It appears to me that the 2850n default firewall settings leave everything open (aside from the xNetBios > DNS rule). Is this correct and therefore does it mean to block incoming connections (WAN>LAN) I need to enter the rules to do so?

The firewall does not do anything by default because NAT protects you internal network from outside access.

You need to open a port using the NAT rules before anyone can access the network. At this point you can then lock down access to that particular port using the firewall rules.

Ah I see. Thank you.