BeforeEach(func() {
					fakeContainer.NetInReturns(0, 0, errors.New("oh no!"))
				})

				It("fails", func() {
					_, _, err := container.NetIn(123, 456)
					Ω(err).Should(HaveOccurred())
				})
			})
		})

		Describe("net out", func() {
			Context("when a zero-value NetOutRule is supplied", func() {
				It("permits all TCP traffic to everywhere, with logging not enabled", func() {
					Ω(container.NetOut(garden.NetOutRule{})).Should(Succeed())
					rule := fakeContainer.NetOutArgsForCall(0)

					Ω(rule.Protocol).Should(Equal(garden.ProtocolAll))
					Ω(rule.Networks).Should(BeNil())
					Ω(rule.Ports).Should(BeNil())
					Ω(rule.ICMPs).Should(BeNil())
					Ω(rule.Log).Should(Equal(false))
				})
			})

			Context("when protocol is specified", func() {
				Context("as TCP", func() {
					It("permits TCP traffic", func() {
						Ω(container.NetOut(garden.NetOutRule{
							Protocol: garden.ProtocolTCP,
						})).Should(Succeed())