OK, after about an hour playing last night I've decided that my idea of "block all, open what I need" was Really Dumb. I blocked everything, the firewall log filled up in about 10 seconds and despite opening assorted obvious ports everything still stopped working. goates' idea is much more sensible.
I think that i'll try blocking a few specific ports on the hardware firewall that I know I really never want stuff going out on - thanks for the suggestions Helen. For the rest, i'll allow it and hope that zone alarm blocks any nasty stuff.
Saab - i've given the firewall a good blasting from outside using the excellent
nmap. It's solid, as far as I can tell (and the grc.com tests pass too). I was wondering if I can get the firewall to prevent nasty stuff getting out.
(edit: what's the difference between TCP and UDP? Does anything need to send UDP packets out?)