correct firewall configuration

A.default block all outbound

B. When use old version of window, priority button may not be available. So add character a in name to make it as first rule to block multicast IP address and broadcast IP address then start to allow port 53,443,80 optional to allow amazon EC2 desktop remote port 3389, if you are using NordVPN, then you have to email support to ask which port to allow. , Another optional allow port is time port, 123

C. You may find some allow rules controlled by default apps. This time you need to configure connection security rules

When you find log about IPsec these things , that means your time port is not allowed yet or there are unknown apps go to internet itself.