Comment by aidenn0

I actually think that's a sane default. With NAT it's a PITA to undo that and in some cases impossible (e.g. when you have 2 machines on a LAN using a protocol that requires a static port, so you can't just forward to a specific machine). With stateful firewalls, it should be much easier to just say "Allow port X through" and have a single application "just work"