The first firewall rule I always set up is deceptively simple, but it sets up the structure for every other rule. That's a default of denying all incoming traffic.

FTP is a good example of the work a stateful firewall does. i forget if it is active or passive FTP. one always has the data channel on port 20. the other will negotiate the data channel port ...