Windows Filtering Platform does it. Windows Firewall barely taps WFP's potential and definitely does not do the whole "ZoneAlarm" style allow/deny thing.