Generally speaking you should allow inbound connections as well, it contributes positively to the overall connectivity of the network. Lately there has been some issues opened on the Substrate repository about syncing slowing down and this was attributed partly to there simply being too many full nodes on the network. You can imagine that blocking inbound connections doesn't help this situation as your node will occupy slots on other publicly reachable nodes but doesn't itself offer any slots for other full nodes.

We're doing some research in providing ability to do hole punching over QUIC but that is likely months away which would take firewall configuration out of the equation and make it easier to allow inbound connections.

Generally speaking you should allow inbound connections as well, it contributes positively to the overall connectivity of the network. Lately there has been some issues opened on the Substrate repository about syncing slowing down and this was attributed partly to there simply being too many full nodes on the network. You can imagine that blocking inbound connections doesn't help this situation as your node will occupy slots on other publicly reachable nodes but doesn't itself offer any slots for other full nodes.

We're doing some research in providing ability to do hole punching over QUIC but that is likely months away but it would take firewall configuration out of the equation and make it easier to allow inbound connections.