Interesting. I guess M$ is talking about those corporate routers which close ports for both directions. For a $100 router, they only close the ports from outside in. So you only need to open those for primary.