Although windows firewall is required to be on when you "start" Internet Connection Sharing, you can stop the WF service with MMC. When done a client can still use the host machines internet. The firewall had port 80/http blocked, and now it is open for incoming traffic. However other ports used by applications on the host and client which communicate with each other still seem to be blocked. Can anybody explain what might be happening here? Doesn't ICS need windows firewall for NAT?

Note: I am not actually seeing anything in the firewall logs after stopping the service, but even packets sent localhost on the host machine never arriving on these other random ports.