| Missing defaultroute on cerebus. See: rc.conf(5)

hmm, that didn't address the problem - ssh, telnet, etc. from either
host to the other still just hangs. (sorry, I should have been more
specific than "can't connect" in the original mail)

one new piece of information, though: with the defaultroute set, I can
now successfully ping, 'route get' and traceroute to outside hosts from
cerebus (there's a longish pause in the hop between alidoro and my ISP's
gateway), but any tcp connection from cerebus to the outside 'net also
hangs. is that useful?