The /usr/libexec/lxc/lxc-net script adds some default firewall rules.
But those don't specify a policy for the input chain so it gets an
accept policy by default. That's not good.

It also makes it a bit pointless that rules are then added that accepts
DNS and DHCP traffic.

The default configuration is to use RFC-1918 addresses for lxc guests
and that makes it hard for traffic from the outside (I assume we can
restrict ourselves to protect against that), but it's hard to be sure,
and I guess it's also possible to configure the networking so LXC guests
are more directly connected to the outside while still relying on that
chain.