Got it to work:

with -net:

qemu-system-i386 -net nic,model=rtl8139 \
  -net user,hostfwd=tcp::3389-:3389,hostfwd=tcp::443-:443,hostfwd=tcp::992-:992 \
  -m 512M -localtime -cpu core2duo,+nx -smp 2 -usbdevice tablet \
  -k en-us -hda win.img -nographic

Original answer: redir (legacy)

qemu-system-i386 -net nic,model=rtl8139 \
  -net user,hostfwd=tcp::3389-:3389 \
  -redir tcp:443::443 -redir tcp:992::992 \
  -redir tcp:5555::5555 -redir udp:1194::1194 -redir udp:500::500 \
  -redir udp:4500::4500 \
  -m 512M -localtime -cpu core2duo,+nx -smp 2 -usbdevice tablet \
  -k en-us -hda win.img -nographic