The qvm-firewall command in dom0 shows the firewall rules, as described in (Firewall VM with Custom Rules behind a VPN = No Internet - #16 by some.user7882)
$ qvm-firewall <name of the qube>
NO ACTION HOST PROTOCOL PORT(S) SPECIAL TARGET ICMP TYPE EXPIRE COMMENT
0 accept dl.delivery.mp.microsoft.com - - - - - -
1 accept download.microsoft.com - - - - - -
2 accept update.microsoft.com - - - - - -
3 accept windowsupdate.microsoft.com - - - - - -
4 accept windowsupdate.com - - - - - -
5 accept wustat.windows.com - - - - - -
6 accept ntservicepack.microsoft.com - - - - - -
7 accept go.microsoft.com - - - - - -
8 accept download.windowsupdate.com - - - - - -
9 accept - - - dns - - -
10 accept - icmp - - - - -
11 drop - - - - - - -