Say I have a Windows Server (let's go with Windows Server 2012, but I'm thinking in general). It's running IIS. We have our standard website, accessible via port 80 (HTTP) and 443 (HTTPS). And let's throw in an FTP server (ports 21 and 22) for administration. Standard user authorization on that (no anonymous FTP). Otherwise everything is in the default settings and we have whatever applications that Windows includes and runs by default.
What's the implications now if we allowed all incoming connections in the firewall?
If I understand correctly, this is almost akin to disabling the firewall -- it turns it into a blacklist, but by default there isn't any block rules, so it's like the firewall wasn't there. I can't think of anything that would be listening on a port that the firewall blocks access to, so can't see what the difference is (and trust that Windows can handle data sent to closed ports appropriately).
EDIT: Actually, I decided to try this on a server that I have access to (hopefully this wasn't a completely stupid idea). I ran an nmap port scan on that server and found the following ports are open (some I have descriptions for but don't know what they are):
- 21 (FTP)
- 80 (HTTP)
- 3389 (ssl/ms-wbt-server?)
- 5985 (Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP))
- 8172 (Microsoft IIS httpd 8.5)
- 47001 (Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP))
- 49152-49164 (RPC)