If you are behind a router with network address translation enabled,
NAT is
NOT a form of security !
UPnP and reverse proxies are just two ways to bypass NAT.
I seem to recall a PPRuNe user by the name of XV105 discovered the hard way what UPnP was capable of.... and it all happened automatically because he just plugged in a new NAS storage box he bought.
However I do agree that top priorities are (a) running up to date software and (b) running up to date anti-virus.
The problem with many free firewalls are that they're nothing more than packet filters with a GUI bolted on. You want something more intelligent with decent rulesets.