Blocking all incoming connections

I bought a Teracube 2e and am new to /e/OS. I would like to know if all incoming network connections are blocked by default?

If not, what is easiest way to achieve this so that internet still works?

If it requires a firewall, what is the best way to get root access for AFwall+?