> A good firewall would protect from WanaCrypt

The attack could come from the internal network (it spreads first via email). Also, don't forget the upnp shenanigans