules:

# for bitcoin-qt
iptables -A INPUT -p tcp --dport 8333 -m state --state ESTABLISHED -j ACCEPT

# for bfgminer
iptables -A INPUT -p tcp --dport 3334 -m state --state ESTABLISHED -j ACCEPT

The bitcoin-qt client connects fine to the network but bfgminer is not able to connect to pool.
With a rule such as
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
bfgminer connects without problems.

So, as I'd like to be as restrictive as possible, what rule should I use for bfgminer?