The WatchGuard Mobile VPN for Windows Mobile client includes two firewall components:
Link firewall
The link firewall is not enabled by default. When the link firewall is enabled, your Windows Mobile device drops any packets received from other computers. You can choose to enable the link firewall only when a Mobile VPN tunnel is active, or enable it all the time.
Desktop firewall
This full-featured firewall can control connections to and from your Windows Mobile device. You can define friendly networks and set access rules separately for friendly and unknown networks.
For more information, see Enable the Link Firewall and Enable the Desktop Firewall.