It blocks all incoming connections, which should really be the default on desktop #Linux.