It is not a good idea to turn on Internet Connection Firewall on any connection that does not directly connect to the Internet. If you turn on Internet Connection Firewall for the network adapter of a client computer that is running Internet Connection Sharing, Internet Connection Firewall interferes with some communications between that computer and all other computers on the network.

For a similar reason, you cannot use the Network Setup Wizard to turn on Internet Connection Firewall on the Internet Connection Sharing host private connection. This is the connection that connects the Internet Connection Sharing host computer with the Internet Connection Sharing client computers. Turning on a firewall in this location would prevent network communications. It is also necessary to consider the effects ICF has on some email programs and messenger programs.
You do not have to use Internet Connection Firewall if your network already has a firewall or proxy server.

In summery

• If a computer is a client computer to an ICS (Internet Connection Sharing) host, do not enable ICF, but be sure you do enable it on the host computer.
• If a computer is behind a NAT box or router, don't enable ICF, because the inherent properties of NAT will protect you.
• If you're in an enterprise/corporate environment, don't enable ICF while logged into a domain at work because your IT staff will have proper commercial firewalls in place on the network. In most cases, user policies will prevent you from enabling ICF if you are logged into a domain.
• If you've logged on at home using cached credentials and enabled ICF, user policies will probably prevent you from using ICF at work, but you will be able to use it at home while not protected by the corporate firewall.

If your network has only one shared Internet connection, it is a good idea to try to protect the network by turning on Internet Connection Firewall. Individual client computers may also have adapters, such as a dial-up or DSL modem that provide individual connections to the Internet and are vulnerable without firewall protection. Internet Connection Firewall can check only the communications that cross the Internet connection where you have turned it on. Because Internet Connection Firewall works on a per-connection basis, you must enable it on all computers that have connections to the Internet to help protect your whole network.
If you turned on Internet Connection Firewall on the Internet Connection Sharing host computer's Internet connection, but a client computer with a direct Internet connection is not using Internet Connection Firewall for protection, your network is vulnerable through that unprotected connection.

The service definitions that permit services to operate across Internet Connection Firewall also work on a per-connection basis. If your network has multiple firewall connections, you must configure service definitions for each Internet Connection Firewall connection through which you want the service to work.

• VPN Usage: If you're a VPN user and connect to a remote office, you should not use ICF. Turn it off before you start your VPN session.
• File and Print Sharing: Some broadband providers offer connectivity for more than a single computer and supply multiple public routable IPs. In this case, computers are connected to a hub or switch (rather than a router or NAT box) that connects to a cable or DSL modem. Since ICF disables file and print sharing using TCP/IP, you may need an alternative method of sharing files among your own computers. You can install an additional network transport protocol such as IPX/SPX that will enable you to transfer files between your computers.
  To install IPX/SPX, from the Connection Properties dialog box,
  1. select Install, then select Protocol,
  2. Add and then NWLink IPX/SPX/NetBIOS Compatible Transport Protocol.
• Outgoing Windows Messenger Calls Behind ICF: If you are using Windows XP Professional, ensure you are using an account with administrative privileges; otherwise outbound calls will not work. Users of Windows XP Home Edition are assigned the proper administrative privileges by default.