Comment by mrsssnake

ISP hosting a virtual machine you remote desktop into from internal network as the only way to access the external internet can also work as a "de facto firewall".

But the best de facto firewall is a proper firewall.