incoming: force block by default, apply default action and allow LAN per rules

firewall/master.go

@@ -54,7 +54,6 @@ var defaultDeciders = []deciderFn{
 	checkBypassPrevention,
 	checkFilterLists,
 	checkCustomFilterList,
-	dropInbound,
 	checkDomainHeuristics,
 	checkAutoPermitRelated,
 }
@@ -539,15 +538,6 @@ func checkDomainHeuristics(ctx context.Context, conn *network.Connection, p *pro
 	return false
 }
 
-func dropInbound(_ context.Context, conn *network.Connection, _ *profile.LayeredProfile, _ packet.Packet) bool {
-	// implicit default=block for inbound
-	if conn.Inbound {
-		conn.Drop("incoming connection blocked by default", profile.CfgOptionServiceEndpointsKey)
-		return true
-	}
-	return false
-}
-
 func checkAutoPermitRelated(_ context.Context, conn *network.Connection, p *profile.LayeredProfile, _ packet.Packet) bool {
 	// Auto permit is disabled for default action permit.
 	if p.DefaultAction() == profile.DefaultActionPermit {