Do not use conflicting blanket rules
Windows Firewall gives conflicting explicit block rules precedence over allows. An all-application block plus a narrow allow is not a generic exception recipe. Verify the actual engine and effective merged policy.
Do not change the whole machine’s default outbound policy for one workload. Confirm exact program/package or authorized identity scope and the conjunction of identity, endpoint and protocol.
Services, entries and updates
Test terminal, original executable, Start menu, IDE and scheduled entry. Children, elevated helpers and services under another identity are not automatically covered. Paths may change after updates.
WSL and VMs need host and guest checks. Keep remote access and other software intact; filter/driver failure is unknown until safely tested.