I am back to Sygate, but with Kerio 4, the advanced mode of course!
Even if no package rules, you get to be asked what to allow in application rules, and not to accept server rights when not needed.
Beware of the famous Kerio BSOD's, hehe.
It is a most comprehensive free easy firewall, if there were not those