Alright, I am/was an idiot. Kept getting
$ nc -zv 1.2.3.4 80
nc: connect to 1.2.3.4 port 80 (tcp) failed: Connection refused
$ nc -zv 1.2.3.4 443
nc: connect to 1.2.3.4 port 443 (tcp) failed: Connection refused
but that just means that nothing is listening on the server side; if the rules would block, there would be no output, and netcat
would seemingly just hang.