A firewall won't do you a whole lot of good in this scenario since uPnP is allowed to punch holes and open up ports in it if you allow it to operate properly.
Sorry for the bad news.
-S
PS. This is why professional firewalls like Monowall will not even allow uPnP and they have no plans to support it.
__________________
 
|