Because it's an ingress firewall and by default netstat -an returns zilch, so a firewall would have zero work to do.