This might have been avoidable using a software firewall that doesn't defacto allow outbound connections.

That's a big maybe.